Skip to main content

Security

Beyond implements comprehensive, thorough security measures at every step.

Security is a top priority, with a variety of measures in place to ensure the safety and integrity of cross-chain transactions. These measures are designed to protect user assets, maintain service reliability, and mitigate potential risks. In this section we list the key security features and practices employed, as well as the results of our audits and the details of our bug bounty program.

1. Encryption​

Use strong encryption standards for data at rest and in transit, leveraging protocols like TLS (Transport Layer Security) and AES (Advanced Encryption Standard) encryption algorithms.

TLS is a foundational protocol for securing internet connections, ensuring that data transferred between two systems (e.g., a web server and a browser) remains encrypted and thus confidential. AES is a widely used encryption standard that provides a high level of security for data at rest, making it challenging for unauthorized entities to access sensitive information.

2. Key Management with MPC and TSS​

Augment traditional key management approaches with Multi-Party Computation (MPC) and Threshold Signing Schemes (TSS). This decentralized approach to key management involves splitting private keys into multiple shares via a multi-signature ('multisig') mechanism, with a transaction requiring a minimum threshold of these shares to be signed.

MPC allows for the secure computation of functions across multiple parties where the inputs are kept secret. In the context of key management, it enables different participants to jointly compute a function over their inputs (key shares) without revealing them to each other, enhancing security by ensuring that no single entity holds complete control over a private key. TSS further solidifies this by requiring a subset of those shares to authorize a transaction, thus distributing trust and adding resilience against key theft or loss.

By integrating MPC and TSS into the key management strategy, the control over cryptographic operations is decentralized, single points of failure are reduced, and the overall security posture is significantly improved.

3. Smart Contract Security​

Ensure that smart contracts used for operations such as token locking, minting, or burning are thoroughly audited and free from exploit vulnerabilities.

Given the immutable nature of smart contracts once deployed on a blockchain, it's crucial to catch and rectify any potential attack vectors through rigorous auditing processes before deployment.

4. Node Security​

Harden the security of blockchain nodes interacting with the application, through firewalls, updated software, and vigilant monitoring.

Nodes serve as the backbone of blockchain infrastructure; thus, securing them against unauthorized access and potential vulnerabilities is paramount to maintaining the integrity and reliability of the service.

5. Secure APIs​

Secure all application programming interfaces (APIs), particularly those interfacing with blockchain networks, with measures like authentication, rate limiting, and input validation.

Ensuring that APIs can only be accessed with proper authentication mechanisms in place guards against unauthorized use. Rate limiting protects against abuse and overload of the API by limiting the number of requests a user can make in a given time frame. Input validation prevents malicious data from entering the system, which can be critical in protecting against attacks such as SQL injection or cross-site scripting (XSS).

6. Access Controls​

Implement strict access control measures, employing the principle of Least Privilege Access across all system and user interactions.

This principle dictates that a user, program, or process should have the minimum level of access necessary to perform its function. For example, a service account running a web server doesn't need, and therefore shouldn't have, the ability to modify user data. Applying this principle mitigates accidental or malicious actions by limiting access rights for users, accounts, and computing processes to only those resources absolutely required to perform their duties.

7. Intrusion Detection and Prevention​

Utilize IDS (Intrusion Detection Systems) and IPS (Intrusion Prevention Systems) to monitor for and mitigate malicious activities and potential security breaches. These systems serve as a crucial layer of defense, identifying and responding to threats in real-time to protect the infrastructure from unauthorized access and attacks.

8. DDoS Protection​

Implement measures to protect against Distributed Denial of Service (DDoS) attacks, safeguarding both the application and associated blockchain nodes.

DDoS attacks flood a network or server with excessive traffic to overwhelm resources and render the service inaccessible. Protective measures include employing DDoS mitigation services that can detect, block and divert attack traffic away from the network, maintaining service availability even under attack.

9. Secure Development Practices​

Adhere to secure coding practices, conduct regular code reviews, and use security-focused development frameworks. Establishing and following a set of secure coding standards minimizes the introduction of vulnerabilities within the codebase from the outset.

10. Logging and Monitoring​

Maintain robust logging and monitoring systems to track transactions, access, and changes, ensuring logs are immutable and securely stored. Effective logging and monitoring not only aid in detecting security incidents but also play a critical role in responding to and recovering from such incidents.

11. Incident Response Plan​

Develop a comprehensive incident response plan, outlining procedures for managing security incidents, communication protocols, and recovery processes. A well-structured plan ensures that the team can respond swiftly and effectively to incidents, minimizing potential damage or downtime.

12. Continuous Security Assessment and Penetration Testing​

Regularly conduct security assessments and penetration testing to identify and mitigate vulnerabilities within the application and infrastructure. This includes:

  • Automated Security Scanning: Use automated tools to continuously scan the codebase, dependencies, and infrastructure for known vulnerabilities and configuration issues. Tools like Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) are particularly effective. SAST analyzes source code to identify security vulnerabilities that could lead to potential breaches, while DAST tools complement SAST by testing the application in its running state, identifying security issues that arise during its operation.
  • Manual Penetration Testing: Engage cybersecurity experts to perform manual penetration testing (pentesting) to simulate real-world attacks and discover vulnerabilities that automated tools might miss.
  • Blockchain-specific Assessments: Include examinations that focus on blockchain-specific vulnerabilities, such as smart contract flaws, consensus algorithm weaknesses, and node communication security.
  • Third-Party Audits: Regularly have third-party security firms audit the application and its infrastructure to provide an external perspective with new insights and identify potential security gaps.