Canonical page: [Work & reports](https://www.guvenkaya.co/work) Report # NEAR Intents NEAR Intents Security Review Guvenkaya reviewed the NEAR Intents smart contracts, including the intent engine, payload verification and cryptography crates. [View PDF on GitHub](https://github.com/Guvenkaya/public-reports/blob/master/NEAR-Defuse-Labs-NEAR-Intents-Security-Review.pdf) ![NEAR Intents logo](https://www.guvenkaya.co/reports/assets/clients/near-intents.svg) Date of engagement: 12th February 2025 - 5th March 2025 - **Timur Güvenkaya** Principal advisor - **Michal Bajor** Specialist ## Engagement Dashboard ### Audit results Guvenkaya conducted a security assessment of the NEAR Intents from 12th February 2025 to 5th March 2025. NEAR Intents are a new type of transaction that allow information, requests, assets, and actions to be exchanged between AI agents, services, and end users. During this engagement, a total of 4 findings were reported. 1 of the findings was medium and the remaining were either low or informational severity. The NEAR Intents team has not fixed the issues yet. ### Engagement record - Client NEAR Intents - System NEAR Intents smart contracts - Review period 12th February 2025 - 5th March 2025 - Reviewed baseline `6da9e2b3ab598f277d45fb356aee01a5d80ac0a6` - Paths in scope 103 - Principal advisor Timur Güvenkaya - Specialist Michal Bajor ### Timeline 1. Review start 12th February 2025 2. Draft report 5th March 2025 ### Findings by severity - Critical **0** - High **0** - Medium **1** - Low **1** - Informational **2** ### Finding status at final report **4** Raised **1** Scheduled **3** Not Fixed ### Remediation complexity **4** Simple ### Impact **1** Severe **3** Negligible ### Likelihood **1** Possible **3** Rare ## Advisory and Client The advisory ![Guvenkaya](https://www.guvenkaya.co/logo.svg) Guvenkaya specializes in security for digital assets and financial infrastructure, from smart contracts and protocols to applications, infrastructure, custody and cryptography. Our team, including the sitting Heads of Security at Gauntlet and Agora, brings experience from Kraken, OpenZeppelin, Binance, ZKsync, Nillion, Invicti and EY. Across the team: 200+ security reviews, $30B+ in volume secured, 13 published cryptography research papers, and credentials including OSCP, OSWE and CISM. - Every reviewer has a public bio and is named before you sign. We match expertise to your system, with a principal leading scoping and checking findings. The client ![NEAR Intents](https://www.guvenkaya.co/reports/assets/clients/near-intents.svg) NEAR Intents is a cross-chain liquidity protocol for swaps, payments and asset onboarding. Users specify the assets and outcome they want, while the system coordinates routing and execution across supported blockchains. Wallets, applications and agents can integrate these capabilities into their own products. Applications obtain quotes from competing solvers. Signed intents express the authorized asset movements, which the Verifier contract validates and executes on NEAR. Developers can integrate through a widget or API; the 1Click API handles quote requests, intent creation and execution tracking, reducing the need to build separate integrations for each supported chain and asset pair. - Cross-chain swaps let users exchange an asset on one network for an asset on another. - Cross-pay lets a sender use one token while the recipient receives a preferred asset on another supported chain. - Asset onboarding lets a wallet or application accept deposits from a user's existing chain through the same network. ## Scope and Review Boundaries ### Review depths - Deep Line-by-line review with explicit attack hypotheses, adversarial reasoning about state transitions, and reproduction attempts for each hypothesis that survived reading. - Supporting The code was read for its effect on a reviewed flow. Behaviour outside that effect was not assessed. - Targeted Entry points were exercised or triaged against the flow's security properties rather than read in full. This is the code we read, and how closely. 103 paths are in scope. Each path links to the file at the reviewed commit. | Path | Review depth | Scope note | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | ---------------------- | | [`admin-utils/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/admin-utils/src/lib.rs) | Deep | Admin Utils Lib | | [`admin-utils/src/full_access_keys.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/admin-utils/src/full_access_keys.rs) | Deep | Full Access Keys | | [`bitmap/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/bitmap/src/lib.rs) | Deep | Bitmap Lib | | [`borsh-utils/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/borsh-utils/src/lib.rs) | Deep | Borsh Utils Lib | | [`borsh-utils/src/base64.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/borsh-utils/src/base64.rs) | Deep | Base64 | | [`borsh-utils/src/string.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/borsh-utils/src/string.rs) | Deep | String | | [`controller/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/controller/src/lib.rs) | Deep | Controller Lib | | [`core/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/lib.rs) | Deep | Core Lib | | [`core/src/accounts.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/accounts.rs) | Deep | Accounts | | [`core/src/deadline.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/deadline.rs) | Deep | Deadline | | [`core/src/engine/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/engine/mod.rs) | Deep | Engine Mod | | [`core/src/engine/inspector.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/engine/inspector.rs) | Deep | Engine Inspector | | [`core/src/engine/state/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/engine/state/mod.rs) | Deep | State Mod | | [`core/src/engine/state/cached.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/engine/state/cached.rs) | Deep | State Cached | | [`core/src/engine/state/deltas.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/engine/state/deltas.rs) | Deep | State Deltas | | [`core/src/error.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/error.rs) | Deep | Error | | [`core/src/events.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/events.rs) | Deep | Events | | [`core/src/fees.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/fees.rs) | Deep | Fees | | [`core/src/intents/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/intents/mod.rs) | Deep | Intents Mod | | [`core/src/intents/account.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/intents/account.rs) | Deep | Intent Account | | [`core/src/intents/token_diff.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/intents/token_diff.rs) | Deep | Token Diff | | [`core/src/intents/tokens.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/intents/tokens.rs) | Deep | Tokens (Intents) | | [`core/src/nonce.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/nonce.rs) | Deep | Nonce | | [`core/src/payload/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/payload/mod.rs) | Deep | Payload Mod | | [`core/src/payload/erc191.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/payload/erc191.rs) | Deep | ERC191 Payload | | [`core/src/payload/multi.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/payload/multi.rs) | Deep | Multi Payload | | [`core/src/payload/nep413.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/payload/nep413.rs) | Deep | NEP413 Payload | | [`core/src/payload/raw.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/payload/raw.rs) | Deep | Raw Payload | | [`core/src/payload/webauthn.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/payload/webauthn.rs) | Deep | WebAuthn Payload | | [`core/src/tokens.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/core/src/tokens.rs) | Deep | Tokens (Core) | | [`crypto/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/lib.rs) | Deep | Crypto Lib | | [`crypto/src/curve/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/curve/mod.rs) | Deep | Curve Mod | | [`crypto/src/curve/ed25519.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/curve/ed25519.rs) | Deep | ED25519 | | [`crypto/src/curve/p256.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/curve/p256.rs) | Deep | P256 | | [`crypto/src/curve/secp256k1.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/curve/secp256k1.rs) | Deep | Secp256k1 | | [`crypto/src/payload.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/payload.rs) | Deep | Payload (Crypto) | | [`crypto/src/public_key.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/public_key.rs) | Deep | Public Key | | [`crypto/src/serde/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/serde/mod.rs) | Deep | Serde Mod | | [`crypto/src/serde/curve.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/serde/curve.rs) | Deep | Serde Curve | | [`crypto/src/signature.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/crypto/src/signature.rs) | Deep | Signature | | [`defuse/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/lib.rs) | Deep | Defuse Lib | | [`defuse/src/accounts.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/accounts.rs) | Deep | Accounts (Defuse) | | [`defuse/src/contract/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/mod.rs) | Deep | Contract Mod | | [`defuse/src/contract/abi.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/abi.rs) | Deep | ABI | | [`defuse/src/contract/accounts/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/accounts/mod.rs) | Deep | Accounts Mod | | [`defuse/src/contract/accounts/account.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/accounts/account.rs) | Deep | Account | | [`defuse/src/contract/accounts/state.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/accounts/state.rs) | Deep | State (Accounts) | | [`defuse/src/contract/admin.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/admin.rs) | Deep | Admin | | [`defuse/src/contract/config.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/config.rs) | Deep | Config | | [`defuse/src/contract/events.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/events.rs) | Deep | Events (Contract) | | [`defuse/src/contract/fees.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/fees.rs) | Deep | Fees (Contract) | | [`defuse/src/contract/intents/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/intents/mod.rs) | Deep | Intents Mod (Contract) | | [`defuse/src/contract/intents/execute.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/intents/execute.rs) | Deep | Execute | | [`defuse/src/contract/intents/relayer.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/intents/relayer.rs) | Deep | Relayer | | [`defuse/src/contract/intents/simulate.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/intents/simulate.rs) | Deep | Simulate | | [`defuse/src/contract/intents/state.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/intents/state.rs) | Deep | State (Intents) | | [`defuse/src/contract/state.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/state.rs) | Deep | State (Contract) | | [`defuse/src/contract/tokens/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/mod.rs) | Deep | Tokens Mod (Contract) | | [`defuse/src/contract/tokens/nep141/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep141/mod.rs) | Deep | NEP141 Mod | | [`defuse/src/contract/tokens/nep141/deposit.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep141/deposit.rs) | Deep | NEP141 Deposit | | [`defuse/src/contract/tokens/nep141/native.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep141/native.rs) | Deep | NEP141 Native | | [`defuse/src/contract/tokens/nep141/withdraw.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep141/withdraw.rs) | Deep | NEP141 Withdraw | | [`defuse/src/contract/tokens/nep171/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep171/mod.rs) | Deep | NEP171 Mod | | [`defuse/src/contract/tokens/nep171/deposit.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep171/deposit.rs) | Deep | NEP171 Deposit | | [`defuse/src/contract/tokens/nep171/withdraw.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep171/withdraw.rs) | Deep | NEP171 Withdraw | | [`defuse/src/contract/tokens/nep245/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep245/mod.rs) | Deep | NEP245 Mod | | [`defuse/src/contract/tokens/nep245/core.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep245/core.rs) | Deep | NEP245 Core | | [`defuse/src/contract/tokens/nep245/deposit.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep245/deposit.rs) | Deep | NEP245 Deposit | | [`defuse/src/contract/tokens/nep245/resolver.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep245/resolver.rs) | Deep | NEP245 Resolver | | [`defuse/src/contract/tokens/nep245/withdraw.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/tokens/nep245/withdraw.rs) | Deep | NEP245 Withdraw | | [`defuse/src/contract/upgrade.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/contract/upgrade.rs) | Deep | Upgrade | | [`defuse/src/fees.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/fees.rs) | Deep | Fees (Defuse) | | [`defuse/src/intents.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/intents.rs) | Deep | Intents (Defuse) | | [`defuse/src/tokens/mod.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/tokens/mod.rs) | Deep | Tokens Mod (Defuse) | | [`defuse/src/tokens/nep141.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/tokens/nep141.rs) | Deep | NEP141 (Defuse) | | [`defuse/src/tokens/nep171.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/tokens/nep171.rs) | Deep | NEP171 (Defuse) | | [`defuse/src/tokens/nep245.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/defuse/src/tokens/nep245.rs) | Deep | NEP245 (Defuse) | | [`erc191/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/erc191/src/lib.rs) | Deep | ERC191 Lib | | [`map-utils/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/map-utils/src/lib.rs) | Deep | Map Utils Lib | | [`map-utils/src/btree_map.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/map-utils/src/btree_map.rs) | Deep | BTree Map | | [`map-utils/src/cleanup.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/map-utils/src/cleanup.rs) | Deep | Cleanup | | [`map-utils/src/hash_map.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/map-utils/src/hash_map.rs) | Deep | Hash Map | | [`map-utils/src/iter.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/map-utils/src/iter.rs) | Deep | Iter | | [`map-utils/src/near.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/map-utils/src/near.rs) | Deep | Near (Map Utils) | | [`near-utils/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/near-utils/src/lib.rs) | Deep | Near Utils Lib | | [`near-utils/src/cache.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/near-utils/src/cache.rs) | Deep | Cache | | [`near-utils/src/gas.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/near-utils/src/gas.rs) | Deep | Gas | | [`near-utils/src/panic.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/near-utils/src/panic.rs) | Deep | Panic | | [`near-utils/src/prefix.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/near-utils/src/prefix.rs) | Deep | Prefix | | [`nep245/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep245/src/lib.rs) | Deep | NEP245 Lib | | [`nep245/src/core.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep245/src/core.rs) | Deep | Core (NEP245) | | [`nep245/src/events.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep245/src/events.rs) | Deep | Events (NEP245) | | [`nep245/src/receiver.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep245/src/receiver.rs) | Deep | Receiver | | [`nep245/src/resolver.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep245/src/resolver.rs) | Deep | Resolver (NEP245) | | [`nep245/src/token.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep245/src/token.rs) | Deep | Token | | [`nep413/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep413/src/lib.rs) | Deep | NEP413 Lib | | [`nep461/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/nep461/src/lib.rs) | Deep | NEP461 Lib | | [`num-utils/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/num-utils/src/lib.rs) | Deep | Num Utils Lib | | [`serde-utils/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/serde-utils/src/lib.rs) | Deep | Serde Utils Lib | | [`serde-utils/src/base58.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/serde-utils/src/base58.rs) | Deep | Base58 | | [`serde-utils/src/base64.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/serde-utils/src/base64.rs) | Deep | Base64 (Serde) | | [`webauthn/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/webauthn/src/lib.rs) | Deep | WebAuthn Lib | | [`wnear/src/lib.rs`](https://github.com/near/intents/blob/6da9e2b3ab598f277d45fb356aee01a5d80ac0a6/wnear/src/lib.rs) | Deep | WNEAR Lib | ### Out of scope The audit will include reviewing the code for security vulnerabilities. The audit does not include a review of the tests and dependencies. ## Assessment Framework Guvenkaya rates findings by likelihood and impact so remediation can be prioritized by technical risk, business context, and the decision the engagement is meant to support. ### Rating chain applied to every finding 1. 01 **Likelihood** Likely, possible or rare 2. 02 **Impact** Severe, moderate or negligible 3. 03 **Severity** Derived from the matrix below 4. 04 **Remediation complexity** Simple, moderate or difficult 5. 05 **Status** Not fixed, fixed, acknowledged or scheduled ### Impact | Impact | What it means here | | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Severe | Exploitation could result in critical loss or compromise, such as full system control, substantial financial loss, or severe reputational damage. | | Moderate | Exploitation may lead to limited data loss, partial compromise, moderate financial impact, or noticeable degradation of services. | | Negligible | Exploitation has minimal impact, such as minor data exposure without significant consequences or slight inconvenience without substantial disruption. | ### Likelihood | Likelihood | What it means here | | ---------- | -------------------------------------------------------------------------------------------------- | | Likely | The vulnerability is easily discoverable and not overly complex to exploit. | | Possible | The vulnerability presents some challenges either in discovery or in the complexity of the attack. | | Rare | The vulnerability is either very difficult to discover or complex to exploit, or both. | This matrix provides a nuanced view, taking into account both the ease of discovering a vulnerability and the complexity involved in exploiting it. | Attack Complexity \ Discovery Ease | Obvious | Concealed | Hidden | | ---------------------------------- | -------- | --------- | -------- | | Complex | Possible | Rare | Rare | | Moderate | Likely | Possible | Rare | | Straightforward | Likely | Possible | Possible | ### Severity | Severity | What it means here | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical | Assigned to vulnerabilities with severe impact and a likely likelihood of exploitation. | | High | For vulnerabilities with either severe impact but only a possible likelihood, or moderate impact with a likely likelihood. | | Medium | Used for vulnerabilities with severe impact but a rare likelihood, moderate impact with a possible likelihood, or negligible impact with a likely likelihood. | | Low | For vulnerabilities with moderate impact and rare likelihood, or negligible impact with a possible likelihood. | | Informational | The lowest severity rating, typically for vulnerabilities with negligible impact and a rare likelihood of exploitation. | | Likelihood \ Impact | Severe | Moderate | Negligible | | ------------------- | -------- | -------- | ------------- | | Likely | Critical | High | Medium | | Possible | High | Medium | Low | | Rare | Medium | Low | Informational | ### Remediation complexity This measures how difficult it is to remediate a finding once it has been identified. | Remediation complexity | What it means here | | ---------------------- | ------------------------------------------------------------------------------------------------------------------ | | Simple | Patches or fixes are readily available and easily implemented. | | Moderate | Requires some time and resources to remediate, but well within the capabilities of most organizations. | | Difficult | Remediation requires significant resources, specialized skills, or substantial changes to systems or architecture. | ### Finding status This tracks the client's response to each finding and whether remediation has been completed, accepted, or scheduled. | Status | What it means here | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Not Fixed | Indicates that the vulnerability has been identified but no remedial action has been taken yet. This status is crucial for newly discovered vulnerabilities or those awaiting prioritization. | | Fixed | This status is applied when the vulnerability has been successfully remediated. It implies that appropriate measures, such as patching, configuration changes, or architectural modifications, have been implemented to resolve the issue. | | Acknowledged | This status is used for vulnerabilities that have been recognized, but for various reasons (such as risk acceptance, cost, or other business decisions), have not been fixed. It indicates that the risk posed by the vulnerability is known and has been consciously accepted. | | Scheduled | This status indicates that the vulnerability has been acknowledged and a plan is in place to fix it in the future. It signifies that while remediation hasn't yet occurred, the issue has been prioritized and is part of the planned development roadmap. | ## Findings Summary **4** All findings **0** Critical **0** High **1** Medium **1** Low **2** Informational ### Findings register | Finding | Impact | Likelihood | Severity | Remediation complexity | Status | | --------------------------------------------------------------------------------- | ---------- | ---------- | ------------- | ---------------------- | --------- | | [GUV-1: Potential Funds Stealing From Users Via Repeating Failed Intents](#guv-1) | Severe | Rare | Medium | Simple | Scheduled | | [GUV-2: Possible DoS Of Public Keys Viewing Per User](#guv-2) | Negligible | Possible | Low | Simple | Not Fixed | | [GUV-3: Arbitrary Public Key Setting In Privileged Functions](#guv-3) | Negligible | Rare | Informational | Simple | Not Fixed | | [GUV-4: Missing Event Emission For Critical Access Control Operations](#guv-4) | Negligible | Rare | Informational | Simple | Not Fixed | ## Detailed Findings ### GUV-1: Potential Funds Stealing From Users Via Repeating Failed Intents - Severity Medium - Impact Severe - Likelihood Rare - Remediation Complexity Simple - Status Scheduled #### Description Depending on the intent structure, it's possible to maliciously fail a transaction and then repeat specific intents, which could lead to: - Stealing tokens - Making solvers lose money or perform unauthorized operations Mainnet deadlines are permissive, ranging from 20 seconds to 10 minutes. This provides ample time to fail a transaction and repeat failed intents. A transaction can be failed by: - Invalidating the nonce after signing in a separate transaction. - Adding an additional intent to your intent array that transfers funds out and fails your token diff Malicious actor can: - Repeat selected intents. - Repeat selected intents and, to maintain `TokenDiff` balance, resign your controlled intents with new values. - Observe failed intents on the blockchain and reconstruct them like building blocks (while deadlines remain valid). The risk is low when `TokenDiff` intent is used, as mainnet calculations are typically precise, making it difficult to modify the intent structure while maintaining zero delta and gaining benefits. The vulnerability is particularly dangerous in **P2P** transfer scenarios where `TokenDiff` intent isn't used, allowing for immediate exploitation with high success rates. #### Impact Funds can be stolen in scenarios where `TokenDiff` intent isn't used. #### Recommendation This behavior should be documented to emphasize that TokenDiff is the preferred method, while Transfer should be discouraged for facilitating swaps. Users must understand they are responsible for reviewing and approving what they sign. #### Remediation The NEAR Intents team has acknowledged the issue and will fix it soon by documenting this scenario. ### GUV-2: Possible DoS Of Public Keys Viewing Per User - Severity Low - Impact Negligible - Likelihood Possible - Remediation Complexity Simple - Status Not Fixed #### Description It was observed that since user can have unlimited public keys, it is possible for a malicious user to cause a DoS of `public_keys_of` method when their account is used. That’s because `public_keys_of` iterates over public keys of a provided account and if account has a lot of public keys it can lead to the error due to a gas limit. defuse/​src/​contract/​accounts/​mod.rs ``` fn public_keys_of(&self, account_id: &AccountId) -> HashSet { self.accounts.get(account_id).map_or_else( || { PublicKey::from_implicit_account_id(account_id) .into_iter() .collect() }, |account| account.iter_public_keys(account_id).collect(), ) } ``` #### Impact - Errors in off-chain components, which utilize `public_keys_of` method. - If `iter_public_keys` is utilized within the smart contract logic somewhere else, depending on a logic it can lead to the DoS on protocol level #### Recommendation It is recommended to limit the number of public keys each account can have #### Remediation The NEAR Intents team has not fixed the issue yet. ### GUV-3: Arbitrary Public Key Setting In Privileged Functions - Severity Informational - Impact Negligible - Likelihood Rare - Remediation Complexity Simple - Status Not Fixed #### Description The codebase accepts public keys in multiple locations without proper validation. The NEAR SDK's `PublicKey` type lacks comprehensive validation of public key formats and values. Malicious users could potentially inject invalid or malformed public keys, leading to undefined behavior in cryptographic operations. #### PoC poc ``` fn test_parse_zero_pubkey() { use near_sdk::PublicKey; let zero_pubkey_str = "ed25519:11111111111111111111111111111111"; let result = zero_pubkey_str.parse::<PublicKey>(); assert!(result.is_err()); } ``` #### Impact - Potential undefined behavior in cryptographic operations - Potential injection of weak public keys that can lead to signature malleability #### Recommendation Implement comprehensive validation for public keys in all relevant functions. - Account Public Key Management (add\_public\_key, remove\_public\_key) - Relayer Keys Management (do\_add\_relayer\_key, delete\_relayer\_key) - Full Access Keys Management (add\_full\_access\_key, delete\_key) #### Remediation The NEAR Intents team has not fixed the issue yet. ### GUV-4: Missing Event Emission For Critical Access Control Operations - Severity Informational - Impact Negligible - Likelihood Rare - Remediation Complexity Simple - Status Not Fixed #### Description The relayer keys operations lacks event emissions for access control operations in `delete_relayer_key()` and `do_add_relayer_key()` methods. This omission makes it difficult to track and audit changes to the relayer key set off-chain. Events are essential for maintaining transparency and allowing external systems to monitor and react to important state changes in the contract. #### Recommendation Implement event emissions for both adding and removing relayer keys #### Remediation The NEAR Intents team has not fixed the issue yet. The web version and the [PDF](https://www.guvenkaya.co/reports/pdfs/near-intents.pdf) (19 pages) are generated from the same source. The [report as first delivered](https://github.com/Guvenkaya/public-reports/blob/master/legacy-design/NEAR-Defuse-Labs-NEAR-Intents-Security-Review.pdf) is kept in the public reports archive. ## Table of Contents - [Engagement Dashboard](#engagement-dashboard) - [Advisory and Client](#advisory-and-client) - [Scope and Review Boundaries](#scope-and-review-boundaries) - [Assessment Framework](#assessment-framework) - [Findings Summary](#findings-summary) - [Detailed Findings](#detailed-findings) ## Share [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.guvenkaya.co%2Freports%2Fnear-intents\&text=NEAR%20Intents%3A%20NEAR%20Intents%20Security%20Review) [Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.guvenkaya.co%2Freports%2Fnear-intents) [Share on Threads](https://www.threads.net/intent/post?text=NEAR%20Intents%3A%20NEAR%20Intents%20Security%20Review%20https%3A%2F%2Fwww.guvenkaya.co%2Freports%2Fnear-intents) [Discuss a security review](https://www.guvenkaya.co/contact?source=report) [View PDF on GitHub](https://github.com/Guvenkaya/public-reports/blob/master/NEAR-Defuse-Labs-NEAR-Intents-Security-Review.pdf) ## Tell us what you need to secure. Describe your system, main concern, and deadline. We’ll reply with scoping questions and a proposed next step. [Discuss your scope](https://www.guvenkaya.co/contact?source=report)