Security Audit Report for EOS EVM

The target of this audit is the implementation of the EOS EVM, which is a compatibility layer deployed on top of the EOS blockchain. The EOS EVM serves as an implementation of the Ethereum Virtual Machine (EVM). It is implemented in C++ and compiled to a WASM binary to be executed within the EOS blockchain. The EOS EVM utilizes a modified version of Silkworm and Evmone for the execution of the EVM operations.

The EOS EVM is an emulation of the EVM, housed within an EOS smart contract. EOS EVM bridges the EOS ecosystem to the Ethereum ecosystem by allowing developers to deploy a wide array of Solidity-based smart contracts and innovative dApps on the EOS Network to make use of its world class performance and low gas fees. Developers can utilize Ethereum’s battle-tested open source code, tooling, libraries and SDKs while leveraging the superior performance of EOS to create a multichain Web3 experience. The EOS EVM Ecosystem has opened up a new world of opportunities for those who wish to leverage the performance, reliability, and low fees on EOS from within the familiar EVM framework.

Our audit methodology employs differential testing, automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we have found that the codebase contains several high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as security suggestions that should be considered. The EOS EVM development team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.