Degov Security Audit Report

[fewensa]

A basic version of the audit report

• degov-web
• degov-square
• degov-indexer

[fewensa]

Overview

DeGov.AI is an on-chain governance platform for DAOs. This repository contains three primary layers:

• Smart contracts (contracts/src): OpenZeppelin Governor + Timelock integration and governance tokens (ERC20Votes, wrapper tokens).
• Indexer (packages/indexer): Subsquid-based event processor that ingests on-chain logs into Postgres and serves GraphQL.
• Web application (packages/web): Next.js UI for proposal creation, voting, queue/execute actions, treasury views, and profile management; includes AI analysis and remote configuration.

Real-world usage centers on token holders proposing and executing governance actions that can transfer treasury funds or change permissions. The timelock is a critical defense against rushed or malicious executions. The indexer and UI provide a view layer and convenience tooling but are not authoritative for on-chain state.

Key assets and security goals:

• Treasury funds and contract permissions (highest-value asset).
• Timelock integrity and governance process correctness (no bypass or role manipulation).
• Voting power integrity (token minting/roles, snapshot correctness).
• User wallet safety and transaction integrity (UI should not mislead users).
• Profile and metadata integrity (off-chain reputation data, JWT secrets, DB credentials).

Threat model, Trust boundaries and assumptions

Trust boundaries / inputs

• Attacker-controlled inputs: on-chain logs and proposal metadata (any token holder can propose/vote), vote reasons, proposal descriptions, AI analysis content, user profile fields, GraphQL responses, and RPC responses if endpoints are untrusted.
• Operator-controlled inputs: degov.yml (local or remote), RPC lists, DEGOV_CONFIG_PATH, NEXT_PUBLIC_DEGOV_API, JWT secret, database credentials, deployment parameters and role assignments.
• Developer-controlled inputs: scripts in contracts/script, test fixtures, build tooling.

Assumptions

• OpenZeppelin Governor/Timelock/AccessControl implementations are correct.
• Timelock admin and token minting roles are properly governed (not permanently held by a single EOA).
• Indexer database is protected from external writes.
• Operators secure secrets and use trusted RPC endpoints.
• UI is not a security boundary; on-chain contracts are the final enforcement layer.

Trust boundary implications

• If RPC or remote config is compromised, indexer and UI can be misled, potentially prompting users to sign transactions on unintended contracts.
• If the indexer or UI is compromised, on-chain checks still apply, but users can be socially engineered into harmful actions.

Attack surface, mitigations and attacker stories

On-chain smart contracts (contracts/src)

Attack surface: DGovernor, Timelock, governance tokens (GTK, wrapper tokens), and the optional DGovernorWithoutTimelock variant.

Mitigations/controls:

• OpenZeppelin Governor + GovernorTimelockControl in contracts/src/DGovernor.sol.
• TimelockController enforces execution delays and queued operations.
• AccessControl/Ownable gates token minting.
• ERC20Votes/clock modes standardize vote snapshots.

Attacker stories:

• Timelock bypass / admin backdoor: If Timelock admin remains an EOA or proposer/executor roles are misconfigured, an attacker could bypass delay and execute malicious actions. Verify deployment roles and consider renouncing admin in production.
• Mint role capture: If token owner or MINTER_ROLE is not governed by the DAO, an attacker can mint voting power and pass treasury-draining proposals.
• Timelockless governor: Deploying DGovernorWithoutTimelock removes the delay and materially increases treasury-drain risk. Treat this as unsafe for production.
• Clock mode mismatch: Incorrect clock mode (timestamp vs blocknumber) can skew quorum/snapshot calculations, leading to disputes or manipulation.

Indexer and synchronization (packages/indexer)

Attack surface: RPC endpoints, log processing, config loading (local or remote), and chain reorgs.

Mitigations/controls:

• setFinalityConfirmation in main.ts reduces reorg impact.
• ChainTool queries canonical on-chain state (proposal snapshot/deadline/quorum) instead of trusting logs alone.
• Reconciliation tooling (reconcile.ts, internal/reconciliation.ts) allows integrity checks.
• Event filters restrict processing to configured contract addresses.

Attacker stories:

• RPC manipulation: A malicious RPC endpoint can provide fake logs or state, causing the indexer/UI to show a proposal as queued/executed. This can mislead users into signing actions or trusting false outcomes.
• Deep reorgs: If finality is configured too low, a chain reorg can revert proposals or timelock operations while the indexer keeps stale data.
• Config injection: If DEGOV_CONFIG_PATH or remote config is attacker-controlled, the indexer could track the wrong contracts/chain, resulting in deceptive governance data.

Web frontend & API (packages/web)

Attack surface: wallet transaction builders, Markdown/HTML rendering, GraphQL responses, remote config, SIWE authentication, and profile APIs.

Mitigations/controls:

• useContractGuard enforces wallet connection and correct network before transactions.
• Zod schemas validate proposal inputs (addresses, amounts, ABI parameters).
• DOMPurify sanitizes proposal markdown and AI analysis output (utils/markdown.ts, description components).
• Some proposal state is read directly from chain via useReadContract, reducing reliance on indexer for critical state.

Attacker stories:

• XSS via vote reason: CommentModal renders commentData.reason using dangerouslySetInnerHTML without sanitization; a malicious voter can embed HTML/JS to steal auth tokens or manipulate UI.
• Proposal action misrepresentation: Proposal descriptions embed <signature> tags used for UI rendering. A malicious proposer can provide misleading signatures that do not match actual calldata, causing user confusion or social engineering.
• ABI supply-chain misdecode: utils/decoder.ts fetches ABIs from a remote GraphQL service; a compromised ABI source can misrepresent action decoding, again misleading users.
• Remote config poisoning: config-remote.ts and app/api/common/config.ts fetch config based on Host header. A malicious config response could point the UI to attacker-controlled RPCs/contracts, leading to phishing-style transaction signing.
• Auth boundary gap: /api/profile/[address] expects x-degov-auth-payload but does not verify JWT itself. If no upstream middleware injects this header, attackers could forge it and update profiles (reputation abuse).
• Nonce replay in multi-instance deployments: Nonce cache is in-memory; in serverless/multi-node setups, a nonce might be reused across instances unless the remote nonce service is used.

Supply chain & build

• Critical dependencies include OpenZeppelin, wagmi/ethers, subsquid, and DOMPurify. Lockfiles reduce risk but do not eliminate malicious dependency updates.
• Build/deployment scripts are developer-controlled and should not run with production secrets.

Criticality calibration (critical, high, medium, low)

Critical

• On-chain vulnerabilities that bypass timelock or allow unauthorized execution (e.g., misconfigured Timelock roles, use of timelockless governor).
• Governance-token mint/owner compromise leading to vote takeover and treasury drain.
• Remote config/RPC compromise that causes users to sign transactions against attacker-controlled contracts (phishing with real fund loss).

High

• Persistent XSS enabling theft of auth tokens or manipulation of transaction parameters in the UI.
• Indexer integrity failures that consistently show incorrect proposal state (e.g., “Succeeded” or “Ready” when not true) leading to harmful user actions.
• Auth bypass enabling impersonation in profile data when used for governance reputation or off-chain decisions.

Medium

• ABI decoding/description parsing inconsistencies that misrepresent actions without changing on-chain behavior.
• Reorg-induced inconsistencies when finality is set too low.
• DoS against indexer/GraphQL/AI endpoints causing stale or unavailable governance data.

Low

• Cosmetic UI issues, analytics misconfiguration, or minor data leakage without direct security impact.
• Issues confined to developer scripts or demo configurations that are not used in production.

Note: Vulnerabilities that require direct operator control over deployment scripts, degov.yml, or environment variables are generally out of scope for remote attackers. Their severity depends on operational compromise rather than code-level exposure.

[fewensa]

安全分析更新（基于 DeGov 项目本身：Web / Indexer）

--
 
这版按项目代码与当前架构重新梳理，聚焦两个问题：

1. DeGov 自身还能怎么优化、目前有哪些潜在安全风险；
2. 平台可以做哪些事，帮助用户识别并降低被攻击概率。
    

---

 

1) DeGov Web / Indexer 当前主要攻击面

 

A. Web 认证链路（SIWE）

• SIWE 校验未显式绑定 domain / uri / chainId
  当前登录接口核心是签名校验 + nonce 校验，但缺少对期望上下文（domain/uri/chainId）的强约束。风险是签名上下文被弱化时，可能出现跨场景复用或钓鱼利用。
   
• Token 存储在 localStorage
  一旦发生 XSS（业务代码、依赖链、第三方脚本、内容渲染污染等），token 可被直接读取并用于会话劫持。
   
• Nonce 接口缺少限流与风控闭环
  nonce 可正常工作，但还应补充 IP/地址/UA 维度限流、失败计数、告警审计，否则会有批量请求放大与溯源困难的问题。
   

B. Web 内容渲染与外部输入

• Markdown 外链图片/链接可被用于追踪与社工引流
  即使有 DOMPurify，若允许任意外链，仍可能出现隐私追踪、伪装内容、钓鱼跳转风险。
   
• 远端服务依赖（GraphQL / AI）带来供应链与数据外发面
  endpoint 一旦被篡改、劫持或隔离不足，会放大登录链路风险与敏感数据外发风险。
   

C. Indexer 数据可信性与运行安全

• RPC 单点信任（或随机单点）
  Indexer 若长期依赖单一 RPC，出现恶意返回、延迟、分叉视图或不一致时，可能造成索引偏差并误导前端展示。
   
• 日志可能泄露带密钥的 RPC URL
  若日志直接输出完整 URL（含 query/key），会把凭证带入日志系统。
   
• 配置支持 HTTP(S) 远端拉取，存在配置投毒/链路劫持面
  部署环境变量或网络链路被劫持时，可能加载恶意配置（链参数、地址、RPC 被替换）。
   

---

 

2) 项目自身优化建议（按优先级）

 

P0（优先处理）

1. SIWE 服务端强校验上下文

• verify 时显式校验：domain、uri、chainId、nonce、expirationTime/notBefore；
• 仅允许受支持链 ID；
• 与站点配置不一致直接拒绝。
   

2. 凭据从 localStorage 迁移到 HttpOnly + Secure Cookie

• 降低 XSS 读取 token 风险；
• 配置 SameSite=Lax/Strict；
• Access Token 短时效 + Refresh Token 轮换；
• 关键动作增加 re-auth/二次确认。
   

3. Nonce/Login 风控补齐

• IP + address + UA 限流（滑窗/令牌桶）；
• nonce 一次性 + 短 TTL；
• 失败指数退避 + 异常峰值告警。
   

4. RPC URL 日志脱敏

• 仅记录 host/provider，不记录 query/key；
• URL 统一 redaction。
   

P1（高价值增强）

1. Indexer 多 RPC 交叉验证（Anti-poisoning）

• 对 quorum、proposal state、snapshot/deadline 等关键字段抽样复核；
• 出现差异时标记“不一致”，重试或降级，不立即写入最终状态。
   

2. 远端配置白名单 + 签名校验

• 默认仅本地配置，必须远端时限制 allowlist 域名；
• 对配置文件做签名校验，防投毒。
   

3. 内容渲染与跳转策略强化

• CSP 收紧（default-src 'self'，img-src 限可信域）；
• 外链统一风险跳转页（展示目标域名与风险提示）。
   

4. 第三方依赖最小外发

• 非必要文本默认不外发；
• 增加开关与审计日志（发了什么、发到哪里）。
   

P2（治理与可观测性）

• 安全看板：登录失败率、nonce 峰值、RPC 不一致率；
• 发布前基线：SAST、依赖漏洞、secrets、镜像扫描；
• 常态演练：签名钓鱼、RPC 污染、索引回滚。
   

---

 

3) 如何帮助用户降低被攻击风险（场景化）

 

1. 签名钓鱼（最常见）

• 登录前展示域名/链 ID/nonce 来源；
• 非官方域名高亮警告；
• 首次连接钱包给出“签名安全检查清单”。
   

2. 提案内容社工（恶意链接/伪装附件）

• 外链加“未验证域名”标签；
• 跳转前二次确认；
• 社区维护已验证域名白名单徽章。
   

3. 前端污染导致会话窃取

• 凭据迁移到 HttpOnly Cookie；
• 异常设备/地区登录触发二次验证；
• 提供会话管理与一键下线。
   

4. RPC 异常导致状态误导

• UI 标注数据可信等级（单源/多源一致）；
• 不一致时提示“校验中，请稍后操作”；
• 提供链上浏览器原始链接供交叉核对。
   

5. 假客服/假治理通知

• 站内官方消息签名标识；
• 明确声明“官方不会私聊索要签名/转账”；
• 举报入口 + 诈骗域名/地址黑名单联动。
   

---

 

4) 建议落地节奏

 
未来 2 周（快改）

• SIWE 上下文强校验；
• 凭据 Cookie 化（至少先灰度）；
• Nonce/Login 限流与告警；
• RPC 日志脱敏。
   
  未来 1 个月（体系化）
• Indexer 多 RPC 一致性校验框架；
• 配置签名校验 + 域名白名单；
• 外链风险提示/未验证标签/可疑内容上报；
• 安全仪表盘 + 演练机制。
   

[fewensa]

#685