Serpent Compiler Audit

Zeppelin
Zeppelin
Jul 28, 2017 · 3 min read

The Augur team asked us to review and audit the Serpent compiler. We looked at the code and now publish our results.

The audited project can be found in the ethereum/serpent GitHub repository. The version used for this report is commit ad53fa2a8a496448d58ef9137959b4a1e86b14d7.

We have found the Serpent project to be of very low quality. It is untested, there’s very little documentation, and language design is very flawed. Serpent should not be considered safe to use unless many critical problems are fixed.

The full report can be found here, and a list summary of the issues ordered by severity can be found next.

Critical Severity

High Severity

Medium severity

Low severity

Conclusions

Eight critical security issues were found and explained, along with recommendations on how to fix them. Some additional changes were proposed to follow best practices and reduce potential attack surface.

We have found the Serpent project to be of very low quality. It is untested, there’s very little documentation, and language design is very flawed. Serpent should not be considered safe to use unless many critical problems are fixed.

Note that as of the date of publishing, the above review reflects the current understanding of known security patterns as they relate to the Serpent compiler. We have not reviewed the related Augur project. The above should not be construed as investment advice or an offering of tokens. For general information about smart contract security, check out our thoughts here.

Be part of the community

Zeppelin Blog

Growing and protecting the core infrastructure of an open, global economy, powered by blockchain technologies.

Zeppelin

Written by

Zeppelin

We build software to grow and protect the core infrastructure of an open, global economy, powered by blockchain technologies.

Zeppelin Blog

Growing and protecting the core infrastructure of an open, global economy, powered by blockchain technologies.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade