Shared security controller: fleet pause, blacklist, least-privilege responders and key rotation

PlasticDigits commented

2026-10-31 01:57:05 +00:00

Owner

Build a separate deployable CosmWasm controller plus versioned Rust interface shared with tokens. One pause call changes shared state immediately for all enrolled token guards; no fleet iteration. Pause-only automated responder cannot unpause, recover, migrate, change roles, or clear blacklists. Governance multisig controls unpause and adjudication. Separate blacklist authority and recovery authority; reject unsafe address/role combinations where enforceable, document overlapping constituent-key risks. Two-step delayed authority rotation (48h initial proposal, configurable only with existing delay and sensible bounds), candidate acceptance, cancellation and emitted audit events. Revocation of compromised responder is immediate; enabling/replacing privilege is delayed. Fail closed on query errors; document controller unavailability blast radius and safe migration process. Use canonical snake_case JSON and typed schemas.

Authorization matrix + focused unauthorized-role tests, rotation boundary/cancel tests.
Controller pause/blacklist query exposes epoch/version and authoritative status.
No permanent automation capability beyond bounded containment; pause cannot silently expire.
Governance multisig verification/deployment identity recorded separately from an arbitrary address.
Dependency: establish interface first, then token guard integration; may implement in parallel with local wallet state.

Working rules

User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.

Build a separate deployable CosmWasm controller plus versioned Rust interface shared with tokens. One pause call changes shared state immediately for all enrolled token guards; no fleet iteration. Pause-only automated responder cannot unpause, recover, migrate, change roles, or clear blacklists. Governance multisig controls unpause and adjudication. Separate blacklist authority and recovery authority; reject unsafe address/role combinations where enforceable, document overlapping constituent-key risks. Two-step delayed authority rotation (48h initial proposal, configurable only with existing delay and sensible bounds), candidate acceptance, cancellation and emitted audit events. Revocation of compromised responder is immediate; enabling/replacing privilege is delayed. Fail closed on query errors; document controller unavailability blast radius and safe migration process. Use canonical snake_case JSON and typed schemas. - [ ] Authorization matrix + focused unauthorized-role tests, rotation boundary/cancel tests. - [ ] Controller pause/blacklist query exposes epoch/version and authoritative status. - [ ] No permanent automation capability beyond bounded containment; pause cannot silently expire. - [ ] Governance multisig verification/deployment identity recorded separately from an arbitrary address. Dependency: establish interface first, then token guard integration; may implement in parallel with local wallet state. ## Working rules User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.

PlasticDigits referenced this issue

2026-10-31 01:59:42 +00:00

Security upgrade: incident-driven CW20 protections and wallet security portal #3

PlasticDigits commented

2026-10-31 01:59:43 +00:00

Author

Owner

Implementation assigned to BB worker thr_n4vtxxfcb7, coordinated by thr_4rw76j9ker in security epic.

Dependency/order: Versioned shared interface first; controller and wallet internals can then progress independently.

Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.

Implementation assigned to BB worker `thr_n4vtxxfcb7`, coordinated by `thr_4rw76j9ker` in [security epic](https://git.cl8y.com/code/cw20-mintable/issues/3). Dependency/order: Versioned shared interface first; controller and wallet internals can then progress independently. Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.

PlasticDigits commented

2026-10-31 02:15:01 +00:00

Author

Owner

Independent coordinator source review completed for controller + shared interface at 3333807148f096cc5894c2b74442655bc5f4ad93; reviewer did not author the controller. This reviews controller source/interface/documentation only, not token correctness or live deployment.

Result: no blocking controller finding in reviewed scope. Inspected initial 2239cd2 implementation, then exact final delta: three timer events gain stored initiator and proposed_at; shared interface changes are formatting only. Guard remains constant-work, maximum three validated addresses with input-order blacklist vector, explicit enrollment/version and authoritative epochs. Distinct role addresses, pause-only responder, governance-only unpause/enrollment/delayed clearing, immediate responder revoke/reblock, candidate acceptance, global nonces and checked counters are enforced. Governance-tenure epoch prevents blacklist-clear replay even after an address returns to governance. Existing proposal deadlines intentionally retain old-delay snapshots; new delay affects future proposals. Fractional block timestamps round deadlines up. Queries and local tests cover shared pause across two enrolled token identities, independent of fleet fanout.

Independent bounded validation: cargo test -p cw20-security-controller --lib in integration worktree at the exact pin: 14 passed, 0 failed, test runtime 0.01s (build 0.93s). Reviewed meaningful authorization, role overlap, replacement/cancellation, old-delay shortening, fractional timestamp, stale-governance replay, overflow/funds and query-boundary tests. No broad script or extra full-workspace test run.

Deployment acceptance remains open: verify actual multisig threshold and constituent-key independence, chain-level admin custody/upgrade policy, exact code/artifact checksums, intended chain/controller enrollment and every token's live fail-closed pointer/guards. Distinct addresses alone cannot prove independent people/keys or a multisig. Shared controller availability and trusted governance/admin remain documented assumptions. Wasm/optimizer/chain compatibility and migration custody are separate release evidence. Any subsequent controller semantic change requires a new pinned review; token review remains assigned to its independent reviewer.

Independent coordinator source review completed for controller + shared interface at `3333807148f096cc5894c2b74442655bc5f4ad93`; reviewer did not author the controller. This reviews controller source/interface/documentation only, not token correctness or live deployment. Result: no blocking controller finding in reviewed scope. Inspected initial `2239cd2` implementation, then exact final delta: three timer events gain stored `initiator` and `proposed_at`; shared interface changes are formatting only. Guard remains constant-work, maximum three validated addresses with input-order blacklist vector, explicit enrollment/version and authoritative epochs. Distinct role addresses, pause-only responder, governance-only unpause/enrollment/delayed clearing, immediate responder revoke/reblock, candidate acceptance, global nonces and checked counters are enforced. Governance-tenure epoch prevents blacklist-clear replay even after an address returns to governance. Existing proposal deadlines intentionally retain old-delay snapshots; new delay affects future proposals. Fractional block timestamps round deadlines up. Queries and local tests cover shared pause across two enrolled token identities, independent of fleet fanout. Independent bounded validation: `cargo test -p cw20-security-controller --lib` in integration worktree at the exact pin: **14 passed, 0 failed**, test runtime 0.01s (build 0.93s). Reviewed meaningful authorization, role overlap, replacement/cancellation, old-delay shortening, fractional timestamp, stale-governance replay, overflow/funds and query-boundary tests. No broad script or extra full-workspace test run. Deployment acceptance remains open: verify actual multisig threshold and constituent-key independence, chain-level admin custody/upgrade policy, exact code/artifact checksums, intended chain/controller enrollment and every token's live fail-closed pointer/guards. Distinct addresses alone cannot prove independent people/keys or a multisig. Shared controller availability and trusted governance/admin remain documented assumptions. Wasm/optimizer/chain compatibility and migration custody are separate release evidence. Any subsequent controller semantic change requires a new pinned review; token review remains assigned to its independent reviewer.

PlasticDigits referenced this issue

2026-10-31 02:20:02 +00:00

Migration, protocol compatibility and independent security review of token fleet #7

PlasticDigits referenced this issue

2026-10-31 02:27:52 +00:00

Shared CW20 containment, delayed wallet protections and reserved recovery #14

PlasticDigits commented

2026-10-31 02:28:44 +00:00

Author

Owner

Implemented separate controller+interface v1 with bounded authoritative guard queries, persistent shared pause, pause-only responder, separate roles, delayed governance blacklist clearing and two-step role rotation, immediate responder revoke/reblock, global nonces/epochs and complete timer events. Independent controller source review3333807 with14tests: #4 (comment) . Generated controller schema SHA256975e0e32db0de5d19ac4d3bcfd3062d137aff8f472d822ad2243ec77ac845544. Controller artifact passes matching CosmWasm1.5.11 checker. New controller roles/admin custody are not yet configured/verified on chain; arbitrary addresses never treated as multisig proof.

Implementation PR: #14 . Reviewed exact-byte local candidate (draft, not deployed): https://git.cl8y.com/code/cw20-mintable/releases/tag/security-v1-review-2d70d43 . Rollout receipts: docs/rollout/{README.md,artifact-provenance.json,columbus-5-inventory.json,selected-integration-balances.json}. Contract lead thr_n4vtxxfcb7 retains issue/rollout ownership; parent coordinator thr_4rw76j9ker. No closing keywords or live coverage claim; this issue remains open for unverified production acceptance.

Implemented separate controller+interface v1 with bounded authoritative guard queries, persistent shared pause, pause-only responder, separate roles, delayed governance blacklist clearing and two-step role rotation, immediate responder revoke/reblock, global nonces/epochs and complete timer events. Independent controller source review3333807 with14tests: https://git.cl8y.com/code/cw20-mintable/issues/4#issuecomment-65368 . Generated controller schema SHA256975e0e32db0de5d19ac4d3bcfd3062d137aff8f472d822ad2243ec77ac845544. Controller artifact passes matching CosmWasm1.5.11 checker. New controller roles/admin custody are not yet configured/verified on chain; arbitrary addresses never treated as multisig proof. Implementation PR: https://git.cl8y.com/code/cw20-mintable/pulls/14 . Reviewed exact-byte local candidate (draft, not deployed): https://git.cl8y.com/code/cw20-mintable/releases/tag/security-v1-review-2d70d43 . Rollout receipts: docs/rollout/{README.md,artifact-provenance.json,columbus-5-inventory.json,selected-integration-balances.json}. Contract lead thr_n4vtxxfcb7 retains issue/rollout ownership; parent coordinator thr_4rw76j9ker. No closing keywords or live coverage claim; this issue remains open for unverified production acceptance.

PlasticDigits referenced this issue

2026-10-31 03:39:00 +00:00

Security upgrade: incident-driven CW20 protections and wallet security portal #3

Rows
Columns

Shared security controller: fleet pause, blacklist, least-privilege responders and key rotation #4

Working rules