code/cl8y-dex-terraclassic

Fork 0

Security: unpause command has no prerequisite root-cause or risk-acceptance checklist [SEC-G07] #440

New issue

Closed

opened 2026-06-29 16:15:02 +00:00 by totdking · 9 comments

totdking commented

2026-06-29 16:15:02 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-29 16:15:43 +00:00

(Migrated from gitlab.com)

Summary

docs/runbooks/blacklist-decision.md has a thorough 7-step "False-positive rollback" checklist that requires documented root cause (step 2: "document reversal reason") and funds-at-risk confirmation (step 3) before executing any Unblacklist* governance message. However, docs/runbooks/emergency-commands.md section 2 (Unpause a pair) presents the unpause command with no analogous prerequisite checklist. An operator can reach the unpause command without passing any gate that requires root cause identification or explicit risk acceptance. The two restore paths (unblacklist and unpause) have asymmetric prerequisite documentation.

What Was Checked

docs/runbooks/blacklist-decision.md lines 115-127: "False-positive rollback" section. 7 steps: preserve evidence, document reversal reason, confirm no funds at risk, log in incident timeline, execute Unblacklist, comms, post-incident. Root cause required at step 2. Confirmed by direct read.
docs/runbooks/emergency-commands.md lines 87-107: section 2 "Unpause a pair". Contains the governance execute command and a post-confirmation query. The global "Before you broadcast" header (lines 9-16) requires: confirm governance key, fill parameters, dry-run on staging, record tx hashes. No step requires documenting root cause, confirming the exploit is resolved, or obtaining explicit risk acceptance before restoring trading.

Expected (per checklist)

Both restore paths (unpause and unblacklist) must require root cause documentation or explicit risk acceptance before the restore governance tx is broadcast. The runbook for unpause must include a prerequisite checklist equivalent to the blacklist rollback checklist: document why trading was paused, confirm the condition is resolved, confirm no funds are at risk, log the decision.

Actual

Unblacklist: covered. A 7-step rollback checklist in blacklist-decision.md requires root cause and funds-at-risk confirmation.

Unpause: not covered. emergency-commands.md section 2 presents the unpause command with no prerequisite requiring root cause or risk acceptance. An operator can unpause without documented confirmation that the incident condition is resolved.

Evidence

docs/runbooks/blacklist-decision.md lines 115-127: unblacklist has 7-step rollback checklist with root cause required at step 2
docs/runbooks/emergency-commands.md lines 87-107: unpause command with no prerequisite checklist beyond governance key confirmation and dry-run

Suggested Fix

Add a Before you unpause checklist to section 2 of docs/runbooks/emergency-commands.md, mirroring the structure of the blacklist rollback checklist: (1) document why the pair was paused (incident reference or issue link); (2) confirm the triggering condition is resolved (attach evidence: tx traces, contract state reads); (3) confirm no funds are at risk if trading resumes; (4) log the unpause decision in the incident timeline with approver and UTC timestamp; (5) then execute the governance unpause command. Link the blacklist rollback checklist for cross-reference so both restore paths are symmetrically gated.

Verification Checklist

emergency-commands.md section 2 includes a prerequisite checklist requiring: documented incident reference, resolution confirmation, funds-at-risk check, incident timeline entry, and approver
Unpause prerequisite checklist mirrors the structure of the blacklist rollback checklist in blacklist-decision.md

Labels

security, pre-launch

Cc: @PlasticDigits

### Summary `docs/runbooks/blacklist-decision.md` has a thorough 7-step "False-positive rollback" checklist that requires documented root cause (step 2: "document reversal reason") and funds-at-risk confirmation (step 3) before executing any `Unblacklist*` governance message. However, `docs/runbooks/emergency-commands.md` section 2 (Unpause a pair) presents the unpause command with no analogous prerequisite checklist. An operator can reach the unpause command without passing any gate that requires root cause identification or explicit risk acceptance. The two restore paths (unblacklist and unpause) have asymmetric prerequisite documentation. --- ### What Was Checked - `docs/runbooks/blacklist-decision.md` lines 115-127: "False-positive rollback" section. 7 steps: preserve evidence, document reversal reason, confirm no funds at risk, log in incident timeline, execute Unblacklist, comms, post-incident. Root cause required at step 2. Confirmed by direct read. - `docs/runbooks/emergency-commands.md` lines 87-107: section 2 "Unpause a pair". Contains the governance execute command and a post-confirmation query. The global "Before you broadcast" header (lines 9-16) requires: confirm governance key, fill parameters, dry-run on staging, record tx hashes. No step requires documenting root cause, confirming the exploit is resolved, or obtaining explicit risk acceptance before restoring trading. --- ### Expected (per checklist) Both restore paths (unpause and unblacklist) must require root cause documentation or explicit risk acceptance before the restore governance tx is broadcast. The runbook for unpause must include a prerequisite checklist equivalent to the blacklist rollback checklist: document why trading was paused, confirm the condition is resolved, confirm no funds are at risk, log the decision. --- ### Actual Unblacklist: covered. A 7-step rollback checklist in `blacklist-decision.md` requires root cause and funds-at-risk confirmation. Unpause: not covered. `emergency-commands.md` section 2 presents the unpause command with no prerequisite requiring root cause or risk acceptance. An operator can unpause without documented confirmation that the incident condition is resolved. --- ### Evidence - `docs/runbooks/blacklist-decision.md` lines 115-127: unblacklist has 7-step rollback checklist with root cause required at step 2 - `docs/runbooks/emergency-commands.md` lines 87-107: unpause command with no prerequisite checklist beyond governance key confirmation and dry-run --- ### Suggested Fix Add a **Before you unpause** checklist to section 2 of `docs/runbooks/emergency-commands.md`, mirroring the structure of the blacklist rollback checklist: (1) document why the pair was paused (incident reference or issue link); (2) confirm the triggering condition is resolved (attach evidence: tx traces, contract state reads); (3) confirm no funds are at risk if trading resumes; (4) log the unpause decision in the incident timeline with approver and UTC timestamp; (5) then execute the governance unpause command. Link the blacklist rollback checklist for cross-reference so both restore paths are symmetrically gated. --- ### Verification Checklist - [ ] `emergency-commands.md` section 2 includes a prerequisite checklist requiring: documented incident reference, resolution confirmation, funds-at-risk check, incident timeline entry, and approver - [ ] Unpause prerequisite checklist mirrors the structure of the blacklist rollback checklist in `blacklist-decision.md` --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-29 16:15:51 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-30 02:22:17 +00:00

(Migrated from gitlab.com)

mentioned in commit dc26e35f45

mentioned in commit dc26e35f4516591e8e5a17b34217f5e0a12cd670

PlasticDigits commented

2026-06-30 02:22:33 +00:00

(Migrated from gitlab.com)

mentioned in merge request !967

Brouie commented

2026-06-30 02:59:10 +00:00

(Migrated from gitlab.com)

Verified #440 (fix/440-unpause-prerequisite-checklist).

check_emergency_commands_docs.py -> OK (SEC-G07 markers)
verify-issue-440.sh -> PASS 7 / FAIL 0

emergency-commands.md section 2 now opens with a "Before you unpause (mandatory)" 8-step gate: preserve evidence, document rationale with incident link, confirm triggering condition resolved, confirm no funds at risk, log timeline with approver + UTC, execute governance set_pair_paused:false, comms, post-incident. That hits every required item (incident ref, resolution, funds-at-risk, timeline entry, approver) and mirrors the blacklist false-positive rollback checklist, with bidirectional cross-links between the two restore paths.

Docs/runbook-only, no code. Verified on my side — @PlasticDigits good to merge !967 + close.

Verified #440 (fix/440-unpause-prerequisite-checklist). - check_emergency_commands_docs.py -> OK (SEC-G07 markers) - verify-issue-440.sh -> PASS 7 / FAIL 0 emergency-commands.md section 2 now opens with a "Before you unpause (mandatory)" 8-step gate: preserve evidence, document rationale with incident link, confirm triggering condition resolved, confirm no funds at risk, log timeline with approver + UTC, execute governance set_pair_paused:false, comms, post-incident. That hits every required item (incident ref, resolution, funds-at-risk, timeline entry, approver) and mirrors the blacklist false-positive rollback checklist, with bidirectional cross-links between the two restore paths. Docs/runbook-only, no code. Verified on my side — @PlasticDigits good to merge !967 + close.

PlasticDigits commented

2026-06-30 03:53:33 +00:00

(Migrated from gitlab.com)

mentioned in commit 9fcb468bc9

mentioned in commit 9fcb468bc9e3684fec66e44bfb00f252f92d7e3a

PlasticDigits commented

2026-06-30 03:55:11 +00:00

(Migrated from gitlab.com)

mentioned in commit 114d10b79d

mentioned in commit 114d10b79dbf0c285b8f4fd13565dfcf492bc456

PlasticDigits commented

2026-06-30 05:08:33 +00:00

(Migrated from gitlab.com)

mentioned in merge request !968

PlasticDigits commented

2026-06-30 06:50:08 +00:00

(Migrated from gitlab.com)

Verification — #440 (SEC-G07 unpause prerequisite checklist)

Verified on main after merge of !967. No repo changes required from this verification pass.

Acceptance criteria

Item	Result	How verified
`emergency-commands.md` § 2 includes prerequisite checklist (incident reference, resolution confirmation, funds-at-risk, timeline entry, approver)	PASS	Manual read of `docs/runbooks/emergency-commands.md` lines 160–173: Before you unpause (mandatory) 8-step gate precedes the `set_pair_paused` execute block; steps 2–5 cover rationale/incident link, resolution evidence, funds-at-risk, and timeline entry with approver + UTC.
Unpause checklist mirrors blacklist rollback structure in `blacklist-decision.md`	PASS	Side-by-side review: unpause steps align with rollback (preserve evidence → document rationale → confirm condition/funds → log timeline → execute → comms → post-incident); unpause adds explicit “triggering condition resolved” step. Bidirectional cross-links present (`blacklist-decision.md#false-positive-rollback-unblacklist` ↔ `emergency-commands.md#2-unpause-a-pair`).

Automated checks

make check-emergency-commands-docs  → OK (SEC-G07 markers)
make verify-issue-440               → PASS 7 / FAIL 0

Steps exercised: doc invariant, prerequisite heading, incident/approver markers, resolution + funds-at-risk markers, symmetric cross-links, skills/AGENTS_EMERGENCY_COMMANDS.md SEC-G07 gate, docs/security-model.md SEC-G07 link.

Manual review

Confirmed Before you unpause (mandatory) appears before the governance terrad tx wasm execute command in § 2.
Confirmed blacklist-decision.md False-positive rollback section cross-links to unpause § 2.
Confirmed both restore paths gate on documented rationale, resolution evidence, funds-at-risk confirmation, and incident timeline entry with approver.

Closing as verified.

## Verification — #440 (SEC-G07 unpause prerequisite checklist) Verified on `main` after merge of !967. No repo changes required from this verification pass. ### Acceptance criteria | Item | Result | How verified | |------|--------|--------------| | `emergency-commands.md` § 2 includes prerequisite checklist (incident reference, resolution confirmation, funds-at-risk, timeline entry, approver) | **PASS** | Manual read of `docs/runbooks/emergency-commands.md` lines 160–173: **Before you unpause (mandatory)** 8-step gate precedes the `set_pair_paused` execute block; steps 2–5 cover rationale/incident link, resolution evidence, funds-at-risk, and timeline entry with approver + UTC. | | Unpause checklist mirrors blacklist rollback structure in `blacklist-decision.md` | **PASS** | Side-by-side review: unpause steps align with rollback (preserve evidence → document rationale → confirm condition/funds → log timeline → execute → comms → post-incident); unpause adds explicit “triggering condition resolved” step. Bidirectional cross-links present (`blacklist-decision.md#false-positive-rollback-unblacklist` ↔ `emergency-commands.md#2-unpause-a-pair`). | ### Automated checks ``` make check-emergency-commands-docs → OK (SEC-G07 markers) make verify-issue-440 → PASS 7 / FAIL 0 ``` Steps exercised: doc invariant, prerequisite heading, incident/approver markers, resolution + funds-at-risk markers, symmetric cross-links, `skills/AGENTS_EMERGENCY_COMMANDS.md` SEC-G07 gate, `docs/security-model.md` SEC-G07 link. ### Manual review 1. Confirmed **Before you unpause (mandatory)** appears **before** the governance `terrad tx wasm execute` command in § 2. 2. Confirmed `blacklist-decision.md` False-positive rollback section cross-links to unpause § 2. 3. Confirmed both restore paths gate on documented rationale, resolution evidence, funds-at-risk confirmation, and incident timeline entry with approver. Closing as verified.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-30 06:50:09 +00:00