Protect Your Project Today
Strengthen your project with the largest web3 security provider.
A CertiK security expert will review your request and follow up shortly.

CertiK Helps Safeheron Resolve TEE-RSA Security Issue

News ·Announcements ·
CertiK Helps Safeheron Resolve TEE-RSA Security Issue

Safeheron promptly acknowledged the vulnerability highlighted by CertiK and has already implemented fixes to address the issue. Safeheron’s agile response to the threat identified is testament to their commitment to security and dedication to enhancing open-source TEE-based RSA key sharding solution

"We commend Safeheron for their swift and responsible action," said Kang Li, Chief Security Officer at CertiK. "Their approach to rapidly addressing these issues, in addition to their ongoing commitment to open-source solutions, is a testament to their dedication to providing a secure MPC self-custody platform for digital assets.”

"In the rapidly evolving landscape of digital assets, security is our utmost priority,” said Max He, Chief Scientist at Safeheron. “Always maintaining high security is our commitment to our users and the wider Web3 community. Solutions we make publicly available, like the TEE-based RSA sharding solution, can significantly help more Web3 builders enhance their security. We appreciate CertiK's assistance in this process, and together, we continue to strive for a more secure future in blockchain technology."

Safeheron pioneers the combination of MPC technology and TEEs in a transparent manner. Safeheron is one of the few solution providers that have adopted this transparent and accountable approach, a move that CertiK firmly supports and encourages others in the industry to adopt.

"Openness and transparency are vital components for building trust within the Web3 community," stated Li. "We are impressed by Safeheron’s approach and encourage others in our industry to follow their lead."

This collaboration between CertiK and Safeheron underscores both organizations’ commitment to improving security in an industry where its effects are invaluable. Through their joint efforts and ongoing commitment to security, CertiK and Safeheron are poised to shape a more robust and reliable future for open-source security solutions in the blockchain industry.

Related Blogs

Technical Deep Dive | CertiK Helped Fix a DoS Vulnerability in Solana’s Big-Integer Modular Exponentiation
Technical Blogs ·Educational

Technical Deep Dive | CertiK Helped Fix a DoS Vulnerability in Solana’s Big-Integer Modular Exponentiation

This article takes an in-depth look at the importance of blockchain transaction fee models and their critical role in ensuring network security and efficient operation. By comparing the transaction fee models of Ethereum and Solana, it highlights how unsafe transaction pricing can introduce network security risks. The article especially focuses on a compute-unit (CU) accounting error in Solana’s big-integer modular exponentiation syscall discovered and reported by the CertiK team, which could lead to a potential remote DoS attack. It further analyzes Solana’s smart-contract pricing model, PoH-related timing mechanics, and parallel transaction processing, and reproduces the remote DoS process and cost via experiments on a private Solana cluster.

Post-Quantum Signatures, Part 1: Understanding One-Time Signature
Technical Blogs ·Educational

Post-Quantum Signatures, Part 1: Understanding One-Time Signature

Digital signatures are a cornerstone of modern information security, providing authenticity, integrity, and non-repudiation for digital communications. The security of prevalent schemes such as RSA, DSA, and ECDSA is predicated on the computational hardness of number-theoretic problems—specifically, integer factorization and the discrete logarithm problem. However, the advent of large-scale quantum computers threatens to render these foundations obsolete. Shor's algorithm, a quantum algorithm, can solve both problems in polynomial time, effectively breaking the cryptographic security of a significant portion of our current digital infrastructure.

Threshold Cryptography V: Auxiliary Zero-knowledge Proofs
Technical Blogs ·Technical Insights

Threshold Cryptography V: Auxiliary Zero-knowledge Proofs

In this post, we analyze the specific ZKP constructions implemented in Binance’s tss-lib [1]. These proofs address previously identified weaknesses in the Multiplicative-to-Additive (MtA) protocol, Paillier encryption parameters, and auxiliary RSA modulus generation. Our discussion is grounded in the improvements formalized by the specifications in CGGMP21 [4], which strengthen the robustness of threshold ECDSA against known attacks.