Security
Protocol security guarantees - atomicity, authentication, and reliability
For a plain-language overview of custody, the Orbit multisig and its admin powers, prices, liquidations, audits, and risks, see Security, governance & risk. To check or manage a position without the website, see Use Liquidium without the app.
Security Principles
Liquidium implements multiple layers of security:
1. Cryptographic Security
- Native-chain signature verification (BIP-322 or legacy message signing for Bitcoin, EIP-191 for Ethereum)
- Nonce-based replay protection
- Threshold ECDSA for the BTC Pool's Bitcoin transactions and for Ethereum deposit addresses
2. State Consistency
- Two-phase execution model
- Write-ahead logging for async operations
- Idempotent handlers prevent double-execution
3. Economic Security
- Overcollateralization requirements
- Liquidation incentives maintain solvency
- Supply/borrow caps limit exposure
4. Access Control
- Caller validation for inter-canister calls
- Admin-only configuration methods requiring authorized principals
- Profile ownership verification
Trust Boundaries
Boundary Protections
Boundary | Attack Vector | Mitigation |
|---|---|---|
User → Lending | Signature forgery | Native-chain signature verification |
User → Lending | Replay attacks | Nonce-based protection |
User → Lending | Unauthorized access | Profile ownership validation |
Lending → Pool | Unauthorized withdrawals | Caller validation |
Lending → Pool | Double execution | WAL idempotency |
Pool → ckMinter | Invalid burn amounts | Pre-flight validation |
Oracle → Lending | Price manipulation | Exchange Rate Canister prices; stale prices (over 120s) block risky actions |
Liquidator → Lending | Griefing attacks | Close factor limits |
Key Security Properties
Atomicity
All critical state changes happen atomically in a single execution:
- No partial state updates
- Rollback on validation failure
- State committed before async work
Durability
Pending operations survive canister upgrades:
- Write-ahead log in stable storage
- Automatic retry on failure
- No data loss on crashes
Idempotency
Operations can be safely retried:
- Unique operation IDs
- Processed ID tracking
- Ledger-level deduplication
Authorization
Every operation is properly authorized:
- Signature verification for user requests
- Caller validation for inter-canister calls
- Admin checks for configuration changes