Security and Scalability Analysis of Moonbeam

Web3 experts often describe smart contracts as the Achilles heel of Blockchain technology. While there is truth to this popular narrative, platforms like Moonbeam are challenging the status quo to make a tangible difference. 

A company that can be described as a smart contract platform for cross-chain applications that combines the functionality of Polkadot, Ethereum, and more, Moonbeam allows developers to deploy their own dApps, which are compatible with Ethereum.

That said, ever since its inception in 2019, Moonbeam has diversified itself into offering other services. Let us briefly have an overview of Moonbeam before discussing the security and scalability of the platform. 

An Overview of Moonbeam,

The two primary offerings on the platform are “Moonbeam” and “Moonriver.” Let us take a deeper look. 

Moonbeam: is a platform available to create Solidity smart contracts on Polkadot. It simplifies the experience for developers by combining the power of Polkadot and full Ethereum compatibility. This includes scalability, onchain governance, and cross chain integrations as well. 

The platform offers simplified deployments of smart contracts using Solidity, a broad spectrum of compatible tools (Hardhar, Truffle, Metamask, and more), and pre-built integrations. 

Moonriver: on the other hand, is a platform to create Solidity smart contracts on Kusama. Although in its early experimental stage, Moonriver is a promising, community-led parachain that works in conjunction with Moonbeam. Moonriver receives the code first, tests it, and verifies it under natural economic conditions before sending it to Moonbeam on Polkadot. That said, the network will live on as a parachain on Kusama. 

Moonbeam Glimmer (GLMR):  Launched in January 2022, GLMR is a utility token of Moonbeam primarily deployed on the Polkadot network. 

Security Attributes

Moonbeam offers numerous “precompiled contracts” with a Solidity interface for developers to access Substrate functionality via Ethereum API but bypassing the EVM. Although the said precompiled contracts are designed to make developers' lives easier, they come with inherent/unintended vulnerabilities that must be addressed. 

Arbitrary Code Execution

In Solidity, arbitrary code execution is the ability to run code and call contracts using arbitrary numbers of any kind of argument. A smart contract allows the arbitrary execution of other contracts by allowing a developer to influence its own call() and/or the call()  target and pass arbitrary call data. The other contract is called when the call() function is invoked using the present arbitrary call information. 

That said, the primary concern with this is, Moonbeam has precompiled contracts that can be called, and this can be used to bypass some protection layers present on Ethereum. 

Hence, arbitrary code execution is a concern that must be addressed. 

Possible solutions:

1. Setting the value of the transaction to a fixed amount while using call() can be bypassed by calling the native asset precompiler and specifying the amount to be transferred in the encoded call data. 

2. Developers can hardcode the function selector, making it safe to execute. 

3. As there are chances of newer precompiles that may be added in the future, blacklisting the target contracts and precompiles that carry forward the arbitrary call data that aren’t considered safe can also work. 

Precompile Overrides

On Moonbeam, you can transfer native assets from a smart contract by establishing the value of a call and via the ERC20 precompile. The value of an arbitrary call can be overridden by targeting the native ERC20 and allowing the call data to send the native asset. 

Setting value attributes does not protect assets like ERC20 and XC20 on Moonbeam or Ethereum, as they are not native assets. 

You can utilize the ABI encoding functionality specified in the Solidity documentation to procure the encoded call data. 

Maintenance Mode

The Maintenance mode is an important tool that is part of the Moonbeam runtimes and is only used in rare cases of emergency. This mode pauses all transaction processing and EVM execution while allowing block production and Governance/Staking operations to continue. The Technical Committee, appointed by the Moonbeam Foundation and early active members of the development community, is responsible for initiating maintenance mode.

The mode was designed so the network could be upgraded without waiting an hour. When upgrading the network, there is a one-hour delay between the time the update is announced and the time it takes effect. During this time, the network remains vulnerable to attacks. The network is maintained to prevent attackers from exploiting the vulnerability before the network can be updated.

These were a few security vulnerabilities developers may come across while using Moonbeam and its precompiled smart contracts, but the platform is quick and steadfast at releasing updates to fix threats. The maintenance mode is crucial to avert and rectify security vulnerabilities as well. 

Now, let us avail an overview of scalability on Moonbeam. 

Scalability

When you try to dive deep into analyzing the scalability attributes of Moonbeam, it becomes apparent why more dApp developers must consider Moonbeam. Some of the reasons are:

Moonbeam enables interoperability.

As Moonbeam is created as a parachain on Polkadot, it enjoys the benefits of Polkadot’s inherent capabilities, like flawless interaction with multiple blockchains. Interoperability is the bane of blockchain, and Moonbeam makes your deployments like dApps and smart contracts future ready. 

To achieve interoperability, Moonbeam first connects with all the parachains natively on Polkadot and establishes seamless communication, which immediately exposes your dApp to a wide variety of use cases. 

Secondly, Moonbeam helps your dApp establish cross-chain communication by bridging the connection between numerous blockchains like Polygon, Cosmos, and others. 

Moonbeam helps to migrate seamlessly

As Moonbeam has full EVM implementation, it makes for an ideal platform to scale Ethereum dApps. As a consequence, migrating Solidity smart contracts from Ethereum becomes seamless, and this is with respect to the backend. 

With regards to the front end, Moonbeam’s implementation of the RPC API and your dApp migrations comes with complete front-end compatibility. This means that your dApp looks the same to the end user on Moonbeam. 

Some tools Moonbeam gives you access to for migrating are Truffle, Hardhat, Remix, Web3.js, Ether.js, and Web3.py. 

Moonbeam is fully decentralized and permissionless.

Unlike many other smart contracts, dApp developers, and other companies, Moonbeam takes decentralization and permissionless very seriously. 

It places the decentralization ideals at its core and builds them into its ecosystem, which provides the freedom for developers to imagine possibilities that are yet to the fathomed. 

Making the platform's foundation decentralized also means that hackers and premeditated attacks cannot take down your dApp. 

Wrapping Up

It is evident that Moonbeam is steadfast at providing fixes to vulnerabilities instantaneously, has all corners covered for its precompiled contracts to run smoothly, and upholds the ideals of decentralization at the same time. 

Hence, it becomes an easy decision for other brands like Zeeve to provide support to launch Moonbeam blockchain nodes. At Zeeve, you can do so in minutes as we provide secure endpoints, a developer-friendly interface, enterprise-grade uptime, and many other functions for developers.

So, what are you waiting for? Book a free developer consultation today, and make the most of Zeeve’s products & services.