Thông báo Hacken Publishes Case Study on Gate.io's Proof of Reserves Solution, Shares Security Audit Insights

Hacken Publishes Case Study on Gate.io's Proof of Reserves Solution, Shares Security Audit Insights

2024-02-04 04:24:19 UTC 14644 Số lượt đọc

[//]:content-type-MARKDOWN-DONOT-DELETE
When we first started our Proof of Reserves (PoR) program in 2020, it marked our most significant commitment to transparency and accountability ever, allowing users to independently verify that their BTC and ETH balances are backed 1:1 by real assets. Since then, we've strengthened this commitment with more regular reporting, zero-knowledge tech, and covering over 170 assets—the most of any exchange.

We are now in our fourth year of producing 100% PoR, and we recently enlisted Hacken, a leading blockchain security firm, to assess our PoR method. After a thorough review, they found no vulnerabilities and followed up with a case study outlining their findings, which you can read below.

# Hacken: Gate.io's Proof of Reserves Security Assessment: Elevating Crypto Standards and Trust
One of the biggest crypto exchanges in the world [Gate.io](https://www.gate.io/ "Gate.io") has recently upgraded its Proof of Reserves (PoR) to include zero-knowledge technology, marking an important step toward enhanced financial transparency. Hacken has conducted an independent third-party assessment to evaluate Gate.io’s Proof of Reserves newest implementation, scrutinizing it for vulnerabilities to known attacks or malicious code.

The move is particularly significant in the post-FTX landscape, where most exchanges don’t provide 100% capital reserve. With this initiative, Gate.io raises the bar for the transparency of digital assets among centralized exchanges.

## Technology & Implementation
Gate.io’s original implementation of PoR, forked from Binance’s "zkmerkle-proof-of-solvency," underwent significant modifications in structure, dependency management, and cryptographic frameworks since 2020.
The most critical enhancement was the addition of [zk-SNARK](https://hacken.io/discover/zk-snark-vs-zk-stark/ "zk-SNARK") verification, which eliminated the weakness in the previous implementation that could have allowed the inclusion of fabricated accounts with negative balances, potentially altering data accuracy.
The project uses the following cryptographic frameworks and structures: 
**-** A fork of GNARK – to construct cryptographic circuits.
**- **Poseidon hash function with the BN254 curve – for hashing user data and the Sparse Merkle Tree (SMT) structure.
**- **BSMT library – for implementing the SMT with a maximum depth of 28, enabling the Proof Of Solvency system to accommodate over 250 million users.
See Gate.io’s Proof of Reserves implementation on [GitHub](https://github.com/gateio/proof-of-reserves "GitHub") or read more about it [here](https://www.gate.io/proof-of-reserves/ "here").

## Findings & Recommendations
![](https://gimg2.gateimg.com/image/article/17070197392.4.1.png)
Hacken’s assessment 
## Assessment Team
[The Proof of Reserves Implementation Security Assessment](https://hacken.io/services/proof-of-reserves-audit/ "The Proof of Reserves Implementation Security Assessment") was led by Luciano Ciattaglia, Hacken's Director of Services and a renowned expert in cryptology, alongside lead auditors Sofiane Akermoun, Nino Lipartiia, and Bartosz Barwikowski.
## Method
The team conducted a thorough analysis of Gate.io's documentation, repository codebase, code structure, and architectural quality, along with examining new release tags and functionalities. We performed extensive checks against known vulnerabilities, including verification through checksum validation for all 1157 dependencies. The primary objective of this assessment was to evaluate the code for vulnerabilities to known attacks or malicious code and to verify the absence of issues in build processes, deployment, and architectural design.
## Findings
The Hacken team’s assessment revealed no critical-, high-, medium-, or low-severity vulnerabilities. We found several informative issues:
**- **Merkle root hash integrity: It was recommended that the Merkle root should be signed by a trusted third-party auditor or published on the blockchain for verifiability.
**- **Outdated GNARK version: Updating to the latest GNARK version was strongly recommended to mitigate security risks and efficiency drawbacks.
## Assessment
Overall, the project is a testament to a strong foundation in cryptographic implementation and exceptional code organization. Its current state reflects a well-considered balance between functionality and complexity, offering a comprehensive setup for users with its detailed documentation and provided sample data. The project's existing framework and features already contribute significantly to the field, demonstrating a clear understanding and application of key principles in blockchain technology and cryptographic systems.
The full report is public and can be accessed at https://hacken.io/audits/gate.io. 
## Conclusions
Gate.io’s PoR implementation sets a new benchmark in the blockchain and cryptocurrency industry. It exemplifies a commitment to transparency and trust for all of its 14M+ users. The 100% Proof of Reserves commitment, as well as a subsequent third-party security assessment of the implementation, offers a blueprint for other digital asset exchanges to enhance their security and integrity.

<sp>
Gateway to Crypto
Trade over 1,700 cryptocurrencies safely, quickly, and easily on Gate.io

Download Gate.io [App](https://www.gate.io/mobileapp?ch=ann28618 "App") / [Web](https://www.gate.io/mobileapp "Web") Client now>>>
Follow us on [Gate.io X (Twitter)](https://twitter.com/gate_io "Gate.io X (Twitter)") to get more bonuses>>>
Join our [Telegram](https://t.me/gateio_en "Telegram") to discuss hot topics>>>
Join our [Global Community](https://www.gate.io/community "Global Community") to get more updates>>>
We provide [100% proof of reserve](https://www.gate.io/proof-of-reserves "100% proof of reserve")>>>
[Sign up](https://www.gate.io/signup "Sign up") to enjoy max. $6666 in rewards exclusively for new users
Get 40% commission from [referrals](https://www.gate.io/referral "referrals")

Gate.io Team
February 4th, 2024

Thay đổi & Thời gian bắt đầu-kết thúc Biểu đồ

Màu sắc tăng giảm

Pay With

Hacken Publishes Case Study on Gate.io's Proof of Reserves Solution, Shares Security Audit Insights

Hacken Publishes Case Study on Gate.io's Proof of Reserves Solution, Shares Security Audit Insights

Chọn ngôn ngữ và khu vực

Chọn khu vực của bạn

Tiền pháp định