Cake Wallet publishes Inference's audit of Thorchain's Monero multisig implementation

Cake Wallet¹ has published Inference²’s audit³ of Thorchain⁴’s Monero multisig implementation⁵:

A few weeks ago, Cake Wallet reached out to auditors to review Thorchain’s Monero multisig implementation. This is a critical part of Thorchain’s code, since it is expected to be used to store native XMR used for liquidity providing and other functions of the Thorchain network.

The audit uncovered 2 potential security issues with low impact:

- S-CKW-001: [sign_multisig_parallel()] Unchecked parsing result (Exploitability: medium / Impact: low)
- S-CKW-002: [accu_multisig()] Undefined Behavior with Empty Signatures (Exploitability: low / Impact: low)

The report also produced 5 observations related to defense-in-depth, reliability, and performance:

- O-CKW-01: [Dockerfile] Leaked IP address
- O-CKW-02: [Dockerfile] unused ports
- O-CKW-03: Unused variables
- O-CKW-04: [RPC] on_check_transaction() can fail if two destinations have
the same amount
- O-CKW-05: [RPC] on_check_transaction() inconsistent failure handling

Before Thorchain can use Monero multisig, some PRs⁶ still have to be reviewed and merged. That would fix the recently disclosed vulnerabilities in the implementation of Monero multisignature wallets code, as previously reported⁷.

More details about this development can be found in Cake’s announcement thread⁸.