Security audit: Rounds 1-4 findings in gravity-aptos (GAPTOS-001 ~ R4-018)

[Richard1048576]

Summary

Multi-round internal security audit of Gravity-specific changes in the consensus layer.

Round 1 (2026-02-26): 31 findings

• 1 CRITICAL — NewEpochEvent serialization mismatch (serde_json vs BCS)
• 5 HIGH — Noise peer_id removed, DKG config hardcoded, unwrap() panics, JWK panic!()
• 8 MEDIUM + 9 LOW + 8 INFO

Round 2 (2026-03-01): Key additions

• GAPTOS-R2-001: GTxnBytes todo!() in 8+ production paths
• GAPTOS-R2-005: GravityExtension unsigned (malleability)

Round 3 (2026-03-04): 31 findings

• 4 P0 — Config unwrap chains, JWK panic, Cargo.lock gitignored (fixed), VM validation disabled
• 8 P1 + 12 P2 + 7 P3

Round 4 (2026-03-05): 18 findings

• GAPTOS-R4-001 (CRITICAL): GTxnBytes todo!() — unfixed for 4 audit rounds
• GAPTOS-R4-002 (CRITICAL): GravityExtension unsigned — transaction malleability
• GAPTOS-R4-003~006 (HIGH): VM validation disabled, config from_str().unwrap(), From<GravityEvent> .expect(), bcs::to_bytes().unwrap()
• GAPTOS-R4-007~012 (MEDIUM): DKGState panic, RoundProposer single-proposer fallback, DKG .unwrap() chains
• GAPTOS-R4-016~018 (INFO): Noise fix verified ✓, BFT safety preserved ✓, Quorum store intact ✓

Persistent Unfixed Findings

Finding	Rounds Open	Severity
GTxnBytes todo!() in production	4 rounds	CRITICAL
GravityExtension unsigned	3 rounds	CRITICAL
From<GravityEvent> .expect()	3 rounds	HIGH
Config path .unwrap() chains	2 rounds	P0
bcs::to_bytes().unwrap()	3 rounds	HIGH

Cross-Module Findings

• VM validation disabled + GTxnBytes = trivially exploitable DoS crashing all validators
• ConfigVariant enum mismatch (Rust V1/V2 vs Solidity Off/V2) → DKG failures
• JWK magic strings "0"/"1" coupled to Move type names → cascade crash
• 3 BCS format deviations across consensus-execution boundary

Cumulative: ~80 findings across 4 rounds

Documentation

• docs/security/2026-02-26-security-audit-report.md
• docs/security/2026-03-01-security-audit-report-round2.md
• docs/security/2026-03-04-security-audit-report-round3.md

Test plan

• Fix GTxnBytes handling — highest priority
• Remove From<GravityEvent> impl, use TryFrom everywhere
• Replace all .unwrap() on config path with ?
• cargo test -p aptos-consensus -p aptos-dkg -p aptos-types
• Verify epoch transitions end-to-end

🤖 Generated with Claude Code