Potentially replace unmaintained libraries ignored in audit.toml.

[ruseinov]

And revisit other ignores.

https://github.com/near/near-sdk-rs/blob/master/.cargo/audit.toml

[MPSxDev]

I am applying to this issue via OnlyDust platform.

My background and how it can be leveraged

I am a process engineer and I have a high problem-solving capacity. I am currently co-founder and developer of my own startup.

How I plan on tackling this issue

My work can be divided into 3 stages:

1. Research new solutions from other updated libraries
2. Deploy locally to see its usage and avoid errors or problems.
3. Implement until the desired goal is achieved.

This is my first ODack I hope to contribute a lot, I am available to start immediately

[frol]

@MPSxDev Go for it!

[MPSxDev]

Research Outcome:

This is the research work carried out, first checking that the repositories are maintained and active, and then verifying the existence of documentation in docs.rs. Below I leave the points found in the audit.toml file

Atty: This is no longer maintained 2 years ago an alternative:

• Use std.io.IsTerminal, introduced in Rust 1.70.0 which is part of The Rust Standard Library. Reference docs.rs

Wee_alloc: This has not been maintained for 3 years, a solution may be to implement

• WasmTools is highly actively maintained. Reference docs.rs
• As a direct replacement for wee_alloc, lol_alloc. Reference docs.rs

curve25519-dalek: Because it has vulnerabilities I found this alternative:

• ed25519 Reference docs.rs

I look forward to your comments and any other requests that may be required.

[frol]

We had a prior discussion about wee_alloc and decided to keep it: https://github.com/near/near-sdk-rs/pull/1151

atty, curve25519-dalek - they are not direct dependencies, right? Can we update any of direct dependencies to fix it?

[MPSxDev]

• In the case of atty, they themselves recommend using std.io.IsTerminal since it was incorporated into the Rust Standard Library. Ref IMG

• curve25519-dalek appears to have vulnerabilities but using Scalar29::sub (32-bit) and Scalar52::sub which can be solved by adding a volatile read as an optimization barrier as stated in this report: RUSTEC Report

[frol]

@MPSxDev near-sdk-rs does not directly depend on atty. Please, inspect the dependencies tree to identify which crates we need to update in order to upgrade/eliminate atty and curve25519-dalek. Once identified, we could make a decision whether we can contribute the fix to those dependencies as there is nothing near-sdk-rs can do about it directly.

[MPSxDev]

After a thorough investigation of the packages that include the involved dependencies.

These include the atty dependency:

• cargo-near 0.5.2
• env_logger 0.9.3

These include ed25519-dalek ( include curve25519-dalek):

• near-crypto 0.23.0 and 0.20.1
• near-cli-rs 0.7.8
• near-vm-runner 0.20.1 and 0.23.0
• slip10 0.4.3

Below are the affected packages used, including the current version and whether they continue to use these affected dependencies.

• cargo-near: The current version is 0.6.4, last updated on 2024-07-22. It could migrate atty to std.io.IsTerminal, as recommended by atty.
• env_logger: There is currently a new version 0.11.5 that does not use atty; it should be updated to this new version.
• near-crypto: The current version is 0.23.0 but it is using the affected version of curve25519-dalek, which should be updated to version >=4.1.3. It is also using version 2.1.0 of ed25519-dalek.
• near-cli-rs: The current version is 0.13.0 and uses version ed25519-dalek v2.
• near-vm-runner: The current version is 0.23.0 and continues to use version 2.1.0 of ed25519-dalek.
• slip10: This package is 3 years old and supports ed25519-dalek v1.
• ed25519-dalek: The current version is v2.1.1 and should be updated to use curve25519-dalek v4.1.3, which fixes the vulnerability according to this Reference.

In summary, the following steps should be taken:

1. Migrate from atty to std.io.IsTerminal in cargo-near.
2. Update env_logger to the latest version.
3. For near-crypto, near-cli-rs, and near-vm-runner, use versions higher than v2 for ed25519-dalek, which according to rustec.org includes the patch for the vulnerability in versions >=2.
4. For all mentioned in point 4, since ed25519-dalek uses curve25519-dalek as a dependency, version >=4.1.3 should be used.

[frol]

@MPSxDev Great summary! We definitely can act on the first two steps immediately. slip10 has been replaced with slipped10, and that should have been subsequently updated in the recent near-cli-rs and cargo-near releases. Can you give it a try upgrading the dependencies and authoring the atty PR to cargo-near as part of this issue?

[MPSxDev]

@frol Thank you very much. Yes, I can try to update this. If I have any questions, I will let you know.

[MPSxDev]

This issue should be closed, I have already done the audit on the latest version and there is no presence of atty and the versions of other dependencies are already updated to versions without the vulnerability. @frol