Blockchain Transaction Lifecycle Security Standard version 1: Audit Framework

This version: https://specs.blockchainssc.org/btl/audit-01/

Introduction

This is a guidance for determining conformance to each requirement in the BSSC Blockchain Transaction Lifecycle Security Standard version 1.

Conformance

This documentation is informative guidance. In case of conflict between this documentation and the BSSC Blockchain Transaction Lifecycle Security Standard version 1, readers should treat the BSSC Blockchain Transaction Lifecycle Security Standard version 1 as authoritative.

General Requirements

• Require Strong Authentication
• Tamper-Proof Logs
• Retain Logs
• Minimize Personal Information Exposure
• Document PII Handling
• Document Hashing Process
• Document Signing Process
• Enable Canceling Transactions
• Check Complete Hashes and Addresses
• Verify Received Transactions
• Document Software Supply Chain
• Document Cryptography Migration Procedures
• Prepare for Cryptography Migration
• Implement Readability Standards
• Render from Signed Bytes
• Present Crucial Information in Readibility-optimised form
• Present Readibility-optimised Information
• Maintain Transaction Integrity
• Communicate Securely
• Expose Transaction Value for Verification

Requirements for Producers

• No Hidden Defaults
• Attach Vital Metadata
• Add Useful Metadata
• Validate Transactions for Each Chain
• Log Transaction Creation
• Hash Transactions
• Use Hardened Environments
• Validate Inputs
• Limit Gas Fees
• Simulate Transactions
• Reject Unauthorized Construction
• Mitigate Timing Attacks
• Verify Transaction Sets
• Apply Transaction Policies to Generation
• Enable Transaction Policies for Generation

Requirements for Signature Managers

• Log All Signature Requests
• Validate Allowed Signers
• Compare Old Transactions
• Require Multiple Signers
• Verify Correct Ordering
• Warn about Timing Attacks
• Apply Transaction Policies to Signing
• Enable Transaction Policies for Signing
• Verify Bytecode
• Verify Access Control
• Implement Upgrade Safety Controls
• Secure Signed Stored Transactions

Requirements for Deployers

• Verify Deployment Authorization
• Log All Delivery Attempts
• Broadcast to Authorized RPC Nodes
• Use Backoff Logic with Retried Delivery
• Verify at Point of Delivery
• Monitor Delivery Latency
• Apply Transaction Policies for Deployment
• Enable Transaction Policies for Deployment
• Limit Transaction Changes at Delivery
• Deliver Transactions Promptly
• Ensure Delivery Capacity
• Re-Verify Application Transactions
• Implement Protected Delivery Paths
• Secure Stored Transactions
• Monitor Stored Transaction Deployment Triggers
• Allow Batching and Throttling

Requirements for Indexers

• Use Tamper-resistant Transaction Storage
• Index Successful Transactions
• Document Finality
• Present Transactions Accurately
• Index Transactions' Finality
• Index Failed Transactions

Appendices

• References
• Checklist