code/cw20-mintable
Watch
4
0
Fork
You've already forked cw20-mintable
 0
Code Issues 10 Pull requests 1 Projects Releases Packages Wiki Activity

docs: incident recovery evidence, ownership adjudication and defense backlog #13

Merged
PlasticDigits merged 2 commits from bb/incident-review-recovered-funds-and-ownership-ve-thr_q67g8guhi6 into main 2026-10-31 02:25:29 +00:00
Conversation 1 Commits 2 Files changed 5 +268
PlasticDigits commented 2026-10-31 02:10:24 +00:00
Owner

Unauthorized accepted signatures in the October incident require recovery to distinguish identity, current key control, historic entitlement and consent. This report records exact dated recovery/compensation evidence, compares current official CEX/bank/NIST/Safe/Argent sources, and proposes independent private adjudication with >=30-day contest, destination consent and reservation-safe disputes/rotation.

Research issue: #8; epic: #3. Six additional-defense issues are linked in the report and epic, separately from original production acceptance. Only README/documentation changes; no contract implementation, chain broadcasts or merges.

Validation: fourteen archived inputs match pinned DEX committed bytes; bounded ledger/selected-capture checks verify exact recovery units, reserve transfer endpoints, NFT ownership and unused nonce153. Official sources checked 2026-10-31; independent research review corrections incorporated. Local links and git diff whitespace check pass. No software test suite/build/archive-wide verifier was run for documentation.

Limits: signing mechanism/device involvement/actor attribution unresolved; no current loss valuation or final victim delivery established. Recommendations, issue creation and source publication do not establish implemented or deployed production controls.

Publication correction: the original local base included inherited GitHub minter changes absent from Forgejo main. Rebased only the two patch-identical research commits onto Forgejo origin/main 2f8438b; new head ae012b7e75b022ea99617276aca2e1b46f55a9c3. Git merge-base diff and the PR files API both confirm exactly README plus four docs files, with no contract/schema/Cargo changes. The prior per-commit docs-only check was insufficient; aggregate PR scope is now verified. No merge or issue closure performed.

Unauthorized accepted signatures in the October incident require recovery to distinguish identity, current key control, historic entitlement and consent. This report records exact dated recovery/compensation evidence, compares current official CEX/bank/NIST/Safe/Argent sources, and proposes independent private adjudication with >=30-day contest, destination consent and reservation-safe disputes/rotation. Research issue: #8; epic: #3. Six additional-defense issues are linked in the report and epic, separately from original production acceptance. Only README/documentation changes; no contract implementation, chain broadcasts or merges. Validation: fourteen archived inputs match pinned DEX committed bytes; bounded ledger/selected-capture checks verify exact recovery units, reserve transfer endpoints, NFT ownership and unused nonce153. Official sources checked 2026-10-31; independent research review corrections incorporated. Local links and git diff whitespace check pass. No software test suite/build/archive-wide verifier was run for documentation. Limits: signing mechanism/device involvement/actor attribution unresolved; no current loss valuation or final victim delivery established. Recommendations, issue creation and source publication do not establish implemented or deployed production controls. Publication correction: the original local base included inherited GitHub minter changes absent from Forgejo main. Rebased only the two patch-identical research commits onto Forgejo `origin/main` `2f8438b`; new head `ae012b7e75b022ea99617276aca2e1b46f55a9c3`. Git merge-base diff and the PR files API both confirm exactly README plus four docs files, with no contract/schema/Cargo changes. The prior per-commit docs-only check was insufficient; aggregate PR scope is now verified. No merge or issue closure performed.
UpdateMinter(None) (and primary rotation) left a dual-listed primary in
the additional MINTERS map, so revoked self-mint could still authorize.
Port upstream-style delete semantics (INV-MINTER-001).
fix(minter): clear MINTERS on UpdateMinter (INV-MINTER-001)
PlasticDigits force-pushed bb/incident-review-recovered-funds-and-ownership-ve-thr_q67g8guhi6 from 20d76b3315 to ae012b7e75 2026-10-31 02:14:04 +00:00 Compare
PlasticDigits commented 2026-10-31 02:16:44 +00:00
Author
Owner

Coordinator reviewed corrected research head ae012b7e75b022ea99617276aca2e1b46f55a9c3: aggregate PR diff is README plus four docs files only; report content is unchanged from reviewed patches. Integration attempted with exact head guard and refused HTTP405: Not all required status checks successful. Existing main protection requires ci/woodpecker/pr/woodpecker; this head has no statuses. Woodpecker repository26 (code/cw20-mintable) is active but has no pipeline history/config. Contract/rollout lead thr_n4vtxxfcb7 owns bounded functional CI setup under #7, retaining branch protection and publishing actual run evidence. No check was bypassed or success status invented. Research issue remains open only pending integration; production criteria remain separately open.

Coordinator reviewed corrected research head `ae012b7e75b022ea99617276aca2e1b46f55a9c3`: aggregate PR diff is README plus four docs files only; report content is unchanged from reviewed patches. Integration attempted with exact head guard and refused HTTP405: `Not all required status checks successful`. Existing main protection requires `ci/woodpecker/pr/woodpecker`; this head has no statuses. Woodpecker repository26 (`code/cw20-mintable`) is active but has no pipeline history/config. Contract/rollout lead `thr_n4vtxxfcb7` owns bounded functional CI setup under #7, retaining branch protection and publishing actual run evidence. No check was bypassed or success status invented. Research issue remains open only pending integration; production criteria remain separately open.
PlasticDigits force-pushed bb/incident-review-recovered-funds-and-ownership-ve-thr_q67g8guhi6 from ae012b7e75 to 5cd743bb6a
All checks were successful
ci/woodpecker/pr/woodpecker Pipeline was successful
Details
2026-10-31 02:22:36 +00:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

   
documentation

   
duplicate

   
enhancement

   
good first issue

   
help wanted

   
invalid

   
question

   
wontfix
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/cw20-mintable!13
No description provided.