Security upgrade: incident-driven CW20 protections and wallet security portal #3
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
code/cw20-mintable#3
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Coordinate all six requested token protections, a public Rust/TypeScript/PostgreSQL portal deployed to Coolify, incident research and independent review. Track dependency order, worker links, exact interfaces, defaults, migration coverage and rollout evidence.
Required acceptance
Implementation architecture: shared controller state is queried at token execution time, avoiding unbounded fleet message fanout. Existing contracts gain enforcement only after authorized migration. Inventory immutable/third-party-admin contracts and disclose uncovered assets. No global-pause claim for unmigrated contracts or native coins.
Working rules
User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.
Tracked work and worker ownership
thr_n4vtxxfcb7thr_n4vtxxfcb7thr_n4vtxxfcb7thr_n4vtxxfcb7thr_wur9hgwhecthr_wur9hgwhecthr_wur9hgwhecthr_wur9hgwhecthr_q67g8guhi6Initial defaults for implementation evaluation
Rate-limit defaults are engineering targets subject to documented protocol compatibility analysis, not already deployed policy. No implicit exemption for every contract/minter. Protocol exemptions require explicit reviewed governance action and delayed changes. Containment remains distinct from recovery authorization; guardian/recovery-wallet assignments require separate proofs and old-delay handling. A compromised signing key or social account cannot become sufficient proof of historical rightful ownership.
Current execution status
Updated 2026-11-01 after resumed coordination. Contract source PR14, research PR13, and the independently reviewed portal/provider/backup source are merged. Contracts have 91 source tests, separate independent reviews, target-compatible optimized artifacts and actual local-Wasm evidence. On-chain security-v1 coverage remains 0/35; source completion is not live activation.
The Rust/TypeScript/PostgreSQL portal is live at https://security.cl8y.com, running immutable application source
4fbe039/ schema6. The API and advancing worker are healthy; email is enabled for opted-in users after an actual three-message owned verification/timer/contact-change trial. The temporary receiver and its token are retired; the normal sender remains enabled, nonadmin and restricted to the verified gateway source IP. Final email evidence, runtime evidence.Encrypted offhost capture/readback/anonymous-denial and fresh-vault offline restore are verified, including all three SMTP sent/first-attempt rows, full timers/contact/event/outbox metadata and scratch authentication invalidation. Backup evidence. Native daily script automation
auto_cqn_6q-vhlgis enabled at 03:20 UTC after an independently accepted native-context run; credentials stay in the authorized operator process. This schedule depends on the BB/operator host, VPN and credentials. WG is currently active but not enabled for boot; reboot-safe availability and a <=24-hour RPO are not claimed (documented daily phase drift can reach 49 hours plus outage).Remaining external activation capabilities: dedicated portal Telegram bot token/authorized creation identity and its reviewed egress activation; actual unlocked authorized governance quorum and verified separate role/issuer/protocol transition for token migration. No chain transaction or security-v1 token migration occurred. No user monitoring or secret-in-chat task is assigned. Parent
thr_4rw76j9kerowns coordination; original implementation threads are completed/read-only and replacement reviewers handled the resumed work, avoiding concurrent resource writers.Incident baseline
Source: case overview, findings, recovery follow-up. Unauthorized accepted signatures began October 15 UTC; mechanism unresolved. The reviewed flows did not identify a contract takeover/exploit. At recorded recovery snapshots: 10.154338 vFDUSD recovered; Penguin #1509 returned to designated recovery address; 25,452.503948354102807429 CL8Y paid from existing reserves as compensation, while attacker-held CL8Y remained blacklisted. Recovery custody does not establish final victim delivery. These are dated records, not current holdings. No actor/nation-state attribution inferred.
Proposed additional defenses from research #8
These separately scoped follow-ups are proposed additional work, distinct from the original mandatory acceptance above. Research delivery does not establish their implementation or close production acceptance.
Research report/source receipts: PR #13, research progress. Documentation publication does not establish production deployment.
Contract source milestone complete: PR14 merged as
cccb89cb5f2f4f5bdddcbab930e0eca8ec20a3b6, reviewed head8dc22d9, after independent controller/token reviews, 91 native tests, matching CosmWasm1.5.11 optimized-artifact checks, bounded actual-Wasm smoke and genuine required CI8 success. Final review: #14 (comment) . Research PR13 is merged and research issue8 closed. Portal/API/notification/deployment lead remains active. Whole original acceptance remains open: live security-v1 coverage0/35 inventoried code10184 contracts; no controller deployment or migration transaction has occurred. Actual remaining chain prerequisites are unlocked authorized governance quorum, separate verified role custody, issuer/governance separation where overlapping, full legacy backup and DEX/protocol code-pin/exemption transition. Draft artifacts are review candidates, not a live release. No extra builds or broad testing requested; future work proceeds on real changed state/capability.Portal milestone: https://security.cl8y.com is live; source PR5 merged at
c07314ae53b6122fef667aa30de838b3a278f3d4. Running workload sourcee44569e45b15dbee4b0347dff742f92bd85bedb2, immutable OCI digest07b476118ac7ca8a8af9653471026d02c0e615ace174231bd50aea06392b607e, separately reviewed configuration hookb8aa303154b25d3017816c258b0daeb8954b7b26. Parent independently read HTTPS /healthz and /api/v1/status: HTTP200, migration5, matching source/advancing worker, CSP/no-store/HSTS/nosniff/no-referrer; source PR and independent live/storage/owned-proof receipts are recorded in portal PR5/OpsPR8. Whole acceptance remains open. Contract source PR14/research PR13 are merged; on-chain security-v1 coverage remains0/35 pending authorized signing/role/protocol transition. Live delivery remains disabled: scoped Mailu sender enrollment is available and now provisioned DISABLED with TESTNET-only token, SMTP adapter PR9 under independent review; this is not unavailable email credentials or a delivery receipt. Provider workerthr_ywz2dcyd3powns #3 continuation (gateway/verified egress, scoped enablement, owned delivery, independent Telegram provisioning); deployment workerthr_tj2burwn8bowns #4 continuation (offhost encrypted restore and contact-key custody proof), coordinated by leadthr_wur9hgwhec. Portal issues1–4 remain open for remaining factual acceptance, no real-recipient test messages or chain transactions performed.