Inventory expiring allowances and add scoped approval/revocation guidance #9

New issue

Open

opened 2026-10-31 02:07:43 +00:00 by PlasticDigits · 0 comments

PlasticDigits commented

2026-10-31 02:07:43 +00:00

Owner

Research follow-up from #8 / epic #3. #5 already owns owner-attributed limits and delegated debit enforcement. This issue owns approval lifetime/amount hygiene and user-facing revocation integration.

Acceptance:

Inventory existing CW20 Expiration variants/defaults, IncreaseAllowance/DecreaseAllowance and From-path behavior at pinned source/deployment; distinguish already supported features from missing capability.
Specify exact amount and finite-expiry defaults for portal-integrated approval flows with protocol exceptions explicitly reviewed; no blanket unlimited approvals or unsupported claim of revocation.
Include existing allowance visibility, expiry/height vs time, revoke/decrease transaction receipt and stale/unavailable-chain handling; coordinate portal #2 without duplicating generic previews.
Document direct owner-key compromise limitation, spender/source attribution, existing pools/bridge compatibility and network coverage.
Only if a contract gap is found, file a separate narrowly scoped implementation issue with acceptance after #5 review. Evidence inventory/examples suffice for design acceptance; do not modify token code as part of #8.

No promise that allowance expiry would have prevented this unresolved signing compromise.

Research follow-up from #8 / epic #3. #5 already owns owner-attributed limits and delegated debit enforcement. This issue owns approval lifetime/amount hygiene and user-facing revocation integration. Acceptance: - Inventory existing CW20 Expiration variants/defaults, IncreaseAllowance/DecreaseAllowance and From-path behavior at pinned source/deployment; distinguish already supported features from missing capability. - Specify exact amount and finite-expiry defaults for portal-integrated approval flows with protocol exceptions explicitly reviewed; no blanket unlimited approvals or unsupported claim of revocation. - Include existing allowance visibility, expiry/height vs time, revoke/decrease transaction receipt and stale/unavailable-chain handling; coordinate portal #2 without duplicating generic previews. - Document direct owner-key compromise limitation, spender/source attribution, existing pools/bridge compatibility and network coverage. - Only if a contract gap is found, file a separate narrowly scoped implementation issue with acceptance after #5 review. Evidence inventory/examples suffice for design acceptance; do not modify token code as part of #8. No promise that allowance expiry would have prevented this unresolved signing compromise.

PlasticDigits self-assigned this

2026-10-31 02:07:43 +00:00

PlasticDigits referenced this issue

2026-10-31 02:09:51 +00:00

Security upgrade: incident-driven CW20 protections and wallet security portal #3

PlasticDigits referenced this issue

2026-10-31 02:11:31 +00:00

Research: October wallet-compromise incident, rescued funds, ownership verification and further defenses #8