Security audit: 19 findings in grevm parallel EVM (GREVM-001 through GREVM-019)

[Richard1048576]

Summary

Internal security audit of the grevm parallel EVM engine (~3000 LOC) identified 19 findings.
The dominant issue is systematic use of unsafe aliasing (&T → &mut T casting) as a substitute
for proper interior mutability — this appears 7 times across the codebase and is the root cause
of the three CRITICAL findings.

• 3 CRITICAL — Undefined Behavior via invalid_reference_casting (7 instances across 5 files),
  data race on ContinuousDetectSet::index_flag, unsound concurrent mutation of ParallelState
  via async commit thread
• 3 HIGH — TOCTOU race in async_finality (status check-and-set not atomic), potential
  deadlock in TxDependency::add() (inconsistent lock ordering), next_validation_idx()
  double-increment race (non-atomic check-then-increment)
• 5 MEDIUM — panic!/assert!/unwrap() in production commit/scheduler paths,
  environment variable parsing crashes, get_contract_type() hardcoded to ERC20,
  println!() debug output in production, fork_join_util unsound parallel mutation
• 5 LOW + 3 INFO — Missing bounds checks, TODO comments, memory ordering, redundancy, cosmetics

Documentation

• docs/security/2026-02-26-security-audit-report.md — Full audit report with all 19 findings
• docs/security-fix-checklist.md — Tracking checklist for fixes

Root Cause Pattern

All three CRITICAL findings stem from #[allow(invalid_reference_casting)] — the pattern of casting
&T to &mut T via raw pointer. This is instant UB under Rust's aliasing model. Files affected:
src/scheduler.rs, src/async_commit.rs, src/utils.rs, src/hint.rs, src/storage.rs.

Recommended approach: replace with UnsafeCell-based abstractions (AtomicBool, Mutex, RwLock,
or custom Sync wrappers with documented safety invariants).

Test plan

• Review findings and prioritize fixes
• Run cargo +nightly miri test to verify UB fixes
• Run RUSTFLAGS="-Z sanitizer=thread" cargo +nightly test for data race detection
• Run cargo bench to verify no performance regression after fixes
• Stress test with GREVM_CONCURRENT_LEVEL=32

🤖 Generated with Claude Code