Timelocked multisig asset recovery during pause and blacklist with dispute controls #6
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
code/cw20-mintable#6
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Implement explicit token recovery entrypoints independent of ordinary transfer guards. Recovery authorization must come from configured governance multisig, never the responder, minter or portal service. Minimum 30 days (2592000 seconds), never shortened by user settings, role rotation or global pause. Proposal binds token, source, exact amount, proven recipient, evidence digest, nonce and earliest execution. Destination/amount/evidence change creates a new proposal and full timer. Only exact approved amount moves; no mint, burn, total-supply change or allowance requirement. Single execution and checked arithmetic. Recoveries work from blacklisted/locked source and during global pause; explicitly decide safe destination blacklist policy. Prevent source draining during delay using bounded reservation or equivalent freeze, with visible state and release on cancellation. Prevent simultaneous over-reservation and recipient/source self-reference.
Provide independent dispute/veto/cancel pathway; an assertion from compromised social media is insufficient. Reject/restart on destination control loss or unresolved dispute. Governance-approved evidence is an attestation, not automatic on-chain proof of rightful ownership; store hash only. Require destination proof/acceptance and secure recovery registration where feasible; separate authorization from execution, revalidate roles/state at execution. Receipt events cover start/cancel/dispute/execute without PII.
Dependency: controller and wallet state definitions before implementation.
Working rules
User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.
Implementation assigned to BB worker
thr_n4vtxxfcb7, coordinated bythr_4rw76j9kerin security epic.Dependency/order: Controller authority and wallet reservation state stable first; research informs adjudication before release.
Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.
Research #8 final lifecycle invariants, aligned with coordinator correction: replacement cannot reduce reserved principal without independent release approval (100→1 must not release99 through governance-only replacement). Increases need unreserved capacity; replacement is atomic without drain gap and starts full >=30d. Cancellation requests bind authority epoch and require current governance renewal after rotation before independent release confirmation. Source-key objections never release/reset, and rotation never implicitly unreserves. These are required review scenarios, not a claim of deployed acceptance.
Implemented immutable exact recovery proposals with >=2592000s (fractional starts round up), source reservation/over-reservation checks, destination on-chain acceptance and irrevocable acceptance revocation, separate governance authorization/recovery execution/independent dispute role. Source objections never release/restart; independent veto keeps reservation; replacement cannot reduce reserved amount and atomically restarts full timer. Cancellation requires current-epoch governance request plus independent confirmation. Epoch invalidation never releases funds. Recovery bypasses source pause/blacklist/lock only; blocked destination is rejected and supply/allowances conserved. Focused boundary/replay/cancel/drain/dispute/rotation tests pass. Procedure links research issue8 and committed independent adjudication report; no PII on chain. Source independently reviewed at2d70d43.
Implementation PR: #14 . Reviewed exact-byte local candidate (draft, not deployed): https://git.cl8y.com/code/cw20-mintable/releases/tag/security-v1-review-2d70d43 . Rollout receipts: docs/rollout/{README.md,artifact-provenance.json,columbus-5-inventory.json,selected-integration-balances.json}. Contract lead thr_n4vtxxfcb7 retains issue/rollout ownership; parent coordinator thr_4rw76j9ker. No closing keywords or live coverage claim; this issue remains open for unverified production acceptance.