Spectrum Network | Security Audit

[GENERAL] Name and surname of main applicant

Yasha Black

[GENERAL] Email address of main applicant

admin@spectrumlabs.fi

Additional applicants

No

[GENERAL] Please specify how many months you expect your project to last (from 2-12 months)

4

[GENERAL] Please indicate if your proposal has been auto-translated into English from another language.

No

[GENERAL] Does your project have any dependencies on other organizations, technical or otherwise?

Yes

[GENERAL] If YES, please describe what the dependency is and why you believe it is essential for your project’s delivery. If NO, please write “No dependencies.” .

We are in talks with CertiK and MLabs

[GENERAL] Will your project’s output/s be fully open source?

Yes

[GENERAL] If NO, please describe which outputs are not going to be open source. If YES, please write “Project will be fully open source.”

Project will be fully open source.

[METADATA] Category of proposal

Dev Ecosystem Collaboration

[IMPACT] Please describe your proposed solution.

This proposal is a continuation of the funded Catalyst F9 proposal Spectrum.Network | Layer 2 for DeFi.

Spectrum aims to enable ultimate interoperability on Cardano. The protocol serves as a programmable cross-chain layer that allows cross-chain messaging between Cardano and any other connected blockchain or general data source.

At its core Spectrum solves the “Oracle problem” which the “Interoperability problem” always boils down to. There are many solutions to this problem out there, some of them even offer programmable cross-chain layers. Nevertheless, ALL of them fail to provide a scalable solution to the problem. Can we really call a PBFT (Practical Byzantine Fault Tolerance) network where a fixed committee of only 8-16 nodes decides what's valid and what's not decentralized? There is no decentralization without scalability.

During the last year, we at Spectrum put an enormous amount of effort into designing a scalable protocol that solves “Oracles” and hence “Interoperability” in a trustless and decentralized way. The protocol has 2 layers. On the upper layer there are independent local committees, each dedicated to one particular data source, be it an external blockchain system or exchange rate of some fiat currency. Each committee runs a scalable collective signature protocol that we have designed and tested specifically for cryptographic primitives that are available on Cardano, Ergo, and many other blockchains RIGHT NOW. The aggregation is performed in logarithmic time, thanks to this each committee can scale up to thousands of nodes. Committees are also continuously rotated thanks to the Roll-dPoS consensus on the lower (master) layer. The master layer enables programmability and serves as a synchronization layer for simultaneous streams of events coming from external systems and served by local committees.

Notable improvements were done in the ledger design towards developers’ experience based on our own experience with dApp building on Cardano and Ergo. dApp builders on Spectrum can vary the amount of on-chain computations, e.g. choosing to perform a bit more computations on-chain for cases where a shared UTxO is involved (such as AMM Liquidity Pool, or Stablecoin Bank). This dramatically reduces the complexity of on-chain code required to implement complex DeFi dApps, while keeping the determinacy of the eUTxO approach.

The design of Spectrum makes it an ultimate platform for decentralized cross-chain applications serving Cardano (and other layer-1 platforms). DeFi apps built on Spectrum have full potential to replace centralized services like CEXes.

To sum up, we have conducted core research, evaluated protocol design and implemented the core of the protocol. There are still some vital things left to be completed to make Spectrum ready for production.

The proposal comprises one primary proposal along with two subsidiary proposals outlining the specific tasks required to complete the Spectrum Network project. The following are the milestones that need to be achieved for the project's overall completion:

• Default mode. The protocol relies on dynamic committees of independent validators in order to operate. When a committee is rotated it has to explicitly pass its “responsibilities” to the next committee. There is still a small probability that some committee fails to reach quorum. To handle this case we have outlined a design of the “Default Mode” for Spectrum consensus, that would save the protocol in the worst scenario. It requires some research and implementation. (separate proposal: “Spectrum Network: Programmable Cross-chain Messaging Protocol”)
• Programmability layer. Spectrum needs a virtual machine and a language that fits its hybrid ledger design. Just adopting Ergoscript or Plutus is not an option. One of the possible options is MoveVM and Move, which provides safety, and convenience has a more-or-less mature ecosystem, and provides formal verification capabilities. But it has to be modified to fit Spectrum's design. (separate proposal: “Spectrum Network: Programmable Cross-chain Messaging Protocol”)
• Upgradability. Initially Spectrum will support Cardano, Ergo and Ethereum, but thanks to committee sharding the system scales linearly in the number of supported chains. So the community will likely be willing to plug-in new blockchains with time. We envision this process as a routine, where developers implement a connector for a new chain, users create a configuration and vote for activation. Thus an upgradability framework should be developed. (separate proposal: “Spectrum Network: Programmable Cross-chain Messaging Protocol”)
• Testing at scale. Spectrum Node is not a lightweight software by any means and the protocol itself is intended to serve a network of thousands of nodes. To prepare the reference implementation for production usage, we have to test it at scale, this means we need hundreds of servers. (separate proposal: “Spectrum Network | Testing Protocol at Scale”)
• Security audit. The essential complexity of Spectrum is high and it has to be carefully audited. (this proposal)

This proposal is about only the Security Audit. The rest related work is covered in other proposals.

— — —

We provided a high-level overview of our interoperability solution, focusing on its overarching aspects. To delve into the technical details of the project, we invite you to refer to our White Paper for more in-depth information.

[IMPACT] How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?

Spectrum Network addresses the challenge by providing solutions that enhance the Cardano developer ecosystem and attract developers from outside the existing community. It aligns with the aims of incentivizing open-source projects and advancing the evolution of the developer ecosystem.

The project brings significant benefits to the Cardano ecosystem:

• Expanded Development Opportunities: Spectrum Network offers new avenues for developers, both within and beyond the existing community, to actively participate in Cardano's development. It provides a tool enabling developers to create innovative cross-chain applications and services, fostering growth and attracting talent.
• Broader Adoption and DApp Solutions: The ability to build natively cross-chain applications allows for seamless integration of Cardano with other ecosystems. This attracts users and developers from different blockchain communities, increasing participation and expanding the Cardano user base. The platform's support for DeFi and tokenization stimulates innovation, providing value in areas of widespread interest.
• Supporting Stake Pool Operators: Stake Pool Operators benefit from the expanded network usage through Spectrum Network. Validating cross-chain operations presents additional opportunities for generating income, as more transactions occur within the ecosystem.

By addressing category challenges and providing key benefits, Spectrum Network strengthens the Cardano ecosystem by driving developer participation, encouraging cross-chain application development, supporting stake pool operators, and fostering collaboration and innovation within the community.

[IMPACT] How do you intend to measure the success of your project?

The success criteria for Security Audit

• 0 critical vulnerabilities
• A comprehensive report from an auditing firm

The success criteria of the Spectrum Network project can be found in the main proposal: “Spectrum Network | Programmable Cross-chain Messaging Protocol”

[IMPACT] Please describe your plans to share the outputs and results of your project?

Security Audit Report: We will upload the PDF file of the security audit report to our repository. Conducting a security audit is crucial to minimize the risk of the protocol being hacked and protect users' funds.

Issues Identified in the Security Audit: Any issues that are discovered during the audit will be addressed appropriately. We will provide detailed explanations of resolved issues through our social channels (Twitter, Telegram, Discord, Reddit). Additionally, we will share links to relevant GitHub issues and closed pull requests once the issues are resolved.

[CAPABILITY/ FEASIBILITY] What is your capability to deliver your project with high levels of trust and accountability?

• Our development team possesses extensive experience of over 4 years in the DeFi sector, including 2 years specifically dedicated to the Cardano space.
• Spectrum Finance boasts a reputable standing within both the Cardano and Ergo communities.
• The Spectrum Network project holds significant strategic value for our team and community, as it aims to establish a cross-chain DEX on top of our platform.
• Our development team has received successful funding twice through the Catalyst program, consistently delivering timely progress updates.
• In addition to the funding acquired through Catalyst, we have access to ample resources, ensuring we are not limited in terms of available means.
• We have implemented rigorous steps and processes to ensure proper management of funds, ensuring trust and accountability throughout the project delivery.

[CAPABILITY/ FEASIBILITY] What are the main goals for the project and how will you validate if your approach is feasible?

• Objective 1: Achieve seamless interoperability within the Cardano community. A successful native cross-chain transfer, such as exchanging ERG for ADA, denotes the achievement of this goal.
• Objective 2: Empower Cardano developers with a tool for building decentralized cross-chain applications. The recognition of a development team utilizing the protocol as a successful implementation would signify reaching this goal.
• Objective 3: Attract users from other ecosystems to Cardano by offering natively cross-chain decentralized applications and services. A 10% year-on-year increase in created Cardano addresses within the first year after the protocol's mainnet launch (excluding average organic growth and other causes) would indicate success.
• Objective 4: Generate an additional revenue stream for Cardano Stake Pool Operators. A 20% monthly income increase for SPOs within the first year after the mainnet launch of the protocol would be considered successful in achieving this goal.
• Objective 5: Provide the entire Cardano community with access to cross-chain liquidity from other ecosystems directly through their Cardano wallets, without relying on centralized exchanges (CEXes) as intermediaries. Achieving a 30% month-over-month increase in decentralized finance transactions within the first year after the protocol's mainnet launch (excluding average organic growth and other causes) would be considered successful.

[CAPABILITY/ FEASIBILITY] Please provide a detailed breakdown of your project’s milestones and each of the main tasks or activities to reach the milestone plus the expected timeline for the delivery.

Milestone 1. Complete security audit of the protocol and reference implementation (Duration: 3 months)

We are in talks with several security audit firms at the moment (including CertiK and MLABS)

Milestone 2. Eliminate issues discovered during security audit (Duration: 1 month)

[CAPABILITY/ FEASIBILITY] Please describe the deliverables, outputs and intended outcomes of each milestone.

Milestone 1

• Deliverables: Report of a security audit. PDF file published in the Spectrum repository on GitHub

Milestone 2

• Deliverables: All issues revealed after the security audit are resolved.

[RESOURCES & VALUE FOR MONEY] Please provide a detailed budget breakdown of the proposed work and resources.

Use the table for easier reading

Milestone 1. Complete security audit of the protocol and reference implementation — 455,486.54 ADA

• Security audit by CetiK — 455,486.54 ADA

Milestone 2. Eliminate issues discovered during security audit — 54,658.39 ADA

For this Milestone we request 40% of the cost. The rest will be covered by Spectrum Labs.

[RESOURCES & VALUE FOR MONEY] How does the cost of the project represent value for money for the Cardano ecosystem?

The cost and explanation are presented in this table.

After consulting multiple auditing firms, we have established the average cost of the security audit displayed above. If Catalysts funds are insufficient, Spectrum Labs will cover the remaining expenses.

Also, we base our cost estimates on our team's hourly rate. In this proposal, we are requesting 40% of the Milestone 2 cost as the rest will be covered by the Spectrum Labs team.

Our main proposal: Spectrum Network | Cross-chain Messaging Protocol

Testing protocol proposal: Spectrum Network | Testing Protocol at Scale

[IMPORTANT NOTE] The Applicant agreed to Fund10 rules and also that data in the Submission Form and other data provided by the project team during the course of the project will be publicly available.

I Accept