Research: October wallet-compromise incident, rescued funds, ownership verification and further defenses #8
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
code/cw20-mintable#8
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Review latest DEX incident records, including incidents/20261016_001/{README,FINDINGS,ACCOUNTING,BRIDGE_RECOVERY,CL8Y_RECOVERY,RECOVERY_UPDATE_20261018,BNB_FOLLOWUP}. Activity began October 15 UTC; case name is not event date. Separate accepted-signature compromise evidence from unresolved mechanism; no established contract exploit or Ledger defect, no attacker/nation-state attribution without evidence. Verify from source ledger what was stolen, contained, compensated, actually recovered and still unreturned. Distinguish designated recovery custody from final victim delivery.
Initial archive facts to independently check: 10.154338 vFDUSD recovered Oct 16; 25,452.503948354102807429 CL8Y paid from reserve Oct 18 (not attacker seizure; same amount remained blacklisted at attacker at snapshot); Penguin #1509 recovered Oct 17. Original $3907.19 was a dated historical valuation, not current loss or total recovery. Original bridge nonce 153 unconsumed is not cancellation.
Research current primary sources from CEX (Coinbase/Kraken/Binance identity/account recovery and withdrawal locks), banks (independent contact/step-up/fraud dispute), NIST identity proofing/recovery and actual DeFi guardians/social recovery/timelocks. Cite direct official links with access date, distinguish deployed mechanisms from proposals, legal requirements from design recommendations. Design evidence rubric distinguishing a stolen wallet key from stolen social identity and legitimate wallet transfer/sale: pre-enrolled independent recovery wallets, multisource possession/history, in-person or privacy-preserving KYC with liveness and issuer checks, out-of-band verification, challenge period, independent adjudicators, conflicting claims/appeals, minimal PII retention, accessibility/no-ID alternative, coercion and collusion. KYC proves identity, not inherently past wallet ownership. Privately store evidence; publish digests/redacted rationales. Trust CL8Y governance explicitly while separating roles and rotating keys. Do not require broad KYC for ordinary transfers by default.
Evaluate further prevention: transaction previews/hardware blind-signing, address allowlists/delayed new recipients, allowance expiry, account abstraction/guardians, bridge destination/cancellation protections and native-asset limits, anomaly automation with pause-only authority, monitored admin migrations, recovery reserves/insurance and escalation to exchanges. Prioritize actionable follow-up issues, not just report.
Independent research may run parallel; send early findings to recovery and portal implementers.
Working rules
User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.
Implementation assigned to BB worker
thr_q67g8guhi6, coordinated bythr_4rw76j9kerin security epic.Dependency/order: Independent immediately; send early adjudication requirements to contract and portal leads.
Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.
Owned by research thread thr_q67g8guhi6 under epic #3. Read full issue and incident archive; sent early adjudication requirements to contract and portal leads. Work is isolated on the documentation branch; no contract files edited. Current primary-source checks distinguish custodial account recovery from wallet entitlement, optional Safe modules and Argent Vault product scope. Preparing source-linked incident/recovery table, private evidence and 30-day contest/veto/appeal policy, plus deduplicated additional-defense issues. Recovery records remain historical observations; no current loss total, actor attribution or final victim-delivery claim is inferred.
Research deliverables published in PR #13, source head
20d76b3315964001223211bf8a3ade2d264c1a6bon isolated research branch. Report, source register, bounded evidence receipt and follow-up index are included. Independent research reviews found no blocker; scope/privacy/appeal corrections incorporated. Latest reservation invariants include independent approval for reduced replacement principal and epoch-bound cancellation renewal.Validated fourteen pinned archived input digests, exact ledger gross/fee/net, recovery units/endpoints/NFT ownership/unused nonce153, local links and diff whitespace. Official sources accessed 2026-10-31. No contract implementation changes, software suite/build, broad chain reconstruction, broadcast or merge.
Created proposed additional defenses (all open): portal #6 private evidence/adjudication, portal #7 recipient maturity; cw20 #9 allowance hygiene, #10 bridge payout invalidation, #11 native-wallet feasibility, #12 reserve/exchange accounting. All six linked in epic #3 separately from original mandatory acceptance. Existing controls/monitoring/previews retain their owners. Both contract and portal leads received early requirements.
Research checklist is satisfied by the published artifacts; leaving issue open pending documentation PR integration. Production acceptance remains open. Signing mechanism/device involvement/actor attribution, current loss and final victim delivery remain unresolved; historical reserve compensation is not attacker seizure.
Publication receipt correction for PR #13: original head20d76b3 inherited minter changes absent from Forgejo main, so the prior aggregate docs-only claim was incorrect. Rebased ONLY research commits onto current Forgejo base
2f8438b8096d3e72e22065822cb6d747ea03ce66; new headae012b7e75b022ea99617276aca2e1b46f55a9c3(commits3e1155b +ae012b7).git range-diffconfirms both research patches unchanged. Fresh merge-base diff AND PR files API show exactly README.md and four docs/research/issue-8 files; no src/contract.rs or other implementation files. Own branch updated with exact force-with-lease. Content reviews and bounded evidence remain valid. Ready for parent exact-pin review; no merge or issue closure performed.Coordinator reviewed corrected research head
ae012b7e75b022ea99617276aca2e1b46f55a9c3: aggregate PR diff is README plus four docs files only; report content is unchanged from reviewed patches. Integration attempted with exact head guard and refused HTTP405:Not all required status checks successful. Existing main protection requiresci/woodpecker/pr/woodpecker; this head has no statuses. Woodpecker repository26 (code/cw20-mintable) is active but has no pipeline history/config. Contract/rollout leadthr_n4vtxxfcb7owns bounded functional CI setup under #7, retaining branch protection and publishing actual run evidence. No check was bypassed or success status invented. Research issue remains open only pending integration; production criteria remain separately open.Research completed and integrated via PR #13 at merge commit
b041c17d852cb92035d939eddd617bdec5ab6de2, reviewed head5cd743bb6a6b4c0cff2c1a4eb499117a78c7cd3b. Coordinator reviewed exact documentation scope, source-linked entitlement/privacy policy, reserve-replacement and epoch invariants, and bounded evidence receipt; documentation diff whitespace check passed. Six additional-defense issues are tracked separately in epic #3. Closing only this research deliverable; no implemented/deployed contract, portal, custody or recovery acceptance is implied. Current state/final victim delivery and incident attribution remain unresolved as documented.