Parfin Threat model

Parfin product allows asset managers, fund institutions and any financial entity to manage their digital assets trough parfin products: plug n play and terminal. Throughout a web interface clients can trade and manage their digital assets by connecting their exchanges (e.g: Binance, Coinbase), banks accounts (e.g: BTG, Genial), or OTC desks (Genesis, FTX, B2C2)

Roles

During the lifetime of Parfin products we identify the following roles that can communicate with Parfin infrastructure starting from entities with less information available towards more powerful users.

  1. External entity (A): An external entity with no access to Parfin network perimeter.
  2. Parfin user (B): A Parfin employee with access to Parfin network.
  3. Parfin client ( C ): A client who is authorized to access Parfin.
  4. Parfin admin (D): A Parfin user setting up accounts for clients.

What user an SER dev is considered with the predefined roles when it instatiates tsm's? admin for a small slot and then it is downgraded to C?

Risks

The ultimate risk is summarized as follows: Unauthorized access to clients assets

Procedures

For the following precedures I need to clarify the following questions:

  • How is it happening exactly in logical steps in the backend?
  • What type of information access each role has?
  • What assumptions are made?
  • What needs to be protected? What is considered critical information?
  1. Client authorization in the platform and account creation
  2. Integration of client accounts to Parfin products
  3. Digital asset transaction
  4. TSM deployment: a) on Parfin, b) Parfin + client, c) only on client premise with existing SEPIOR product.

Cryptography Compliance

Sources:

  • src/Parfin.HMAC.Service/HmacService.cs
  • api/services/keyShareService.go
  • src/APIGatewayAuthorizerHandler/Function.cs
Select a repo