Blockchain Client Security Checklist | Hashtag Web3

0 of 36 complete

Consensus Safety

Ensure consensus implementation is correct.

Fork choice rule implemented correctlycritical

Incorrect fork choice can cause chain splits or stuck nodes.

Finality conditions verifiedcritical

Blocks marked final must actually be final. Reorging finalized blocks breaks assumptions.

Slashing conditions correctcritical

Validators must be slashed for violations. Missing slashing allows attacks.

Byzantine fault tolerance maintainedcritical

System must tolerate f Byzantine nodes with 3f+1 total nodes.

Time synchronization handledcritical

Clock drift between nodes must not break consensus.

Edge cases in slot/epoch transitionscritical

Boundary conditions between slots and epochs are bug-prone.

P2P Network Security

Secure peer-to-peer networking.

Peer authenticationcritical

Verify peer identity. Prevent impersonation attacks.

Eclipse attack protectioncritical

Ensure node connects to diverse peers. Detect isolation attempts.

DoS protection on P2P layercritical

Rate limit messages. Disconnect misbehaving peers.

Message validation before processingcritical

Validate all P2P messages before acting on them.

Peer scoring implementedcritical

Track peer behavior. Penalize and disconnect bad actors.

NAT traversal handledimportant

Support nodes behind NAT. Use hole punching or relays.

Transaction Processing

Secure transaction handling.

Signature verification correctcritical

All transaction signatures must be verified. Missing checks allow forgery.

Nonce handling correctcritical

Nonces must be sequential. Gaps or repeats indicate bugs.

Gas/fee calculation accuratecritical

Incorrect gas can cause DoS or allow free execution.

Mempool DoS protectioncritical

Limit mempool size. Prevent spam transactions.

Transaction ordering deterministiccritical

Same inputs must produce same ordering. Nondeterminism causes consensus failures.

State Management

Secure state storage and transitions.

State root calculation verifiedcritical

State roots must be calculated identically across clients.

State pruning preserves necessary datacritical

Pruning must not remove data needed for validation.

Database corruption recoverycritical

Clients should detect and recover from database corruption.

State sync securitycritical

When syncing state, verify proofs. Do not trust peers blindly.

Archive node data integrityimportant

Historical data must remain accessible and correct.

Cryptographic Implementation

Cryptography must be correct.

Use audited cryptographic librariescritical

Never implement cryptography yourself. Use established libraries.

Constant-time operations for secretscritical

Timing attacks can leak private keys. Use constant-time comparisons.

Random number generation securecritical

Use cryptographically secure RNG. Weak randomness breaks security.

Key storage securedcritical

Validator keys must be encrypted at rest and in memory when possible.

Hash function collision resistancecritical

Use modern hash functions. Be aware of collision attacks.

Node Operations

Secure node deployment and operations.

RPC endpoints authenticatedcritical

Admin RPC endpoints must require authentication.

Metrics and logging securecritical

Logs must not contain secrets. Metrics endpoint should be internal.

Update mechanism securecritical

Software updates must be signed and verified.

Resource limits configuredcritical

Memory, disk, and connection limits prevent resource exhaustion.

Firewall rules appropriatecritical

Only necessary ports exposed. Admin interfaces internal only.

Protocol Upgrades

Handle hard forks and upgrades safely.

Fork activation testedcritical

Test fork transitions on testnet thoroughly before mainnet.

Rollback capabilitycritical

Have ability to roll back if upgrade causes issues.

Client diversity coordinationcritical

Coordinate upgrades across multiple client teams.

State migration verifiedcritical

If upgrade changes state format, migration must be correct.