code/cl8y-dex-terraclassic

Fork 0

Security: no incident classification decision tree or rollback runbook for blacklist operations [SEC-B12] #400

New issue

Closed

opened 2026-06-19 10:44:09 +00:00 by totdking · 8 comments

totdking commented

2026-06-19 10:44:09 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-19 10:45:16 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-B12: Add explicit criteria for blacklisting during incidents: confirmed exploit signer, malicious token, compromised pair, and false-positive rollback. Verify: incident runbook has decision tree and rollback step.

Summary

ADR 0003 and the user-incident FAQ explain that blacklisting exists and what it does, but no document defines when to apply each type of blacklist, what evidence is required before acting, or what the rollback procedure looks like if an action is taken in error.

What Was Checked

docs/adr/0003-governance-trading-blacklist.md -- design rationale, no operational criteria or decision tree
docs/templates/incident-dex-indexer.md -- severity matrix and triage steps, no blacklist-specific decision branch
docs/user-incident-faq.md -- user-facing impact explanations, not operator decision logic
docs/security-model.md -- governance capabilities documented, no incident classification criteria
docs/runbooks/ -- no blacklist-decision.md or equivalent file found

Expected (per checklist)

The incident runbook must include explicit criteria for when to blacklist a wallet (confirmed exploit actor), when to blacklist a token (malicious contract behavior), when to blacklist a pair (compromised pool), and a false-positive rollback procedure including evidence preservation before reversal.

Actual

No decision criteria exist for any blacklist type. ADR 0003 explains the design but gives no operational guidance. The incident template has a severity table (S1-S4) but does not map severity levels to specific blacklist actions. There is no documented rollback procedure or requirement to preserve evidence before unblacklisting.

Evidence

docs/adr/0003-governance-trading-blacklist.md: design intent only, no criteria
docs/templates/incident-dex-indexer.md Mitigation step: "Follow Security model (pause, governance)" -- no decision branch
docs/user-incident-faq.md: user impact only, not operator decision logic
docs/runbooks/: no blacklist-decision.md found

Suggested Fix

Add a blacklist classification decision tree to docs/templates/incident-dex-indexer.md or a new docs/runbooks/blacklist-decision.md covering:

Wallet blacklist: apply when a wallet is confirmed as an exploit actor via on-chain evidence, not on suspicion alone
Token blacklist: apply when a registered CW20 contract exhibits malicious behavior verified by contract inspection
Pair blacklist: apply when a specific pool has a confirmed accounting error or is under active manipulation targeting that pair
False-positive rollback: before unblacklisting, record the evidence that led to the action, note the reason for reversal, confirm no funds were at risk, and log the decision in the incident timeline

Link this document from docs/templates/incident-dex-indexer.md at the Mitigation step.

Verification Checklist

Decision criteria exist for wallet blacklist (what constitutes a confirmed exploit actor)
Decision criteria exist for token blacklist (what constitutes malicious token behavior)
Decision criteria exist for pair blacklist (what constitutes a compromised pair)
False-positive rollback procedure requires evidence preservation before reversal
Decision document linked from the incident triage template at the Mitigation step
Developer has reviewed the criteria and confirmed they match intended governance policy

Labels

security, pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-B12: Add explicit criteria for blacklisting during incidents: confirmed exploit signer, malicious token, compromised pair, and false-positive rollback. Verify: incident runbook has decision tree and rollback step. --- ### Summary ADR 0003 and the user-incident FAQ explain that blacklisting exists and what it does, but no document defines when to apply each type of blacklist, what evidence is required before acting, or what the rollback procedure looks like if an action is taken in error. --- ### What Was Checked - `docs/adr/0003-governance-trading-blacklist.md` -- design rationale, no operational criteria or decision tree - `docs/templates/incident-dex-indexer.md` -- severity matrix and triage steps, no blacklist-specific decision branch - `docs/user-incident-faq.md` -- user-facing impact explanations, not operator decision logic - `docs/security-model.md` -- governance capabilities documented, no incident classification criteria - `docs/runbooks/` -- no blacklist-decision.md or equivalent file found --- ### Expected (per checklist) The incident runbook must include explicit criteria for when to blacklist a wallet (confirmed exploit actor), when to blacklist a token (malicious contract behavior), when to blacklist a pair (compromised pool), and a false-positive rollback procedure including evidence preservation before reversal. --- ### Actual No decision criteria exist for any blacklist type. ADR 0003 explains the design but gives no operational guidance. The incident template has a severity table (S1-S4) but does not map severity levels to specific blacklist actions. There is no documented rollback procedure or requirement to preserve evidence before unblacklisting. --- ### Evidence - `docs/adr/0003-governance-trading-blacklist.md`: design intent only, no criteria - `docs/templates/incident-dex-indexer.md` Mitigation step: "Follow Security model (pause, governance)" -- no decision branch - `docs/user-incident-faq.md`: user impact only, not operator decision logic - `docs/runbooks/`: no blacklist-decision.md found --- ### Suggested Fix Add a blacklist classification decision tree to `docs/templates/incident-dex-indexer.md` or a new `docs/runbooks/blacklist-decision.md` covering: - Wallet blacklist: apply when a wallet is confirmed as an exploit actor via on-chain evidence, not on suspicion alone - Token blacklist: apply when a registered CW20 contract exhibits malicious behavior verified by contract inspection - Pair blacklist: apply when a specific pool has a confirmed accounting error or is under active manipulation targeting that pair - False-positive rollback: before unblacklisting, record the evidence that led to the action, note the reason for reversal, confirm no funds were at risk, and log the decision in the incident timeline Link this document from `docs/templates/incident-dex-indexer.md` at the Mitigation step. --- ### Verification Checklist - [ ] Decision criteria exist for wallet blacklist (what constitutes a confirmed exploit actor) - [ ] Decision criteria exist for token blacklist (what constitutes malicious token behavior) - [ ] Decision criteria exist for pair blacklist (what constitutes a compromised pair) - [ ] False-positive rollback procedure requires evidence preservation before reversal - [ ] Decision document linked from the incident triage template at the Mitigation step - [ ] Developer has reviewed the criteria and confirmed they match intended governance policy --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

PlasticDigits commented

2026-06-19 10:52:07 +00:00

(Migrated from gitlab.com)

Additionally blacklisting may occur for tos violations.

totdking commented

2026-06-19 10:57:16 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 10:57:42 +00:00

(Migrated from gitlab.com)

mentioned in merge request !924

PlasticDigits commented

2026-06-19 12:45:40 +00:00

(Migrated from gitlab.com)

mentioned in commit 3446b3332a

mentioned in commit 3446b3332af5d1b41c5847ef796e01c06a568319

PlasticDigits commented

2026-06-19 12:49:56 +00:00

(Migrated from gitlab.com)

mentioned in merge request !928

PlasticDigits commented

2026-06-25 11:34:45 +00:00

(Migrated from gitlab.com)

Verification — GitLab #400 (SEC-B12)

Result: all acceptance criteria PASS. No repo changes required; remediation already on main.

Checklist

Criterion	Result	How verified
Wallet blacklist decision criteria (confirmed exploit actor)	PASS	`docs/runbooks/blacklist-decision.md` § Wallet blacklist — requires on-chain evidence of participation in theft/drain/abuse, tx hashes, governance approval; explicitly rejects suspicion-only
Token blacklist decision criteria (malicious token behavior)	PASS	Same runbook § Token blacklist — malicious CW20 verified by contract inspection (fee-skimming, hidden mint, reentrancy, etc.)
Pair blacklist decision criteria (compromised pair)	PASS	Same runbook § Pair blacklist — confirmed accounting error, reserve invariant break, or active manipulation; pause vs blacklist guidance
False-positive rollback with evidence preservation	PASS	Same runbook § False-positive rollback — mandatory checklist: preserve original evidence before `Unblacklist*`, document reversal reason, confirm no funds at risk, timeline logging
Decision document linked from incident template Mitigation	PASS	`docs/templates/incident-dex-indexer.md` Mitigation step links to `../runbooks/blacklist-decision.md` with SEC-B12 / #400 reference
Developer review of criteria vs governance policy	PASS	Criteria align with ADR 0003 factory blacklist design; PlasticDigits ToS-violation comment incorporated (§ Wallet blacklist + decision-tree branch); cross-linked from `security-model.md` and ADR 0003

Automated verification

$ make verify-issue-400
  PASS  blacklist decision doc invariant
  PASS  agent skill present
  PASS  incident template Mitigation links runbook
  PASS  security-model links operator runbook
  PASS: 4   FAIL: 0

$ make check-blacklist-decision-docs
OK: blacklist decision runbook covers SEC-B12 topics and is linked from incident template, security-model, and ADR 0003

Supporting artifacts

docs/runbooks/blacklist-decision.md — decision tree (mermaid), severity→action table, evidence-before-action table, rollback checklist, execution reference
skills/AGENTS_BLACKLIST_DECISION.md — agent playbook + drift guard pointer
scripts/check_blacklist_decision_docs.py — CI/lint invariant for required markers and cross-links

Closing as verified on main.

## Verification — GitLab #400 (SEC-B12) **Result: all acceptance criteria PASS.** No repo changes required; remediation already on `main`. ### Checklist | Criterion | Result | How verified | |-----------|--------|--------------| | Wallet blacklist decision criteria (confirmed exploit actor) | **PASS** | `docs/runbooks/blacklist-decision.md` § Wallet blacklist — requires on-chain evidence of participation in theft/drain/abuse, tx hashes, governance approval; explicitly rejects suspicion-only | | Token blacklist decision criteria (malicious token behavior) | **PASS** | Same runbook § Token blacklist — malicious CW20 verified by contract inspection (fee-skimming, hidden mint, reentrancy, etc.) | | Pair blacklist decision criteria (compromised pair) | **PASS** | Same runbook § Pair blacklist — confirmed accounting error, reserve invariant break, or active manipulation; pause vs blacklist guidance | | False-positive rollback with evidence preservation | **PASS** | Same runbook § False-positive rollback — mandatory checklist: preserve original evidence before `Unblacklist*`, document reversal reason, confirm no funds at risk, timeline logging | | Decision document linked from incident template Mitigation | **PASS** | `docs/templates/incident-dex-indexer.md` Mitigation step links to `../runbooks/blacklist-decision.md` with SEC-B12 / #400 reference | | Developer review of criteria vs governance policy | **PASS** | Criteria align with ADR 0003 factory blacklist design; PlasticDigits ToS-violation comment incorporated (§ Wallet blacklist + decision-tree branch); cross-linked from `security-model.md` and ADR 0003 | ### Automated verification ```text $ make verify-issue-400 PASS blacklist decision doc invariant PASS agent skill present PASS incident template Mitigation links runbook PASS security-model links operator runbook PASS: 4 FAIL: 0 $ make check-blacklist-decision-docs OK: blacklist decision runbook covers SEC-B12 topics and is linked from incident template, security-model, and ADR 0003 ``` ### Supporting artifacts - `docs/runbooks/blacklist-decision.md` — decision tree (mermaid), severity→action table, evidence-before-action table, rollback checklist, execution reference - `skills/AGENTS_BLACKLIST_DECISION.md` — agent playbook + drift guard pointer - `scripts/check_blacklist_decision_docs.py` — CI/lint invariant for required markers and cross-links Closing as verified on `main`.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-25 11:34:47 +00:00

Brouie commented

2026-06-28 23:24:44 +00:00

(Migrated from gitlab.com)

mentioned in issue #337