code/cl8y-dex-terraclassic

Fork 0

Pre-launch: no evidence of emergency controls rehearsed from actual governance multisig [SEC-B09] #397

New issue

Closed

opened 2026-06-19 10:40:09 +00:00 by totdking · 13 comments

totdking commented

2026-06-19 10:40:09 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-19 10:40:58 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-B09: Verify emergency controls are executable from the actual planned governance wallet/multisig, not just local test keys. Verify: testnet/local dry run using same signing flow or documented manual rehearsal.

Summary

The launch checklist Phase 5 PAUSE gate requires that governance emergency controls have been rehearsed from the actual planned multisig or governance wallet, not only from local test keys. No rehearsal transcript, testnet evidence, or manual rehearsal note exists in the repo or linked from any issue or MR.

What Was Checked

docs/runbooks/launch-checklist.md Phase 5 -- PAUSE criteria at line 98 references multisig rehearsal as a required gate but provides no linked evidence
docs/security-model.md line 17 -- states governance should be a multisig or DAO, not a single EOA
docs/templates/incident-dex-indexer.md -- internal triage template, no command execution evidence
All docs/ files -- no testnet or LocalTerra rehearsal log referencing a multisig address
smartcontracts/tests/src/ -- all contract tests use App::default() and local test keys, not a multisig signing flow

Expected (per checklist)

A dry run or manual rehearsal using the same signing flow as production (multisig threshold signing, hardware wallet, or DAO proposal) must be documented and linked from the launch issue or a pinned comment. The rehearsal must cover at minimum one pause, one blacklist, one unpause, and one unblacklist operation.

Actual

All automated tests use local test keys via cw-multi-test. No evidence exists that the actual planned governance wallet or multisig has been used to sign any emergency control transaction on any network. The launch runbook flags this as a PAUSE gate but no evidence has been attached.

Evidence

docs/runbooks/launch-checklist.md Phase 5 line 98: "Production governance multisig has not rehearsed the deploy/admin txs (pause, fee update, hook registration) on staging" -- listed as a PAUSE trigger, no linked evidence
docs/security-model.md line 17: "the governance address should be a multisig or DAO-controlled address in production"
smartcontracts/tests/src/blacklist_tests.rs: all blacklist tests use App::default() and local test wallets

Suggested Fix

Before production deploy, run the following from the actual planned governance multisig on a staging network or LocalTerra configured with the multisig address:

Pause one pair and confirm the transaction is accepted with the required threshold
Blacklist one wallet and confirm rejection of subsequent user operations
Unpause the pair and confirm trading resumes
Unblacklist the wallet and confirm access is restored

Attach the signed transaction hashes and a brief note to this issue or the launch tracking issue as evidence, then mark the Phase 5 PAUSE gate as satisfied.

Verification Checklist

Rehearsal executed using the actual planned governance multisig signing flow
Rehearsal covers pause, blacklist, unpause, and unblacklist operations
Signed transaction hashes or rehearsal transcript linked from this issue or the launch issue
Rehearsal conducted on staging or LocalTerra (not mainnet)
Phase 5 PAUSE gate in docs/runbooks/launch-checklist.md updated to reference the evidence

Cc: @PlasticDigits

### Checklist Item SEC-B09: Verify emergency controls are executable from the actual planned governance wallet/multisig, not just local test keys. Verify: testnet/local dry run using same signing flow or documented manual rehearsal. --- ### Summary The launch checklist Phase 5 PAUSE gate requires that governance emergency controls have been rehearsed from the actual planned multisig or governance wallet, not only from local test keys. No rehearsal transcript, testnet evidence, or manual rehearsal note exists in the repo or linked from any issue or MR. --- ### What Was Checked - `docs/runbooks/launch-checklist.md` Phase 5 -- PAUSE criteria at line 98 references multisig rehearsal as a required gate but provides no linked evidence - `docs/security-model.md` line 17 -- states governance should be a multisig or DAO, not a single EOA - `docs/templates/incident-dex-indexer.md` -- internal triage template, no command execution evidence - All `docs/` files -- no testnet or LocalTerra rehearsal log referencing a multisig address - `smartcontracts/tests/src/` -- all contract tests use `App::default()` and local test keys, not a multisig signing flow --- ### Expected (per checklist) A dry run or manual rehearsal using the same signing flow as production (multisig threshold signing, hardware wallet, or DAO proposal) must be documented and linked from the launch issue or a pinned comment. The rehearsal must cover at minimum one pause, one blacklist, one unpause, and one unblacklist operation. --- ### Actual All automated tests use local test keys via `cw-multi-test`. No evidence exists that the actual planned governance wallet or multisig has been used to sign any emergency control transaction on any network. The launch runbook flags this as a PAUSE gate but no evidence has been attached. --- ### Evidence - `docs/runbooks/launch-checklist.md` Phase 5 line 98: "Production governance multisig has not rehearsed the deploy/admin txs (pause, fee update, hook registration) on staging" -- listed as a PAUSE trigger, no linked evidence - `docs/security-model.md` line 17: "the governance address should be a multisig or DAO-controlled address in production" - `smartcontracts/tests/src/blacklist_tests.rs`: all blacklist tests use `App::default()` and local test wallets --- ### Suggested Fix Before production deploy, run the following from the actual planned governance multisig on a staging network or LocalTerra configured with the multisig address: - Pause one pair and confirm the transaction is accepted with the required threshold - Blacklist one wallet and confirm rejection of subsequent user operations - Unpause the pair and confirm trading resumes - Unblacklist the wallet and confirm access is restored Attach the signed transaction hashes and a brief note to this issue or the launch tracking issue as evidence, then mark the Phase 5 PAUSE gate as satisfied. --- ### Verification Checklist - [ ] Rehearsal executed using the actual planned governance multisig signing flow - [ ] Rehearsal covers pause, blacklist, unpause, and unblacklist operations - [ ] Signed transaction hashes or rehearsal transcript linked from this issue or the launch issue - [ ] Rehearsal conducted on staging or LocalTerra (not mainnet) - [ ] Phase 5 PAUSE gate in `docs/runbooks/launch-checklist.md` updated to reference the evidence Cc: @PlasticDigits

totdking commented

2026-06-19 10:57:16 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 11:09:22 +00:00

(Migrated from gitlab.com)

mentioned in commit 3493333f25

mentioned in commit 3493333f254e4899a541233494478a36ffa54261

PlasticDigits commented

2026-06-19 11:09:59 +00:00

(Migrated from gitlab.com)

mentioned in merge request !927

PlasticDigits commented

2026-06-19 13:46:27 +00:00

(Migrated from gitlab.com)

mentioned in commit 0c87b934f4

mentioned in commit 0c87b934f48eb5bb6cd0b7e4a7675c11c38e446e

PlasticDigits commented

2026-06-19 13:49:46 +00:00

(Migrated from gitlab.com)

mentioned in commit 392c0986f5

mentioned in commit 392c0986f5775f0b7e3de3ea5a409c9334e72878

PlasticDigits commented

2026-06-19 13:49:49 +00:00

(Migrated from gitlab.com)

mentioned in merge request !928

PlasticDigits commented

2026-06-25 11:50:34 +00:00

(Migrated from gitlab.com)

Verification — SEC-B09 (#397)

Verified on 2026-06-25 (Cloud Agent VM, main @ current HEAD).

Acceptance checklist

Criterion	Result	How verified
Rehearsal using multisig threshold signing flow	PASS (LocalTerra)	`make verify-issue-397` → `./scripts/rehearse-governance-emergency-controls.sh` — 2-of-3 `terrad tx sign` + `multisign` + `broadcast`
Covers pause, blacklist, unpause, unblacklist	PASS	Transcript at `/tmp/sec-b09-verify-397.md`; on-chain LCD checks toggled `is_paused` and `wallet_blacklisted`
Signed tx hashes linked	PASS (this comment)	See table below
Conducted on staging or LocalTerra (not mainnet)	PASS	`network=localterra`
Phase 5 PAUSE gate references evidence workflow	PASS	`docs/runbooks/launch-checklist.md` line 130 links `governance-emergency-rehearsal.md`, SEC-B09, `make verify-issue-397`
Production planned governance multisig on testnet/staging	FAIL	Requires human operators with production keys — documented PAUSE gate in runbook; LocalTerra rehearsal does not substitute (per `docs/runbooks/governance-emergency-rehearsal.md`)

Automated verification

make check-governance-emergency-rehearsal-docs  → OK
make verify-issue-397                         → PASS: 5  FAIL: 0  SKIP: 0

Doc invariants: runbook, evidence template, agent skill (skills/AGENTS_GOVERNANCE_EMERGENCY_REHEARSAL.md), security-model.md / launch-checklist.md cross-links, Makefile targets.

LocalTerra multisig rehearsal evidence (2026-06-25T11:49:25Z)

Field	Value
Factory	`terra1hrpna9v7vs3stzyd4z3xf00676kf78zpe2u5ksvljswn2vnjp3ysc6mpf5`
Governance multisig	`terra18fmftmt6r36tca30ayc3hywp70gl0yyejk37ej` (2-of-3 rehearsal keys)
Pair	`terra16jd56eylzgwr2jyx97wymajp7u5h9rdn9jqh0nkfm6jswec66qkq3tdy0g`

Step	Tx hash
UpdateConfig → multisig	`29D77A5A3F300BAC48DCFD6B3C9744F1B290AE72189DE652A0F337E607CAB1D5`
SetPairPaused `true`	`A0CD4F4110FCA0FF1B09FCEF79F33B6633EC456CF2BC824012CF8E6D199790DF`
BlacklistWallet	`ADF973512965FA38704D8F2FDA12CCE84C73AEA0362F9F1A536F5AC0974D31B1`
SetPairPaused `false`	`0B1B320F3F047A5EEF46E7D81D7F1A502C090241EF0F6334A0497DC013FC05D0`
UnblacklistWallet	`50AE562E9DF1EF05D549CAFCB1407B25659B18CC306CC7031FC9790983CEF941`

Repo deliverables (original gap — resolved)

docs/runbooks/governance-emergency-rehearsal.md — operator runbook + signing flow
docs/templates/governance-emergency-rehearsal-evidence.md — evidence template
scripts/rehearse-governance-emergency-controls.sh — automated LocalTerra dry-run
scripts/qa/verify-issue-397.sh — verification harness

Follow-up (pre-mainnet, operator-owned)

Before Phase 5 GO, operators must repeat the four emergency operations from the planned production governance multisig on testnet/staging, post the filled evidence template on launch issue #391, and link it in go/no-go sign-off. Until then, SEC-B09 remains a PAUSE criterion per the launch checklist.

## Verification — SEC-B09 ([#397](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/397)) Verified on **2026-06-25** (Cloud Agent VM, `main` @ current HEAD). ### Acceptance checklist | Criterion | Result | How verified | |-----------|--------|--------------| | Rehearsal using multisig threshold signing flow | **PASS** (LocalTerra) | `make verify-issue-397` → `./scripts/rehearse-governance-emergency-controls.sh` — 2-of-3 `terrad tx sign` + `multisign` + `broadcast` | | Covers pause, blacklist, unpause, unblacklist | **PASS** | Transcript at `/tmp/sec-b09-verify-397.md`; on-chain LCD checks toggled `is_paused` and `wallet_blacklisted` | | Signed tx hashes linked | **PASS** (this comment) | See table below | | Conducted on staging or LocalTerra (not mainnet) | **PASS** | `network=localterra` | | Phase 5 PAUSE gate references evidence workflow | **PASS** | `docs/runbooks/launch-checklist.md` line 130 links `governance-emergency-rehearsal.md`, SEC-B09, `make verify-issue-397` | | **Production** planned governance multisig on testnet/staging | **FAIL** | Requires human operators with production keys — documented PAUSE gate in runbook; LocalTerra rehearsal does **not** substitute (per `docs/runbooks/governance-emergency-rehearsal.md`) | ### Automated verification ``` make check-governance-emergency-rehearsal-docs → OK make verify-issue-397 → PASS: 5 FAIL: 0 SKIP: 0 ``` Doc invariants: runbook, evidence template, agent skill (`skills/AGENTS_GOVERNANCE_EMERGENCY_REHEARSAL.md`), `security-model.md` / `launch-checklist.md` cross-links, Makefile targets. ### LocalTerra multisig rehearsal evidence (2026-06-25T11:49:25Z) | Field | Value | |-------|-------| | Factory | `terra1hrpna9v7vs3stzyd4z3xf00676kf78zpe2u5ksvljswn2vnjp3ysc6mpf5` | | Governance multisig | `terra18fmftmt6r36tca30ayc3hywp70gl0yyejk37ej` (2-of-3 rehearsal keys) | | Pair | `terra16jd56eylzgwr2jyx97wymajp7u5h9rdn9jqh0nkfm6jswec66qkq3tdy0g` | | Step | Tx hash | |------|---------| | UpdateConfig → multisig | `29D77A5A3F300BAC48DCFD6B3C9744F1B290AE72189DE652A0F337E607CAB1D5` | | SetPairPaused `true` | `A0CD4F4110FCA0FF1B09FCEF79F33B6633EC456CF2BC824012CF8E6D199790DF` | | BlacklistWallet | `ADF973512965FA38704D8F2FDA12CCE84C73AEA0362F9F1A536F5AC0974D31B1` | | SetPairPaused `false` | `0B1B320F3F047A5EEF46E7D81D7F1A502C090241EF0F6334A0497DC013FC05D0` | | UnblacklistWallet | `50AE562E9DF1EF05D549CAFCB1407B25659B18CC306CC7031FC9790983CEF941` | ### Repo deliverables (original gap — resolved) - `docs/runbooks/governance-emergency-rehearsal.md` — operator runbook + signing flow - `docs/templates/governance-emergency-rehearsal-evidence.md` — evidence template - `scripts/rehearse-governance-emergency-controls.sh` — automated LocalTerra dry-run - `scripts/qa/verify-issue-397.sh` — verification harness ### Follow-up (pre-mainnet, operator-owned) Before Phase 5 **GO**, operators must repeat the four emergency operations from the **planned production governance multisig** on **testnet/staging**, post the filled evidence template on launch issue [#391](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/391), and link it in go/no-go sign-off. Until then, SEC-B09 remains a **PAUSE** criterion per the launch checklist.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-25 11:50:35 +00:00

Brouie commented

2026-06-28 23:24:44 +00:00

(Migrated from gitlab.com)

mentioned in issue #337