metadata: {"signature": "0xbcee142642eddb4f11ad58a0749030c43d2c5b8d3114f8a5f4ceb13f7c13f70518666c3d6e3cb2762f144c21ea3be485d29def89e7d0cf0fca1a2cef107f06dc1b", "application": {"round": "0xf50fa2dc5cbe583670323bc5acdeb02c447cd8b3", "answers": [{"type": "email", "hidden": true, "question": "Email Address", "questionId": 0, "encryptedAnswer": {"ciphertext": "LMwjZENytY/z/+LVCeteJ8+Vts/V4RwkloNybIkjBSY5lRCYDv4PQSN3hS70WB5o", "encryptedSymmetricKey": "b319407b630ef0ec867bbe68be58ced1fa0c8c889839fa4e9ed54a40769d3c36ac8d0755337b5d3c88d2505a50b2da17fccea5854f99a4ec83141f28d89182d961373a989d0fce87fdacba492e6cb233327c4fd6256c5736039e339dabdbb483ee26bc8963a03663e3e6ea2b33750f2a994a7df51456b1d26b4ccb78bac8ec98000000000000002027449509ccf5467416e7a79fecb0b5a8ff8c77f362e8221a5d06872cb947c47b00fc7faa697ce44631f4af740f800b8f"}}, {"type": "short-answer", "answer": "None", "hidden": true, "question": "Please Provide Prior Funding Sources Including Total Prior Funding for the project in USD", "questionId": 1}, {"type": "link", "hidden": true, "question": "Telegram Handle of Primary Contact", "questionId": 2, "encryptedAnswer": {"ciphertext": "VBwYiXzsvHufnyxsw7SVpZVbckBEDRXIPCoG+5iv9oWEucEpxWPBhC2Y+mlHn0LS", "encryptedSymmetricKey": "e34387233710e56655784977574ac14aaddaa79477965d397a6eb784dfeee8a3ebaceda5ab88adeb7c17956582fea21975e1b73ede18439089e4bc3144ce1a25a14ebddd04540cc4de428539c105304514799249295c8c96777f3bcc5b0c08a34393d028a70f8f455c547f793a509cfe78f4844897c41d418cc736c649ab129b0000000000000020ec861bd06c8639a29246f8e43b92f19641f8e7ae1323be2065d5d92bfd648bf1dcb2e9e50a1289f52d5df5c196d59cb1"}}, {"type": "short-answer", "hidden": true, "question": "Profiles or socials of other main team members publicly associated with the project", "questionId": 3, "encryptedAnswer": {"ciphertext": "gSzbSFhKyoPIm6NhHtAbJ38x47wICqepl/u3Bo5uPDw=", "encryptedSymmetricKey": "ab759a1bf29de87055d6067776fc9c00ca35d719c0cade5ff98b5ebca15b1386b2f2639e51b6468cdbf4a092d1464d0f844e55ca7f5bc406a51620fb72073b36781c114affa1189bf14dc62301d23b7290c1ae98065fa7d553758fe0d636bb96d705aeabc07b4faf0dd4420c91f441a7b5a0b97f6098e80f6fbb3349ed687c1d000000000000002018590778a48ebb89aea5ff2d23f541c46a1939a360ecbbf278e41f5a966187e9585af0c84d88a13f31f994915e55e4b2"}}, {"type": "link", "answer": "https://forum.avax.network/t/audit-improve-and-port-fundamental-avalanche-tools-to-openbsd-adj-round-1/2098", "hidden": true, "question": "Please provide a link to the forum.avax.network post detailing the application", "questionId": 4}, {"type": "paragraph", "answer": "Detailed in the post in the forum.\n\nAs we describe in the web page of this project, we started the porting effort in October 2023 by finding how to use the Core wallet in OpenBSD/adJ, see https://t.me/avalancheacademy/1/837", "hidden": true, "question": "Please explain how your project meets the round eligibility criteria", "questionId": 5}, {"type": "paragraph", "answer": "We expect that soon a new version of the library `blst` will be upgraded in all the fundamental open source tools of Avalanche (used by `avalanchego`, `coreth`, `avalanche-network-runner`, `subnet-evm`, `precompile-evm` and `avalanche-cli`)  and then in all the validators.  The new version includes a security improvement that we helped to shape and that will benefit directly all the avalanche network.", "hidden": true, "question": "How does your project benefit the Avalanche Ecosystem?  Please mention any existing or upcoming partnerships.", "questionId": 6}, {"type": "link", "answer": "https://t.me/AvalancheEnAdJ", "hidden": true, "question": "Please provide a link to your Public Group Chat (Discord or Telegram)", "questionId": 7}, {"type": "short-answer", "answer": "(1) We are the developers of adJ the distribution of OpenBSD with xlocale. See https://en.wikipedia.org/wiki/AdJ, (2) we are TON Award Recipients for porting the tools of the TON blockchain to OpenBSD/adJ (see  https://t.me/tondev_eng/26429)", "hidden": true, "question": "Is there anything else you'd like to share about your project, previous work, or other affiliations?", "questionId": 8}], "project": {"id": "0x94a296807c13932b607c43b0f2e2201a9fa9936a86f2f4f320b07c9a23103719", "title": "Improve the security of the Avalanche network by auditing, porting and testing its fundamental tools on OpenBSD/adJ", "logoImg": "bafkreicjekx2up5igmrlgmryzrtyxbnwuyqtq2u72sutgbemny5x63w56a", "metaPtr": {"pointer": "bafkreicmqlubjqdzwcbggjrukalnn3nwi7ifuass2s3bhkmogf34omseba", "protocol": "undefined"}, "website": "https://www.pasosdejesus.org/avalanche-adJ/index.html", "bannerImg": "bafkreiadnl3ryv2huugxfthwf4ja635bkwlnfaqqylo5n7mu47oemw52nm", "createdAt": 1713288934714, "userGithub": "vtamara", "credentials": {"github": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..9I4bNcPncXgkXMFiSj2o5YjrkEfKdbuZMb5s5HXlxElhZfxc1PB-GCbBY_YDf0aM2OPJ4h4YtcabZbFVhsxLBQ", "type": "Ed25519Signature2018", "created": "2024-04-16T17:08:15.511Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2024-04-16T17:08:15.511Z", "expirationDate": "2024-07-15T17:08:15.511Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x2e2c4AC19c93d0984840cDD8E7f77500e2ef978e", "hash": "v0.0.0:jMgNV9IRChHicb6fkbTaU3tMlmNatPeEFuRR60w3cWk=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextGithubOrg#pasosdeJesus#701221"}}, "twitter": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..RBTTq4ii9CrrtR3huWUhgTX5uUIJZPQ6zVHjnvRcizyuuMhJWL-10L-7MiiO4JhESwuo_RAKDTYlu2SvPqHODQ", "type": "Ed25519Signature2018", "created": "2024-04-16T17:07:25.230Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2024-04-16T17:07:25.230Z", "expirationDate": "2024-07-15T17:07:25.230Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x2e2c4AC19c93d0984840cDD8E7f77500e2ef978e", "hash": "v0.0.0:8GTsHv2TY2pgasZsJn3xarA9BCVV4B8YDP58pmmJiaw=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextTwitter#VladimirTamara"}}}, "description": "We propose to improve the security of the Avalanche network as a whole by:\n\n1. Auditing the source code of the Avalanche tools and some of the libraries on which they depend. To audit we will follow the [methodology of OpenBSD](https://www.openbsd.org/security.html)\n\n2. Porting the libraries and the fundamental avalanche tools to OpenBSD/adJ (at least `avalanchego`, `subnet-evm`, `coreth`, `avalanche-network-runner`, `precompile-evm` and `avalanche-cli`)\n\n3. On OpenBSD/adJ run the tests of the Avalanche tools and use them with different use cases (including a validator and developing dApps) and with loads as close as production as possible to discover runtime failures that could point to security flaws.\n\n4. Report the problems found and recommend ways to improve and/or propose Pull Requests to fix them.\n\nUp to now we have concentrated more in the porting effort but it already gave fruit in improving security:\n* We contributed 3 pull requests with small improvements in portability. They were already merged in the main avalanche tools\n* We contributed one pull request that adds support for OpenBSD to `avalanchego`.  This one is waiting approval and hopefully merging.\n* We helped to improve the security of one library that is central for the Avalance protocol.    The Avalanche protocol depends on the BLS12-381 signature, in the source code it is implemented by the library  [supranational/blst](https://github.com/supranational/blst). Using our methodology we reported a crash of this library in OpenBSD/adJ  due to a security feature of that OS (see [issue 206](https://github.com/supranational/blst/issues/206)). With our feedback the author of `blst` solved the problem and improved the security of the library with the  commits [dae1f](https://github.com/supranational/blst/commit/dae1f9416f157112be1dc46209a32ed5414fd525) and [6cca1](https://github.com/supranational/blst/commit/6cca12ac0c10ca8752d1788ee44891261c0f272a) --a constant table required for the cryptographic BLS12-381 signature library now is in a section for constants (`.rodata`) not allowing an attacker to modify it after the program starts.\n\nWith the funding of this project we will go through a full audit of the sources, completing the porting effort and more integral testing to keep contributing pull requests and suggestions to improve the security of Avalanche tools and the libraries that they depend on.\n\nPlease see details of the results as we progress in the project  [web page](https://www.pasosdejesus.org/avalanche-adJ/index.html)", "lastUpdated": 0, "projectGithub": "pasosdeJesus", "projectTwitter": "VladimirTamara"}, "recipient": "0x8BFA46F6c184550e499304809f9133F907a0471f"}}