→ Download Full Report (PDF)

At Symbolic Software, we recently concluded, in close collaboration with 3MI Labs an extensive audit of the 2PC-MPC Rust crate developed by dWallet Labs. We’re excited to share our findings and offer our perspectives on the strengths and areas for improvement of this innovative protocol implementation.

dWallet Labs’ 2PC-MPC crate represents a practical software implementation of the “2PC-MPC: Emulating Two Party ECDSA in Large-Scale MPC” protocol. This novel cryptographic structure enables a non-collusive and UC-secure two-party ECDSA scheme, allowing one party to be fully centralized while abstracting away the decentralization of the second party, enabling it to scale to an arbitrary number of virtual parties.

Audit Methodology and Focus Areas

Our audit covered the following aspects:

• Functional Correctness Assessment: We verified that the implementation of the protocol in the 2PC-MPC crate aligns with the specifications outlined in the accompanying paper. This included ensuring that the cryptographic operations are correctly implemented and that the protocol’s security properties are maintained.

• Security Assessment: We evaluated the security of the 2PC-MPC crate and its underlying crates, examining them for potential vulnerabilities that could compromise the security of the protocol. This included assessing the crates for common cryptographic vulnerabilities and ensuring their adherence to secure implementation best practices.

Key Findings and Recommendations

• Functional Correctness: The implementation generally aligns with the protocol specifications, with the cryptographic operations and protocol steps being correctly realized in the Rust code. However, due to the high complexity of the target, further analysis is recommended to ensure complete functional correctness.

• Security: We identified three main security findings of varying severity levels, including one critical issue of nonce reuse in the decentralized party presigning step.

• Code Complexity: The high complexity of the Rust implementation can make the codebase challenging to understand, maintain, and audit. We recommend strategies such as code simplification, comprehensive documentation, rigorous testing, and regular security audits to address this issue.

In addition, Symbolic Software provided a roadmap for future work that proposes several avenues for further exploration and development to enhance the protocol’s security, efficiency, and usability. These include an in-depth cryptographic review, cryptographic optimizations, protocol API correctness and usability analysis, state machine transition analysis, understanding the decentralized party in a protocol setting, performance and scalability testing, integration with existing systems and frameworks, and real-world applications and case studies.

Read the Report

→ Download Full Report (PDF)

Symbolic Software would like to thank Erik Takke and Tomer Ashur from 3MI Labs for their collaboration and support throughout the assessment process. We appreciate their expertise, insights, and dedication to advancing the field of secure multi-party computation. We would also like to extend our sincere thanks to Yehonathan Cohen Scaly and Dolev Mutzari of dWallet Labs for their valuable contributions and feedback on the assessment findings. Their expertise and feedback have been instrumental in enhancing the quality and accuracy of the assessment results.