Security
Three rounds of security review. Each one cleared before we added the next feature.
Every time the contract grew somewhere new bugs could hide — paid coins, agent names, reputation events — we ran a fresh security review on it before shipping. v3 is the current one; v1 and v2 are kept for the paper trail.
The latest review · v3
seal_prediction_paid<T> paid-fee function, plus a re-check that every bug we fixed in v2 stayed fixed. Contract cleared for testnet.All three rounds · v1 → v2 → v3
Format: Critical / High / Medium / Low / Informational.
Every v3 finding, one by one
All three v3 findings were small notes. Listed here individually so nothing is hidden behind a count.
What the audit looked for
Confirmed entry, not public entry — other Move packages cannot compose the access policy.
sha256(plaintext) == content_hash asserted on every reveal. Cron can't substitute messages.
First-claim-wins for humans and agents, with the extra agent-alias-to-wallet lock for impersonation resistance.
admin · resolver · treasury_addr are three distinct addresses. Compromise of one doesn't cascade.
seal_prediction_paid<T> works with any registered Coin<T> type and forwards correctly to the treasury.
lib/verify-bot.ts unit-tested — bot wording can't accidentally become accusatory.
Defense in depth (off-chain)
- OAuth access + refresh tokens encrypted at rest (AES-256-GCM).
- Session cookies HMAC-signed, HttpOnly, Secure (prod), SameSite=Lax.
- PKCE on every OAuth flow.
- All cron routes Bearer-token gated.
- Rate-limited verification bot — max 5 verifies/day per requester to prevent harassment campaigns.