RiB Newsletter #37

July 06, 2022

Welcome to the #37 edition of Rust in Blockchain, the monthly newsletter about Rust, distributed systems, cryptography, and other industry topics. Previous: #36.

Thanks

Thanks to contributors: djddo, Hunter Trujillo, keymakercasa, kn0wmad, mradkov, Piotr Dziubecki, Samuel Dare, Brian Anderson, and Aimee Zhu. Thank you for your help!

RiB needs help to keep up with Rust blockchain projects. If you follow a particular project, or otherwise find information that is beneficial to the Rust & blockchain community, please contribute to the next issue by submitting a PR to the next draft.

Project Spotlight

Each month we like to shine a light on a notable Rust blockchain project. This month that project is…

lurk-lang.

Lurk is a Lisp the correct execution of which can be proved with recursive SNARKS. The lurk-rs implementation compiles by transpiling through rustc.

Interesting Things

Blog Posts

Papers

Projects

Cleopatra Cairo. A Rust implementation of the Cairo VM. Cairo is a programming language for writing provable programs, where one party can prove to another that a certain computation was executed correctly. Cairo and similar proof systems can be used to provide scalability to blockchains.
Rust Discrete Log Contracts. DLCs are a means of creating derivatives, futures, and stablecoin contracts on Bitcoin. For more, see the DLC specs. It makes use of the rust-lightning (LDK) and rust-bitcoin crates.
arkworks::algebra. Libraries for finite field, elliptic curve, and polynomial arithmetic
Circuits for zkEVM.
Lurk. A Turing-complete programming language for Zero-Knowledge Proofs.

Security Advisories

Monthly security advisories, from RustSec, and GitHub Advisories. Bold entries here are especially relevant to blockchain projects.

RUSTSEC-2022-0033: Vulnerability in openssl-src.
- Heap memory corruption with RSA private key operation.
RUSTSEC-2022-0032: Vulnerability in openssl-src.
- AES OCB fails to encrypt some bytes.
RUSTSEC-2022-0029: Vulnerability in crossbeam.
- MsQueue push/pop use the wrong orderings
CVE-2021-41641: Link following in Deno.
CVE-2022-31100: Reachable assertion in rulex.
CVE-2022-31099: Uncontrolled recursion in rulex.
CVE-2022-31104: Miscompilation of i8x16.swizzle and select with v128 inputs in cranelift.

GitHub issued a large set of Rust advisories on a single day in June, but it seems to be a result of importing old RustSec advisories.

Most Active in June

Parity: 557 merged PRs, 152 closed issues, 130 open issues

Solana: 501 merged PRs, 95 closed issues, 103 open issues

Sui: 343 merged PRs, 155 closed issues, 140 open issues

Fuel: 339 merged PRs, 214 closed issues, 180 open issues

Aptos: 290 merged PRs, 81 closed issues, 32 open issues

Project Updates

Aleo

50 merged PRs (1, 2, 3), 25 closed issues (1, 2), 14 open issues (1, 2, 3)

Anoma

19 merged PRs (1), 10 closed issues (1), 28 open issues (1)

Aptos

290 merged PRs (1), 81 closed issues (1), 32 open issues (1)

Casper

69 merged PRs (1, 2), 79 closed issues (1, 2), 41 open issues (1, 2)

ChainSafe

45 merged PRs (1, 2), 91 closed issues (1, 2, 3), 20 open issues (1, 2)

COMIT

4 merged PRs (1, 2, 3), 0 closed issues, 3 open issues (1, 2)

Concordium

38 merged PRs (1, 2, 3, 4, 5, 6, 7, 8), 49 closed issues (1, 2, 3, 4, 5, 6, 7), 34 open issues (1, 2, 3, 4, 5, 6)

Conflux

16 merged PRs (1), 0 closed issues, 0 open issues

DarkFi

2 merged PRs (1), 2 closed issues (1), 2 open issues (1)

Dfinity

92 merged PRs (1, 2, 3, 4, 5, 6, 7, 8), 34 closed issues (1, 2, 3, 4, 5, 6, 7), 7 open issues (1, 2, 3)

Dusk Network

27 merged PRs (1, 2, 3, 4, 5), 27 closed issues (1, 2, 3, 4), 7 open issues (1, 2, 3, 4)

Elrond

37 merged PRs (1, 2, 3, 4, 5), 15 closed issues (1, 2), 3 open issues (1)

Elrond Incident and Recovery Report

Espresso Systems

68 merged PRs (1, 2, 3), 46 closed issues (1, 2), 23 open issues (1, 2, 3)

Findora

36 merged PRs (1, 2, 3, 4), 0 closed issues, 0 open issues

Fluence

52 merged PRs (1, 2, 3, 4, 5, 6, 7), 27 closed issues (1, 2, 3, 4), 3 open issues (1, 2)

Fuel

339 merged PRs (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12), 214 closed issues (1, 2, 3, 4, 5, 6, 7, 8, 9), 180 open issues (1, 2, 3, 4, 5, 6, 7, 8)

Golem

42 merged PRs (1, 2, 3, 4, 5, 6), 42 closed issues (1, 2), 22 open issues (1, 2, 3)

Grin

2 merged PRs (1, 2), 0 closed issues, 3 open issues (1, 2)

Helium

8 merged PRs (1, 2, 3, 4), 9 closed issues (1, 2), 2 open issues (1, 2)

Holochain

40 merged PRs (1, 2, 3), 3 closed issues (1, 2), 5 open issues (1, 2)

IOTA

242 merged PRs (1, 2, 3, 4, 5, 6, 7), 65 closed issues (1, 2, 3, 4, 5, 6), 42 open issues (1, 2, 3, 4, 5, 6, 7, 8)

Maidsafe

75 merged PRs (1, 2, 3, 4, 5, 6), 8 closed issues (1), 6 open issues (1, 2, 3)

MobileCoin

110 merged PRs (1, 2), 26 closed issues (1), 14 open issues (1)

NEAR

202 merged PRs (1, 2, 3, 4, 5, 6, 7, 8, 9, 10), 49 closed issues (1, 2, 3, 4, 5, 6, 7, 8), 52 open issues (1, 2, 3, 4, 5, 6)

NEAR Foundation Launches Smart Contract Audit Program

Nervos

179 merged PRs (1, 2, 3, 4, 5, 6, 7, 8, 9), 9 closed issues (1, 2, 3, 4), 4 open issues (1, 2, 3)

Major Protocol Upgrade – Diving Into CKB-VM V1

Oasis

42 merged PRs (1, 2, 3), 4 closed issues (1, 2), 1 open issues (1)

Parity

557 merged PRs (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15), 152 closed issues (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14), 130 open issues (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)

Secret Network

5 merged PRs (1, 2), 3 closed issues (1, 2), 2 open issues (1)

Solana

501 merged PRs (1, 2, 3), 95 closed issues (1, 2), 103 open issues (1, 2, 3)

Subspace Labs

68 merged PRs (1), 38 closed issues (1), 12 open issues (1)

Sui

343 merged PRs (1, 2), 155 closed issues (1, 2), 140 open issues (1, 2)

TezEdge

47 merged PRs (1, 2), 0 closed issues, 1 open issues (1)

Zcash

110 merged PRs (1, 2, 3, 4), 90 closed issues (1, 2, 3, 4, 5), 34 open issues (1, 2, 3)

Rust in Bitcoin

BDK 0.19 was released with experimental Taproot support, including tr() descriptors, taproot PSBTs, signing key and script spend taproot PSBTs, and tr() in descriptor! macros. Lots of activity from the RGB team this month as they released rgb 0.7 and are working hard on finishing 0.8, which is currently available pre-release, and includes work on Tapret on-chain Deterministic Bitcoin Contracts. Once the rgb-core 0.8 release is finalized, mainnet support for RGB20 tokens should be ready. Activity around LDK is also picking up, with their recent 0.108 and 0.109 releases.

For discussion join the Rust in Bitcoin Telegram group.