Project Name: CardanoPress: Security Audits, Improvements & Optimisations
IdeaScale URL: https://cardano.ideascale.com/c/cardano/idea/111932
Project Number: 1100081
Project Manager: Peter Bui
Date project started: 14th March 2024
Date project completed: 11th October 2024
List of challenge KPIs and how the project addressed them
Open Source Contributions: The CardanoPress project is open-source, and we continued with the audit, keeping it all open-sourced. Anyone using the plugin will gain those benefits and be able to check the source code to ensure that we did indeed secure the plugin as recommended by PatchStack.
Increasing Developer Engagement: Delivering the audited project reassures developers that the tools they are working with to build the website are as secure as possible. Confidence in Cardano’s security is what makes it a blockchain of choice. We wanted that same reassurance with our plugin for all developers, which we believe we achieved by delivering an audited plugin.
List of project KPIs and how the project addressed them
Secure Base Platform: The main challenge of the project was to provide a secure base for all websites that use CardanoPress. The last thing the team wanted was for CardanoPress to be an attack vector, allowing hackers into a website and manipulating code during NFT mints, stake pool delegation and so on.
The audit provided the team with new techniques and recommendations for strengthening and securing our base against hackers and malicious activity.
The audit by PatchStack highlighted various issues within the plugin, which have all been implemented.
Propagation of Secure Plugin: The second challenge was to get users to install the later version so that the plugin remained as secure as possible. The audit started at version 1.8.x; anything version 1.20 or higher incorporated the new security features. Thankfully, with good communication via Discord and X, we managed to get over 80% of our user base to upgrade to version 1.20 or higher.
Key achievements
Message Signing for Authentication: One key achievement from the audit was implementing Message Signing for authentication on any CardanoPress-powered website. Cardano Improvement Proposal 8 (CIP-8) details message or data signing.
Previously, anyone accessing the wallet could connect to the website and start interacting with it. With the implementation of Message Signing, a user must enter their signing password before using the website. This helps retain the user’s anonymity but increases security dramatically.
Security Through Obscurity: Other achievements include implementing various changes to the logs and code base, which make it much harder for hackers to probe the plugin and look for vulnerabilities in the plugin and the website itself.
Key learnings
Budgeting for Third Party Services: One of the project’s difficulties and the lessons learned resulted from budgeting.
When engaging with an auditing firm such as PatchStack, upfront payment for the project is required. This is a substantial upfront cost for us, which has set back the company’s cash flow. It has also affected the company’s ability to attend key Cardano-related events worldwide, participate in, or provide other community-led Meetups, such as a locally hosted Cardano Summit.
Budgeting Through Volatility: Being paid for Project Catalyst in volatile assets, ADA, while needing to pay for the services required in USD, also diminished funds. Fortunately for us, the ADA price remained fairly flat from the original scoping of the project in September 2023 to the completion of the project in October 2024. If the price were to drop much further, it would have completely crippled the business. We recall comments on our proposal stating that we shouldn’t have budgeted so much ADA as the price would go up due to the bull market that was coming, which never came.
For anyone who needs to engage with a third-party service provider, we recommend gearing the project to hit various milestones to help buffer up the cash required to pay them upfront. We also recommend assuming that the price of ADA will drop in all your budgeting, especially when costs are involved, and payments are needed in fiat currencies.
Next steps for CardanoPress
The next stage for CardanoPress is documentation. It is the number one thing stopping people from building on the product. Not knowing how to use it or getting stuck trying to implement it causes frustration. More documentation will help guide users through all the steps and increase tool adoption.
Final thoughts
We’re ever so thankful to Project Catalyst and the Cardano community for supporting our work and the tooling we build for other projects and builders. We hope to double the number of installs by the end of 2025 and finally become a sustainable business, not relying on Project Catalyst to fund our operations and new features.
Links to other relevant project sources
Anyone interested in downloading CardanoPress and trying out the latest secured release should do so via the WordPress Plugin directory listing for CardanoPress or search for “CardanoPress” in the plugin installer on your WordPress-powered website.
Please visit our online forum for additional support and the CardanoPress GitHub repo for the latest development versions, to report issues, or to contribute to the project itself.