Securing Aleo: a deep dive into zkSecurity audits and resilient blockchain infrastructure
Hello, tech enthusiasts! I’m Heorhii, and I’m thrilled to delve into a riveting exploration of zkSecurity, a crucial component shaping the security landscape in the Aleo blockchain. In this article, we’ll unravel the significance of zkSecurity, scrutinize its audits, and unveil the robust security measures it fortifies in Aleo’s synthesizer and consensus.
So, fasten your seatbelts as we embark on a journey into the heart of zkSecurity, understanding its pivotal role in ensuring a robust security baseline for cutting-edge blockchain applications. Let’s dive in!
What is zkSecurity?
zkSecurity specializes in auditing zk-proof systems, their apps, and associated protocols, including secure multi-party computation protocols. These audits provide companies with a security baseline, ensuring that their offerings meet stringent security standards.
Importance of zkSecurity:
- Verification of zk proof systems: zkSecurity conducts audits to verify the integrity of zero-knowledge-proof systems. For Aleo, this involves scrutinizing their synthesizer, a pivotal component in the deployment and execution of user programs on the Aleo blockchain.
- Ensuring consensus integrity: the consensus mechanism is the heartbeat of any blockchain. zkSecurity audits Aleo’s consensus mechanism, ensuring its resilience and trustworthiness.
- Upholding privacy and confidentiality: with a focus on privacy-centric applications, zkSecurity ensures that Aleo’s protocols maintain the highest standards of privacy and confidentiality.
zkSecurity’s audit of Aleo:
1. Aleo synthesizer:
- Audited for deployment and execution of user programs.
- Thoroughly documented, rigorously tested, and well-specified.
- Core protocol wrapped around Varuna, Aleo’s Marlin-based zk proof system.
In the zkSecurity audit conducted on Aleo’s synthesizer, the focus was on ensuring the security and functionality of the core protocol used in the deployment and execution of user programs on the Aleo blockchain. The audit, initiated on September 11th, 2023, spanned three weeks, involving in-depth scrutiny of Aleo’s codebase by two consultants.
Key findings:
- Code evaluation: the codebase of Aleo’s synthesizer was found to be not only thoroughly documented and rigorously tested but also well-specified, contributing to a robust foundation.
- Program overview: Aleo’s synthesizer wraps Varuna, the Marlin-based zk proof system, providing a high-level interface for users to deploy and execute programs. The synthesis process encompasses user program deployment, execution flows, and fee collection.
- Programming languages: Aleo supports two programming approaches: using the Leo programming language or the Aleo instruction language. Leo programs are eventually compiled down to Aleo instructions, the form used for program deployment and execution.
- Aleo programs: programs in Aleo consist of structures similar to Ethereum smart contracts, including a list of imported programs, public mappings, and executable functions. Functions are split into two parts to handle contention issues and are executed locally on a user’s machine, verified by the network through zero-knowledge proofs.
- Circuit synthesis: the SnarkVM synthesizer’s primary role is to produce zk proof circuits encoding the functions of an Aleo program. This involves parsing the program into Aleo instructions and converting each instruction into its corresponding circuit gadget.
- Function calls: the synthesizer handles the complexity of allowing functions to call other programs’ functions. Each function call results in two circuits — one for the caller and one for the callee. The execution of a root function is encoded as a list of transitions, representing the execution of individual function calls.
- Program deployment: users can deploy Aleo programs, which involves uploading the program’s code to the Aleo blockchain and deploying verifier keys for each function on-chain. Verifier keys, along with their proof of correctness, ensure the integrity of the deployed program.
- Function execution: executing a function involves the production of transition proofs and inclusion proofs. Transition proofs demonstrate the correctness of function calls, while inclusion proofs verify the existence of records used as inputs. All these proofs are eventually aggregated into a single proof using Varuna’s batching capabilities.
The audit report, well-received by the Aleo team, provides a comprehensive understanding of the synthesizer’s intricate processes, highlighting its strengths and areas of optimization. For detailed insights, the complete zkSecurity report is available here.
Public report of Aleo’s synthesizer:
2. Aleo consensus:
- Audited Bullshark (partially synchronous version) and Narwhal implementation.
- High-level consensus logic in snarkOS scrutinized.
- Ledger service dependencies checked.
In the audit conducted by zkSecurity on Aleo’s Bullshark consensus, the focus was on ensuring the reliability and security of the consensus protocol. The audit spanned three weeks, involving a thorough review of Aleo’s codebase by two consultants.
Key findings:
- Code quality: the Aleo codebase was found to be meticulously documented and of high quality.
- Cooperative collaboration: the Aleo team exhibited a highly cooperative approach, aiding in the identification and resolution of several issues.
- Consensus protocol — Bullshark: Bullshark, Aleo’s consensus protocol, was examined for its three-step committing process, involving proposal, voting, and committing.
- Pipelining techniques: Bullshark introduced innovative pipelining techniques, with every participant proposing in every round, enhancing the efficiency of the consensus process.
- Commit rule: the commit rule in Bullshark involves a leader’s batch being committed if there are f+1 certificates referring to it in even rounds.
- Quorum intersection property: the quorum intersection property ensures that committed anchors are eventually accepted by all honest nodes.
- Timeout mechanism: timeouts are incorporated to manage delays in proposing and certifying leaders and anchors, ensuring protocol efficiency.
- Garbage collection: to prevent unbounded storage growth, a garbage collection protocol is implemented, pruning older parts of the DAG after commits.
The audit report, well-received by the Aleo team, offers detailed insights into the protocol’s strengths, security measures, and areas of optimization. For an in-depth understanding, the full zkSecurity report is available here.
Public report of Aleo’s consensus (Bullshark):
Audit findings: Read the full zkSecurity reports for Aleo Synthesizer and Aleo Consensus here:
In conclusion, zkSecurity’s audits provide a critical layer of assurance for companies and users within the Aleo ecosystem. The commitment to privacy, decentralization, and security is not just a promise but a reality, backed by meticulous audits and prompt issue resolution. Aleo stands as a testament to the evolving standards of security in the blockchain space.
To know more, join now!
Aleo Twitter
Aleo Discord
Aleo Website
List of Aleo and Leo code and resourses
Prepared by Colliseum
