We propose to improve the security of the Avalanche network as a whole by:

1. Auditing the source code of the Avalanche tools and some of the libraries on which they depend. To audit we will follow the methodology of OpenBSD

2. Porting the libraries and the fundamental avalanche tools to OpenBSD/adJ (at least avalanchego, subnet-evm, coreth, avalanche-network-runner, precompile-evm and avalanche-cli)

3. On OpenBSD/adJ run the tests of the Avalanche tools and use them with different use cases (including a validator and developing dApps) and with loads as close as production as possible to discover runtime failures that could point to security flaws.

4. Report the problems found and recommend ways to improve and/or propose Pull Requests to fix them.

Up to now we have concentrated more in the porting effort but it already gave fruit in improving security:

• We contributed 3 pull requests with small improvements in portability. They were already merged in the main avalanche tools
• We contributed one pull request that adds support for OpenBSD to avalanchego. This one is waiting approval and hopefully merging.
• We helped to improve the security of one library that is central for the Avalance protocol. The Avalanche protocol depends on the BLS12-381 signature, in the source code it is implemented by the library supranational/blst. Using our methodology we reported a crash of this library in OpenBSD/adJ due to a security feature of that OS (see issue 206). With our feedback the author of blst solved the problem and improved the security of the library with the commits dae1f and 6cca1 --a constant table required for the cryptographic BLS12-381 signature library now is in a section for constants (.rodata) not allowing an attacker to modify it after the program starts.

With the funding of this project we will go through a full audit of the sources, completing the porting effort and more integral testing to keep contributing pull requests and suggestions to improve the security of Avalanche tools and the libraries that they depend on.

Please see details of the results as we progress in the project web page