MAP Protocol v2 security relies on multiple layers of protection including TSS threshold signatures, consensus mechanisms, penalty mechanisms, and emergency pauses. This document details various security measures and response strategies.
Byzantine Fault Tolerance
Basic Principle
The system is designed based on Byzantine Fault Tolerance (BFT) principles, tolerating up to 1/3 of nodes failing or acting maliciously:
Tolerate < 1/3 nodes offline
Tolerate < 1/3 malicious nodes
Tolerate < 1/3 nodes disconnected
TSS Signature Security
KeyGen: Requires all participants to collaborate
KeySign: Requires 2/3+ nodes to participate
Any coalition of < 1/3 nodes cannot independently generate valid signatures
Consensus Security
All critical operations require 2/3+ Maintainer confirmation:
ObservedTxIn / ObservedTxOut
Any coalition of < 1/3 nodes cannot forge consensus
Election Restrictions
During each TSS switch, no more than 1/3 of members can be removed from the original Maintainer set. This ensures sufficient overlap between old and new sets, preventing security risks from replacing too many nodes at once.
Asset Theft Handling
Detection Mechanism
Observers detect abnormal transactions by checking:
Memo doesn't match TxOutItem
Transfer amount doesn't match expected
Target address doesn't match expected
Gas consumed exceeds maximum allowed
Penalty Calculation
The stolen token value (including gas fees) is converted to MAPO value and multiplied by a penalty coefficient greater than 1. The penalty is distributed proportionally among Vault Maintainers based on their stake.
Automatic Pause
When the penalty amount exceeds the configured threshold, the affected chain is automatically paused to prevent further losses.
Pause Mechanism
Asset theft, chain anomaly
All cross-chain operations for that chain
System-level security event
All cross-chain operations
Cross-chain operations for that token
Behavior During Pause
New cross-chain requests are rejected
In-progress transactions continue execution
Observer continues monitoring for post-recovery handling
Users can initiate refund requests
Replay Attack Protection
Order ID Mechanism
Each cross-chain transaction has a unique Order ID derived from source chain, transaction hash, and log index. The system checks if an order has been executed before processing and marks it as executed afterward.
Nonce/Epoch Mechanism
Operations requiring multiple signatures (like TSS key updates) include epoch numbers that must exceed the current epoch, preventing replay of old signatures.
Signature Security
Signature Verification
Gateway contracts verify TSS signatures by:
Recovering the public key from the signature
Verifying it matches the current TSS address
Signature messages include context information to prevent cross-chain replay:
Private Key Share Protection
Private key shares encrypted with password
Private keys not written to disk during runtime
Private keys cleared from memory on exit
TSS switching provides key rotation:
Generate new TSS key pair periodically
Old key shares become invalid
Recommended forced rotation every N epochs
Network Security
P2P Communication
Maintainer inter-communication uses:
TLS/Noise protocol encryption
Node identity verification via ed25519 public key
Message signing to prevent tampering
Protection against man-in-the-middle attacks
Chain RPC access employs:
Cross-validation of responses
Prevention of single point of failure
Protection against RPC spoofing
Economic Security
Staking Requirement
Maintainers must stake sufficient MAPO as:
Collateral for malicious behavior penalties
Incentive for honest behavior
Stake amount affects election priority
Penalty Deterrence
The penalty system ensures malicious behavior is economically irrational:
Slash Points affect rewards and election
Jail Epochs prohibit election participation
Stake slashing directly deducts from stake
Penalty amounts exceed potential malicious gains
Emergency Response
Admin multisig address for emergency operations
Core team 24/7 response capability
2/3 normal nodes sufficient
Refund with fee deduction
Receiving address anomaly
Fault tolerant transfer to vault
Order ID prevents duplicates
Supported Chains
Contract Chains
Non-contract Chains
