XCMv2 Audit Completed by Quarkslab
XCM (Cross-Consensus Messaging format) provides a fundamental utility for the Polkadot technology stack. It enables seamless communication between blockchains as well as pallets (Substrate runtime modules) and smart contracts (including over bridges and sharded enclaves like Polkadot’s SPREE), fulfilling Polkadot’s foundational objective to be a fully-functioning, interoperable multichain ecosystem. Crucially, XCM is consensus agnostic, meaning it can be used to communicate between blockchains with differing consensus systems, and conceivably even between disparate ecosystems such as Polkadot and Ethereum.
Having a common messaging format broadens the scope of projects in the Polkadot and Substrate ecosystem, allowing cross-chain communication, a defining functionality for connecting chains and dapps not necessarily working under the same technology or consensus rules, providing a solid foundation for the future of Web3.
For background on XCM, see the recent series of blogs (Part I, Part II, Part III) by Polkadot founder Dr. Gavin Wood examining the importance and functionality of the format.
Auditing XCMv2
XCMv2, deployed first on Kusama, Polkadot’s canary network, has now been audited for a second time and is ready for production release. Because of the scope of cross-consensus messaging for the Polkadot network, it is crucial that every iteration of XCM undergoes independent review from external security organizations.
Quarkslab has completed a comprehensive second audit (a previous audit was already completed by another security firm) of XCMv2, an overview of which can be found here. The goal of this audit was to discover any potential cross-chain security or fairness issues, including logical bugs, denial-of-service, and incorrect lock/unlock or burn/mint on both chains.
The findings
Two security engineers from Quarkslab carried out the audit over a span of 50 man-days. They did not uncover any important security issues within XCMv2. Additionally, the scope of the audit included an examination of the underlying security of multiple XCM components. This makes the audit report useful for anyone interested in exploring the inner workings of XCM.
A full audit report can be found here.
Keep up to date with the latest XCM developments
Following the full audit, XCMv2 is ready for production release, and XCMv3 is currently in the final stages of development. For information on using XCM, watch the workshop from Parity’s Shawn Tabrizi. For updates, follow the xcm-format repository on GitHub, and follow Polkadot on Twitter and sign up for the newsletter.
Interested in building on Polkadot or Kusama? Get in touch!
From the blog
Racing Into the Future: Polkadot and Conor Daly Revolutionize Sports Sponsorship
Breaking new ground in sports sponsorship, the Polkadot community has chosen race car dynamo Conor Daly as its brand ambassador for the Indianapolis 500. This decision, decided using Polkadot’s decentralized governance feature, marks the first time a major athlete’s sponsorship has been determined by a community vote using blockchain technology. What is Polkadot? A Closer Look Launched in 2020 by Ethereum Co-Founder Gavin Wood, Polkadot is a digital platform engineered to be the powerful, se
Elastic Scaling: Streamlining Growth on Polkadot
Elastic scaling is an extremely useful addition for parachains that need higher throughput than allowed by the current Polkadot protocol. This blog from Fatemeh Shirazi explains its importance and how this technical upgrade will come about. Polkadot’s mission is based on delivering a platform that focuses on excellent scaling and security. The aim is to allow decentralized applications to operate in the best conditions possible. Polkadot scales by applying hierarchy to the platform architectur
JAM Session: Gavin Wood Reveals Bold Vision for Polkadot's Next Revolution
Yesterday at Token 2049 Dubai, Gavin Wood announced a bold vision for the next generation of Polkadot technology. In line with the other groundbreaking firsts that Polkadot has brought to the market, this new vision is set to revolutionize the future of Web3. It will provide the speed, scale, full decentralization, and ease of use needed to drive forward deep innovation across not just Web3, but the entire tech landscape. At the heart of this vision is JAM, a new version of the Polkadot chain t