Skip to main content

XCMv2 Audit Completed by Quarkslab

April 8, 2022 in Polkadot, Polkadot Audit
Avatarby Polkadot

XCM (Cross-Consensus Messaging format) provides a fundamental utility for the Polkadot technology stack. It enables seamless communication between blockchains as well as pallets (Substrate runtime modules) and smart contracts (including over bridges and sharded enclaves like Polkadot’s SPREE), fulfilling Polkadot’s foundational objective to be a fully-functioning, interoperable multichain ecosystem. Crucially, XCM is consensus agnostic, meaning it can be used to communicate between blockchains with differing consensus systems, and conceivably even between disparate ecosystems such as Polkadot and Ethereum.

Having a common messaging format broadens the scope of projects in the Polkadot and Substrate ecosystem, allowing cross-chain communication, a defining functionality for connecting chains and dapps not necessarily working under the same technology or consensus rules, providing a solid foundation for the future of Web3.

For background on XCM, see the recent series of blogs (Part I, Part II, Part III) by Polkadot founder Dr. Gavin Wood examining the importance and functionality of the format.

Auditing XCMv2

XCMv2, deployed first on Kusama, Polkadot’s canary network, has now been audited for a second time and is ready for production release. Because of the scope of cross-consensus messaging for the Polkadot network, it is crucial that every iteration of XCM undergoes independent review from external security organizations.

Quarkslab has completed a comprehensive second audit (a previous audit was already completed by another security firm) of XCMv2, an overview of which can be found here. The goal of this audit was to discover any potential cross-chain security or fairness issues, including logical bugs, denial-of-service, and incorrect lock/unlock or burn/mint on both chains.

The findings

Two security engineers from Quarkslab carried out the audit over a span of 50 man-days. They did not uncover any important security issues within XCMv2. Additionally, the scope of the audit included an examination of the underlying security of multiple XCM components. This makes the audit report useful for anyone interested in exploring the inner workings of XCM.

A full audit report can be found here.

Keep up to date with the latest XCM developments

Following the full audit, XCMv2 is ready for production release, and XCMv3 is currently in the final stages of development. For information on using XCM, watch the workshop from Parity’s Shawn Tabrizi. For updates, follow the xcm-format repository on GitHub, and follow Polkadot on Twitter and sign up for the newsletter.

Interested in building on Polkadot or Kusama? Get in touch!

From the blog

Decentralization

Empowering Decentralization: Polkadot DAO Allocates 3M DOT for DeFi Growth

With an overwhelming majority of voters in favor, the Polkadot community has chosen to allocate 3 million DOT to enhance the ecosystem’s decentralized finance (DeFi) landscape. Made through three separate proposals via Polkadot’s decentralized governance (OpenGov), this decision provides an accessible, deep layer of native liquidity to help the ecosystem flourish. It also demonstrates the power of community-driven initiatives to shape the future of decentralized finance.Hydration (formerly known

Real World Assets

Polkadot and the Future of Real World Asset Tokenization

The world of blockchain is rapidly evolving, and one of the most exciting developments is the emergence of Real World Assets (RWA) tokenization.  What are Real World Assets? RWAs represent a wide range of physical assets, such as real estate, precious metals, artwork, intellectual property, and commodities. By tokenizing these assets on the blockchain, we unlock new possibilities for liquidity, transparency, and accessibility in traditionally illiquid markets. Unleashing the Potential of RW

Consensus

Consensus 2024: Get Ready, Get Set, Polkadot

Polkadot is revving up for Consensus 2024 in Austin, Texas, from May 29th to May 31st. The road to this year’s conference is fueled by the community Indy 500 sponsorship and ecosystem teams and is set to be an unforgettable journey into Polkadot. Before Consensus Polkadot hackathon: North America edition 2024 April 15 to May 6, 2024 The Polkadot hackathon: North America edition 2024 is igniting the imaginations of developers worldwide, offering an unparalleled opportunity to dive deep into

Subscribe to the newsletter to hear about updates and events.