Blockchain Transaction Lifecycle Security Standard Audit Framework

previous: Apply Transaction Policies to Signing | Contents | next: Verify Access Control

Verify Bytecode

Statement of Requirement

For Application Transactions, Signature Managers MUST verify that the bytecode of any contract to be deployed is accurately built from the declared source code before signing.

See it in the specification

Applicability

Purpose

Ensure Application Transactions are only signed when the code they deployed is verified.

Audit Procedure

Verify that the Signature Manager checks Application Transactions and rejects them unless the code for deployment accurately reflects the source code, compiled according to the metadata provided

Success Criteria

The Signature Manager tests Application Transactions code, and verifies that it matches the source code provided to the Producer.

Failure Criteria

An Application Transaction is signed without verifying that the code it deploys matches the source code provided through metadata

Key Evidence

previous: Apply Transaction Policies to Signing | Contents | next: Verify Access Control