Keyring Credentials audit
A private security review of Keyring (zero-knowledge compliance), conducted with Three Sigma and completed on 10th July 2024 over 5 days. 0xSimao disclosed 12 findings: 2 high severity, 1 medium, 3 low and 6 informational.
What Keyring is
Keyring is zero-knowledge compliance infrastructure: users hold credentials attesting policy eligibility (KYC, jurisdiction, sanctions state), verified on-chain through RSA/PKCS#1-style signature checks without revealing identity, so permissioned pools keep composable liquidity.
Scope
This second Three Sigma round covered the credential verifier and its key handling, credential creation timestamps and expiry, the fee transfer mechanism, and the blacklist machinery that cuts an entity's addresses off.
High severity findings
- Credentials can be manipulated
- RsaVerifyOptimized sets the size of the key to 1024 bits, which is unsafe
Medium severity findings
Low severity findings
- KeyringCoreV2Base::collectFees() should use Address::sendValue() instead of address.transfer()
- Missing admin change events
- KeyringCoreV2Base could use a 2 step admin transfer mechanism
Informational findings
- KeyringCoreV2Base::_createCredential() could use currentTime instead of block.timestamp on the creatBefore check
- KeyringCoreV2Base::blacklistEntity() and KeyringCoreV2Base::unblacklistEntity() could check that the addresses are not already set
- Admin checks in KeyringCoreV2Base could be placed in a modifier to increase readability and reduce code duplication
- KeyringCoreV2Base::registerKey() could check that validTo is equal to or bigger than block.timestamp
- Functions can be marked external when only called from other contracts
- Some natspec comments in KeyringCoreV2Base are outdated
The report