Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

blog: add 2024 code audit #206

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

blog: add 2024 code audit #206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions docs/_blog/2024_q4_code_audit.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
---
title: "2024 Q4 Code Audit"
description: "2024 Code Audit by Wizardsardine"
authors:
- Steve Myers
date: "2024-12-03"
tags: ["BDK", "project"]
draft: false
---

A heartfelt thank you to our friends at [Spiral](https://spiral.xyz/) for sponsoring a code audit of the current `bdk` 1.0.0-beta Rust codebase. The effort was led by [Antoine Poinsot](https://gist.github.com/darosior) from [Wizardsardine](https://wizardsardine.com/), who did a fantastic job provided insightful and actionable recommendations for the BDK team. You can find the full report [here](https://gist.github.com/darosior/4aeb9512d7f1ac7666abc317d6f9453b).
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

...who did a fantastic job provided... ----> ...who did a fantastic job providing...?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: possibly use Antoines GitHub Profile https://github.com/darosior instead of Gist Profile https://gist.github.com/darosior (even though I understand we link to his gist of the full report)? Just a suggestion though, either way totally works.

The effort was led by [Antoine Poinsot](https://github.com/darosior)


As outlined in Antoine's report, the audit's primary focus was to review the core components that constitute a BDK-based wallet, particularly the new methods for managing and synchronizing chain data. The audit scope included some reasonable simplifying assumptions, such as trusting that the Electrum or Esplora servers to which BDK wallets connect are not malicious. However, Antoine went above and beyond and also recommended a few simple fixes we can do to guard against certain types of bad server behavior.

While no critical defects were identified, a potential denial of service/performance issue was uncovered, along with opportunities to improve the code's fault tolerance and API documentation. The team is currently addressing the performance issue, as well as some of the more straightforward recommendations. All suggested improvements have been [added to our issues backlog](https://github.com/bitcoindevkit/bdk/issues?q=is%3Aissue+label%3Aaudit) for future releases.

If you are a user or potential user of BDK, or a Bitcoin Rust developer, we would love to hear your feedback. Please reach out on the [BDK Discord](https://discord.gg/dstn4dQ) or comment on individual [Github issues](https://github.com/bitcoindevkit/bdk/issues?q=is%3Aissue+is%3Aopen). As a fully free and open-source project, the BDK team relies on YOU our community of users and contributors to help us deliver the best Bitcoin wallet library possible.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: change Github to GitHub for this or comment on individual [Github issues]

Loading
Loading