docs: extend CW20 whitelist policy to rebase/elastic-supply tokens (#448) #985

Merged

Brouie merged 1 commit from qa/448-token-whitelist-rebase-docs into main

2026-06-30 22:00:37 +00:00

Brouie commented

2026-06-30 19:06:55 +00:00

(Migrated from gitlab.com)

security-model.md: reframe the constraint as a balance-stability requirement
covering both fee-on-transfer and rebase/elastic-supply, and require source
review + recorded audit evidence before AddWhitelistedCodeId (not checksum
match alone).
cw20-whitelist-policy.md: add rebase/elastic-supply to prohibited templates and
the table, add a source-review step (no balance mutation outside an explicit
transfer) and an attach-audit-evidence step to pre-whitelist verification.

Docs-only; the optional balance-delta runtime assertion stays tracked on #448 as
a separate code change.

The fee-on-transfer prohibition (#377) was documented, but rebase / elastic- supply / reflection tokens — whose balance changes after receipt with no transfer — were not named, and there was no explicit audit-evidence requirement (SEC-I01 H05). Both mechanics desync the pair reserves and limit-order escrow the same way, since accounting credits declared amounts, not balance deltas. - security-model.md: reframe the constraint as a balance-stability requirement covering both fee-on-transfer and rebase/elastic-supply, and require source review + recorded audit evidence before AddWhitelistedCodeId (not checksum match alone). - cw20-whitelist-policy.md: add rebase/elastic-supply to prohibited templates and the table, add a source-review step (no balance mutation outside an explicit transfer) and an attach-audit-evidence step to pre-whitelist verification. Docs-only; the optional balance-delta runtime assertion stays tracked on #448 as a separate code change.

Brouie commented

2026-06-30 19:06:55 +00:00

(Migrated from gitlab.com)

assigned to @Brouie

PlasticDigits commented

2026-06-30 19:08:51 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 1a8ab01706a9dd2966a1f837407cc496710dfdfc

Scope: Docs-only MR — extends CW20 whitelist operational policy in docs/runbooks/cw20-whitelist-policy.md and docs/security-model.md to cover rebase / elastic-supply / reflection tokens alongside fee-on-transfer, and adds pre-whitelist source-review + audit-evidence requirements (GitLab #448, SEC-I01 H05). No smart-contract, indexer, or frontend code changes.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary: Reviewed the full MR diff and traced attacker-controlled inputs to sinks. Changes are documentation and governance-process guidance only; runtime controls are unchanged (AddWhitelistedCodeId remains governance-only; pair RESERVES / PENDING_ESCROW still credit declared CW20 amounts, not balance deltas — invariant P2). The added rebase/elastic-supply prohibition accurately reflects the same reserve-desync class already demonstrated for fee-on-transfer in adversarial_token::fee_on_transfer_creates_reserve_imbalance. New steps (source review, attach audit evidence, do not whitelist on checksum alone) strengthen ops controls rather than introducing injection, authz bypass, secret leakage, or other exploitable paths.

Inline threads: None (no medium+ findings to anchor).

## Security review **Commit reviewed:** `1a8ab01706a9dd2966a1f837407cc496710dfdfc` **Scope:** Docs-only MR — extends CW20 whitelist operational policy in `docs/runbooks/cw20-whitelist-policy.md` and `docs/security-model.md` to cover rebase / elastic-supply / reflection tokens alongside fee-on-transfer, and adds pre-whitelist source-review + audit-evidence requirements (GitLab #448, SEC-I01 H05). No smart-contract, indexer, or frontend code changes. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Summary:** Reviewed the full MR diff and traced attacker-controlled inputs to sinks. Changes are documentation and governance-process guidance only; runtime controls are unchanged (`AddWhitelistedCodeId` remains governance-only; pair `RESERVES` / `PENDING_ESCROW` still credit declared CW20 amounts, not balance deltas — invariant P2). The added rebase/elastic-supply prohibition accurately reflects the same reserve-desync class already demonstrated for fee-on-transfer in `adversarial_token::fee_on_transfer_creates_reserve_imbalance`. New steps (source review, attach audit evidence, do not whitelist on checksum alone) strengthen ops controls rather than introducing injection, authz bypass, secret leakage, or other exploitable paths. **Inline threads:** None (no medium+ findings to anchor).

Brouie commented

2026-06-30 19:08:57 +00:00

(Migrated from gitlab.com)

mentioned in issue #448