code/ust1-window
Watch
4
0
Fork
You've already forked ust1-window
 0
Code Issues 2 Pull requests 2 Projects Releases Packages Wiki Activity

Security review checklist — Top 20 CosmWasm + Top 20 EVM (approved via cl8y-ecosystem-qa #8) #5

New issue
Closed
opened 2026-04-21 07:34:03 +00:00 by Brouie · 14 comments
Brouie commented 2026-04-21 07:34:03 +00:00 (Migrated from gitlab.com)

@PlasticDigits approved via cl8y-ecosystem-qa#8. Full checklist committed at specs/UST1-Window-Security-Checklist.md in cl8y-ecosystem-qa (commit 556fdc0).

Scope

ust1-oracle + ust1-window CosmWasm contracts on Terra Classic, plus ust1-oracle-service (off-chain, BSC-reading).

Contract surface

ust1-oracle: UpdateRate, SetOracleOperator, SetPaused, ProposeGovernance, AcceptGovernance + Config, State + instantiate/migrate

ust1-window: Receive (cw20 hook — vFDUSD→UST1 mint / UST1→vFDUSD burn), SetLimits, SetPaused, SetFeeBps, ProposeGovernance, AcceptGovernance + Config, EffectiveSwap + instantiate/migrate

ust1-oracle-service: polls BSC Venus exchangeRateStored, applies throttle/daily-cap/monotonic policy, broadcasts UpdateRate to Terra

Checklist categories

CW-01 to CW-20 — access control, reply/submsg, fixed-point math, rounding, oracle staleness, two-step governance, migrate privilege, reentrancy, unbounded loops, panics, replay, pause bypass, limit bypass, fee_bps bounds, oracle policy (INV-ORACLE-*), attribute injection, cw20 spoofing, instantiate validation, attached funds, dependency hygiene.

EVM-01 to EVM-20 — RPC trust, reorg susceptibility, Venus address spoofing, decimals scaling, Rust math overflow, policy-drift (off-chain vs on-chain), signing key handling, TLS, DoS, liveness gap, replay, malicious UpdateRate injection, Venus deprecation, wrong-chain (chainId check), operator front-run, read/write separation, config injection, sensitive logging, supply-chain, CI pipeline integrity.

Method × issue coverage matrix included in the spec doc.

Next

I'll work through verification, document evidence per method in this issue thread (or split into sub-issues per category as findings emerge), and link back to the spec doc for any updates.

Full spec: https://gitlab.com/PlasticDigits/cl8y-ecosystem-qa/-/blob/main/specs/UST1-Window-Security-Checklist.md

@PlasticDigits approved via cl8y-ecosystem-qa#8. Full checklist committed at `specs/UST1-Window-Security-Checklist.md` in cl8y-ecosystem-qa (commit 556fdc0). ## Scope ust1-oracle + ust1-window CosmWasm contracts on Terra Classic, plus ust1-oracle-service (off-chain, BSC-reading). ## Contract surface **ust1-oracle:** UpdateRate, SetOracleOperator, SetPaused, ProposeGovernance, AcceptGovernance + Config, State + instantiate/migrate **ust1-window:** Receive (cw20 hook — vFDUSD→UST1 mint / UST1→vFDUSD burn), SetLimits, SetPaused, SetFeeBps, ProposeGovernance, AcceptGovernance + Config, EffectiveSwap + instantiate/migrate **ust1-oracle-service:** polls BSC Venus `exchangeRateStored`, applies throttle/daily-cap/monotonic policy, broadcasts UpdateRate to Terra ## Checklist categories **CW-01 to CW-20** — access control, reply/submsg, fixed-point math, rounding, oracle staleness, two-step governance, migrate privilege, reentrancy, unbounded loops, panics, replay, pause bypass, limit bypass, fee_bps bounds, oracle policy (INV-ORACLE-*), attribute injection, cw20 spoofing, instantiate validation, attached funds, dependency hygiene. **EVM-01 to EVM-20** — RPC trust, reorg susceptibility, Venus address spoofing, decimals scaling, Rust math overflow, policy-drift (off-chain vs on-chain), signing key handling, TLS, DoS, liveness gap, replay, malicious UpdateRate injection, Venus deprecation, wrong-chain (chainId check), operator front-run, read/write separation, config injection, sensitive logging, supply-chain, CI pipeline integrity. Method × issue coverage matrix included in the spec doc. ## Next I'll work through verification, document evidence per method in this issue thread (or split into sub-issues per category as findings emerge), and link back to the spec doc for any updates. Full spec: https://gitlab.com/PlasticDigits/cl8y-ecosystem-qa/-/blob/main/specs/UST1-Window-Security-Checklist.md
Brouie commented 2026-04-21 08:11:23 +00:00 (Migrated from gitlab.com)

@PlasticDigits initial sweep complete — all 40 categories (CW-01 to CW-20 + EVM-01 to EVM-20) reviewed against the contract surface and oracle-service code. Full notes below; findings will be filed as sub-issues for tracking.

Summary

  • Passes: 17 CosmWasm + 12 EVM = 29 of 40 categories clean
  • Findings: 9 real (medium-severity or actionable)
  • Minor notes: 9 (documentation/style/invariant clarifications)

CosmWasm findings

CW-05 — No oracle staleness guard on swap side. ust1-window deposit/withdraw query oracle.state and use the returned rate without checking last_update_sec against current block time. If oracle-service stops broadcasting, swaps continue indefinitely against the last-known rate. INV-ORACLE-THROTTLE-001 guarantees updates are ≥4h apart but places no upper bound on rate age. Recommend max-age check in deposit/withdraw.

CW-13 — Strict > on limits makes them inclusive caps. ensure_limits rejects only when ust1_notional > per_tx_ust1_limit and next > rolling_24h_ust1_limit. A swap exactly equal to the limit passes. Probably intentional but ambiguous vs spec. Recommend documenting Config field semantics.

CW-20 — cw20-mintable git dep not pinned. In workspace Cargo.toml: cw20-mintable = { git = "https://github.com/PlasticDigits/cw20-mintable", features = ["library"] }. No rev, tag, or branch. Supply-chain risk — force-push or compromise would affect next clean build. Recommend pinning to a commit SHA.

EVM / oracle-service findings

EVM-01 — Sequential RPC fallback, not multi-provider cross-check. run_with_evm_rpc_url_fallback tries URL 1, falls through to URL 2 only on error. First responsive URL wins. A single malicious or compromised RPC can forge the rate. Recommend reading from ≥2 providers and requiring exact match (or median) before broadcasting.

EVM-02 — No reorg protection. exchangeRateStored().call() uses Alloy's default block tag (latest). No confirmation depth, no Finalized tag. Reorg could cause pre-reorg rate to be read and broadcast. Recommend reading at Finalized or latest - N.

EVM-03 — Venus vToken address not allowlisted. VENUS_VTOKEN_ADDRESS accepted as any 0x-prefixed hex string. Wrong vToken (e.g. a different Venus market) would be read silently. Recommend hardcoded expected address or explicit allowlist, assert on startup.

EVM-08 — No HTTPS check on RPC URLs. BSC_RPC_URLS and TERRA_LCD_URL accepted as any string. HTTP URLs silently accepted and vulnerable to MITM. Recommend starts_with("https://") validation at config load.

EVM-10 — No liveness alerting. Service logs "tick failed" / "skip update" but has no external alert if it hasn't broadcast successfully in >4h. A silent failure compounds CW-05 (stale rate on-chain). Recommend metric endpoint, heartbeat file, or dead-man alert.

EVM-14 — No eth_chainId verification. Service doesn't assert chainId == 56 on BSC reads. Wrong-chain RPC (opBNB 204, mainnet 1, testnet) would be read silently. Recommend eth_chainId check per connection.

EVM-18 — Config derives Debug with terra_mnemonic field. config.rs:5 has #[derive(Debug, Clone)] pub struct Config { ... pub terra_mnemonic: String, ... }. Any debug!(?cfg) or {:?} formatter leaks the mnemonic into logs. Recommend dropping Debug on Config, or wrapping mnemonic in a redacting type.

Minor notes (document or decide later)

  • CW-04: Double-floor rounding in swap math compounds dust in protocol's favor. Not a bug — INV-SWAP-001/002 document floor semantics. Worth a README note: "vFDUSD reserve may drift slightly positive over many swaps; this is correct behavior."
  • CW-07: migrate in both contracts relies on chain-level wasm admin, no contract-level governance check on top. Standard CosmWasm pattern. Worth noting in deployment docs that whoever holds the chain admin can migrate.
  • CW-18: instantiate accepts per_tx_ust1_limit = 0 and rolling_24h_ust1_limit = 0 without rejection. Zero-limit deploys DoS all swaps. Recoverable via governance SetLimits. Deployer footgun.
  • CW-19: Governance exec_* paths don't reject info.funds.is_empty(). Attached uluna would lock in the contract. Can't hit via normal flows (governance wouldn't attach funds) but worth defensive rejection.
  • EVM-04: RATE_SCALE = 1e18 matches Venus exchangeRateStored only because FDUSD is 18-decimal. If ever pointed at a non-18-decimal underlying, math breaks silently. Document invariant.
  • EVM-09: No per-URL backoff on RPC failure. With poll_interval_secs = 21_600 (6h), this is low-risk. If service is ever tuned to faster polling, add exponential backoff.
  • EVM-13: If Venus exchangeRateStored reverts (paused/deprecated), service logs and retries forever. Configurable alert path preferred.
  • EVM-19 / CW-20: cargo audit not available on QA server this session. Recommend running in CI on every push (supplements the filed CW-20 git-pin finding).

Passes (no action needed)

  • CW-01 access control, CW-02 reply/submsg (contracts don't use reply handlers, simpler = safer), CW-03 overflow/truncation (all checked_*, proper Uint256 widening), CW-04 rounding (against-user floor), CW-06 two-step governance (clean pending clear), CW-08 reentrancy (state-before-submsg), CW-09 unbounded loops (no iteration anywhere), CW-10 panics (no unwrap in production), CW-11 replay, CW-12 pause bypass (correctly skipped on gov actions), CW-14 fee_bps bounds, CW-15 oracle policy (throttle/daily/monotonic all enforced), CW-16 attribute injection (bech32 validated inputs safe in practice), CW-17 cw20 spoofing (only registered tokens accepted).
  • EVM-05 Rust overflow, EVM-06 policy drift (uses shared ust1_common — perfect), EVM-07 signing key (not exposed on signer struct), EVM-11 Terra nonce (fresh sequence per tick + on-chain throttle idempotence), EVM-12 malicious UpdateRate injection (poll-only, caps limit blast radius), EVM-15 operator front-run (structurally bounded), EVM-16 read/write separation (clean), EVM-17 config injection (required-field errors), EVM-20 CI pipeline (gitleaks + pre-commit + workspace-optimizer).

Filing the 9 medium-severity findings as sub-issues next.

@PlasticDigits initial sweep complete — all 40 categories (CW-01 to CW-20 + EVM-01 to EVM-20) reviewed against the contract surface and oracle-service code. Full notes below; findings will be filed as sub-issues for tracking. ## Summary - **Passes:** 17 CosmWasm + 12 EVM = 29 of 40 categories clean - **Findings:** 9 real (medium-severity or actionable) - **Minor notes:** 9 (documentation/style/invariant clarifications) ## CosmWasm findings **CW-05 — No oracle staleness guard on swap side.** `ust1-window` deposit/withdraw query `oracle.state` and use the returned `rate` without checking `last_update_sec` against current block time. If `oracle-service` stops broadcasting, swaps continue indefinitely against the last-known rate. INV-ORACLE-THROTTLE-001 guarantees updates are ≥4h apart but places no upper bound on rate age. Recommend max-age check in `deposit`/`withdraw`. **CW-13 — Strict `>` on limits makes them inclusive caps.** `ensure_limits` rejects only when `ust1_notional > per_tx_ust1_limit` and `next > rolling_24h_ust1_limit`. A swap exactly equal to the limit passes. Probably intentional but ambiguous vs spec. Recommend documenting Config field semantics. **CW-20 — `cw20-mintable` git dep not pinned.** In workspace `Cargo.toml`: `cw20-mintable = { git = "https://github.com/PlasticDigits/cw20-mintable", features = ["library"] }`. No `rev`, `tag`, or `branch`. Supply-chain risk — force-push or compromise would affect next clean build. Recommend pinning to a commit SHA. ## EVM / oracle-service findings **EVM-01 — Sequential RPC fallback, not multi-provider cross-check.** `run_with_evm_rpc_url_fallback` tries URL 1, falls through to URL 2 only on error. First responsive URL wins. A single malicious or compromised RPC can forge the rate. Recommend reading from ≥2 providers and requiring exact match (or median) before broadcasting. **EVM-02 — No reorg protection.** `exchangeRateStored().call()` uses Alloy's default block tag (`latest`). No confirmation depth, no `Finalized` tag. Reorg could cause pre-reorg rate to be read and broadcast. Recommend reading at `Finalized` or `latest - N`. **EVM-03 — Venus vToken address not allowlisted.** `VENUS_VTOKEN_ADDRESS` accepted as any 0x-prefixed hex string. Wrong vToken (e.g. a different Venus market) would be read silently. Recommend hardcoded expected address or explicit allowlist, assert on startup. **EVM-08 — No HTTPS check on RPC URLs.** `BSC_RPC_URLS` and `TERRA_LCD_URL` accepted as any string. HTTP URLs silently accepted and vulnerable to MITM. Recommend `starts_with("https://")` validation at config load. **EVM-10 — No liveness alerting.** Service logs "tick failed" / "skip update" but has no external alert if it hasn't broadcast successfully in >4h. A silent failure compounds CW-05 (stale rate on-chain). Recommend metric endpoint, heartbeat file, or dead-man alert. **EVM-14 — No `eth_chainId` verification.** Service doesn't assert `chainId == 56` on BSC reads. Wrong-chain RPC (opBNB 204, mainnet 1, testnet) would be read silently. Recommend `eth_chainId` check per connection. **EVM-18 — `Config` derives `Debug` with `terra_mnemonic` field.** `config.rs:5` has `#[derive(Debug, Clone)] pub struct Config { ... pub terra_mnemonic: String, ... }`. Any `debug!(?cfg)` or `{:?}` formatter leaks the mnemonic into logs. Recommend dropping Debug on Config, or wrapping mnemonic in a redacting type. ## Minor notes (document or decide later) - **CW-04:** Double-floor rounding in swap math compounds dust in protocol's favor. Not a bug — INV-SWAP-001/002 document floor semantics. Worth a README note: "vFDUSD reserve may drift slightly positive over many swaps; this is correct behavior." - **CW-07:** `migrate` in both contracts relies on chain-level wasm admin, no contract-level governance check on top. Standard CosmWasm pattern. Worth noting in deployment docs that whoever holds the chain admin can migrate. - **CW-18:** `instantiate` accepts `per_tx_ust1_limit = 0` and `rolling_24h_ust1_limit = 0` without rejection. Zero-limit deploys DoS all swaps. Recoverable via governance `SetLimits`. Deployer footgun. - **CW-19:** Governance `exec_*` paths don't reject `info.funds.is_empty()`. Attached uluna would lock in the contract. Can't hit via normal flows (governance wouldn't attach funds) but worth defensive rejection. - **EVM-04:** `RATE_SCALE = 1e18` matches Venus `exchangeRateStored` only because FDUSD is 18-decimal. If ever pointed at a non-18-decimal underlying, math breaks silently. Document invariant. - **EVM-09:** No per-URL backoff on RPC failure. With `poll_interval_secs = 21_600` (6h), this is low-risk. If service is ever tuned to faster polling, add exponential backoff. - **EVM-13:** If Venus `exchangeRateStored` reverts (paused/deprecated), service logs and retries forever. Configurable alert path preferred. - **EVM-19 / CW-20:** `cargo audit` not available on QA server this session. Recommend running in CI on every push (supplements the filed CW-20 git-pin finding). ## Passes (no action needed) - **CW-01** access control, **CW-02** reply/submsg (contracts don't use reply handlers, simpler = safer), **CW-03** overflow/truncation (all `checked_*`, proper Uint256 widening), **CW-04** rounding (against-user floor), **CW-06** two-step governance (clean pending clear), **CW-08** reentrancy (state-before-submsg), **CW-09** unbounded loops (no iteration anywhere), **CW-10** panics (no unwrap in production), **CW-11** replay, **CW-12** pause bypass (correctly skipped on gov actions), **CW-14** fee_bps bounds, **CW-15** oracle policy (throttle/daily/monotonic all enforced), **CW-16** attribute injection (bech32 validated inputs safe in practice), **CW-17** cw20 spoofing (only registered tokens accepted). - **EVM-05** Rust overflow, **EVM-06** policy drift (uses shared `ust1_common` — perfect), **EVM-07** signing key (not exposed on signer struct), **EVM-11** Terra nonce (fresh sequence per tick + on-chain throttle idempotence), **EVM-12** malicious UpdateRate injection (poll-only, caps limit blast radius), **EVM-15** operator front-run (structurally bounded), **EVM-16** read/write separation (clean), **EVM-17** config injection (required-field errors), **EVM-20** CI pipeline (gitleaks + pre-commit + workspace-optimizer). Filing the 9 medium-severity findings as sub-issues next.
Brouie commented 2026-04-21 08:12:03 +00:00 (Migrated from gitlab.com)

mentioned in issue #6

mentioned in issue #6
Brouie commented 2026-04-21 08:12:46 +00:00 (Migrated from gitlab.com)

mentioned in issue #7

mentioned in issue #7
Brouie commented 2026-04-21 08:13:14 +00:00 (Migrated from gitlab.com)

mentioned in issue #8

mentioned in issue #8
Brouie commented 2026-04-21 08:13:48 +00:00 (Migrated from gitlab.com)

mentioned in issue #9

mentioned in issue #9
Brouie commented 2026-04-21 08:14:13 +00:00 (Migrated from gitlab.com)

mentioned in issue #10

mentioned in issue #10
Brouie commented 2026-04-21 08:14:45 +00:00 (Migrated from gitlab.com)

mentioned in issue #11

mentioned in issue #11
Brouie commented 2026-04-21 08:15:18 +00:00 (Migrated from gitlab.com)

mentioned in issue #12

mentioned in issue #12
Brouie commented 2026-04-21 08:15:56 +00:00 (Migrated from gitlab.com)

mentioned in issue #13

mentioned in issue #13
Brouie commented 2026-04-21 08:16:36 +00:00 (Migrated from gitlab.com)

mentioned in issue #14

mentioned in issue #14
Brouie commented 2026-04-21 08:17:06 +00:00 (Migrated from gitlab.com)

@PlasticDigits all 9 medium-severity findings filed as sub-issues #6 through #14.

Summary by category:

  • On-chain (ust1-window): #6 (CW-05 staleness), #14 (CW-20 git pin)
  • Off-chain (oracle-service): #7 (EVM-01 multi-provider), #8 (EVM-02 reorg), #9 (EVM-03 Venus allowlist), #10 (EVM-08 HTTPS), #11 (EVM-10 liveness), #12 (EVM-14 chainId), #13 (EVM-18 mnemonic redact)

The 9 minor notes from the sweep comment above are in-comment only — not filing separately unless you want them as tracking issues. Happy to split any of them out if you'd rather.

This issue (#5) can serve as the verification tracker. As each sub-issue is fixed I'll close it + confirm on the parent. Ready for dev triage on severity/priority.

@PlasticDigits all 9 medium-severity findings filed as sub-issues #6 through #14. Summary by category: - On-chain (ust1-window): #6 (CW-05 staleness), #14 (CW-20 git pin) - Off-chain (oracle-service): #7 (EVM-01 multi-provider), #8 (EVM-02 reorg), #9 (EVM-03 Venus allowlist), #10 (EVM-08 HTTPS), #11 (EVM-10 liveness), #12 (EVM-14 chainId), #13 (EVM-18 mnemonic redact) The 9 minor notes from the sweep comment above are in-comment only — not filing separately unless you want them as tracking issues. Happy to split any of them out if you'd rather. This issue (#5) can serve as the verification tracker. As each sub-issue is fixed I'll close it + confirm on the parent. Ready for dev triage on severity/priority.
Brouie commented 2026-04-21 08:22:53 +00:00 (Migrated from gitlab.com)

mentioned in issue #1

mentioned in issue #1
Brouie commented 2026-04-22 00:37:33 +00:00 (Migrated from gitlab.com)

@PlasticDigits all 9 sub-issues from the initial sweep are now CLOSED as of this morning's verification.

Closed today: #6 #7 #8 #9 #10 #11 #12 #13 #14

Every fix verified by code review + 40/40 workspace test run (up from 28/28 before fixes — 12 new tests landed). All fixes meet or exceed the recommendations in the original findings. Particular standouts:

  • #6 staleness guard: added last_update_sec == 0 protection + governance-settable max age, beyond spec
  • #7 multi-provider consensus: parallel queries + 0.01% tolerance + tiebreaker URL, full implementation
  • #9 Venus address: hardcoded with conditional requirement gated on chain-id whitelist
  • #13 Debug redact: used secrecy::SecretString (compile-time expose_secret requirement) instead of manual Debug impl
  • #10 HTTPS: loopback escape hatch via DEV_ALLOW_HTTP matches exactly

Parent #5 can serve as the ongoing verification tracker. No outstanding findings from the initial sweep. Happy to sweep again after any significant contract or oracle-service change.

@PlasticDigits all 9 sub-issues from the initial sweep are now CLOSED as of this morning's verification. Closed today: #6 #7 #8 #9 #10 #11 #12 #13 #14 Every fix verified by code review + 40/40 workspace test run (up from 28/28 before fixes — 12 new tests landed). All fixes meet or exceed the recommendations in the original findings. Particular standouts: - #6 staleness guard: added `last_update_sec == 0` protection + governance-settable max age, beyond spec - #7 multi-provider consensus: parallel queries + 0.01% tolerance + tiebreaker URL, full implementation - #9 Venus address: hardcoded with conditional requirement gated on chain-id whitelist - #13 Debug redact: used `secrecy::SecretString` (compile-time expose_secret requirement) instead of manual Debug impl - #10 HTTPS: loopback escape hatch via DEV_ALLOW_HTTP matches exactly Parent #5 can serve as the ongoing verification tracker. No outstanding findings from the initial sweep. Happy to sweep again after any significant contract or oracle-service change.
Brouie commented 2026-04-23 09:20:52 +00:00 (Migrated from gitlab.com)

@PlasticDigits all 9 findings from the 4/21 sweep have been closed via #6-#14 (fixes verified 4/22). Minor notes remain as documentation/invariant annotations — not blockers.

Resolution status

Finding Issue Status
CW-05 oracle staleness guard #6 ✅ Closed 4/22
CW-13 strict > on limits (inclusive caps) #7 ✅ Closed 4/22 (docs)
CW-20 cw20-mintable unpinned dep #14 ✅ Closed 4/22
EVM-01 sequential RPC fallback #8 ✅ Closed 4/22 (EvmRpcReadPolicy quorum)
EVM-02 no reorg protection #9 ✅ Closed 4/22 (BSC_CONFIRMATION_BLOCKS)
EVM-03 Venus vToken address #10 ✅ Closed 4/22 (canonical allowlist)
EVM-08 no HTTPS check #11 ✅ Closed 4/22 (validate_rpc_url)
EVM-10 no liveness alerting #12 ✅ Closed 4/22 (ORACLE_MAX_SILENCE_SECS)
EVM-14 no chainId verification #13 ✅ Closed 4/22 (BSC_ALLOWED_CHAIN_IDS)
EVM-18 Debug leaks mnemonic covered under #12 ✅ Closed 4/22 (secrecy::SecretString)

Also shipped this week off this sweep

  • #15 deployment script + checklist + address registry (verified 4/23)
  • #16 wLUNC/wUSTC native wrap (verified 4/22)
  • #17 CMM treasury custody + 1% fee split (verified 4/23)
  • #18 INV-SWAP-002 vectors (verified 4/22)

Minor notes still standing (docs-only)

The 9 minor notes (CW-04, CW-07, CW-18, CW-19, EVM-04, EVM-09, EVM-13) were documentation / deployer-footgun observations, not security blockers. Spec UST1-Window-Security-Checklist.md in ecosystem-qa retains them as invariant reference.

Companion specs

The UST1 pattern is being replicated for YO and DEX (dev's 11am request):

  • YO-Security-Checklist-DRAFT.md — pushed to ecosystem-qa today (53f24a9), lowest priority
  • DEX-Security-Checklist.md — pending peer draft

Closing this tracker — sweep + all 9 findings accounted for.

@PlasticDigits all 9 findings from the 4/21 sweep have been closed via #6-#14 (fixes verified 4/22). Minor notes remain as documentation/invariant annotations — not blockers. ## Resolution status | Finding | Issue | Status | |---------|-------|--------| | CW-05 oracle staleness guard | #6 | ✅ Closed 4/22 | | CW-13 strict `>` on limits (inclusive caps) | #7 | ✅ Closed 4/22 (docs) | | CW-20 cw20-mintable unpinned dep | #14 | ✅ Closed 4/22 | | EVM-01 sequential RPC fallback | #8 | ✅ Closed 4/22 (`EvmRpcReadPolicy` quorum) | | EVM-02 no reorg protection | #9 | ✅ Closed 4/22 (`BSC_CONFIRMATION_BLOCKS`) | | EVM-03 Venus vToken address | #10 | ✅ Closed 4/22 (canonical allowlist) | | EVM-08 no HTTPS check | #11 | ✅ Closed 4/22 (`validate_rpc_url`) | | EVM-10 no liveness alerting | #12 | ✅ Closed 4/22 (`ORACLE_MAX_SILENCE_SECS`) | | EVM-14 no chainId verification | #13 | ✅ Closed 4/22 (`BSC_ALLOWED_CHAIN_IDS`) | | EVM-18 Debug leaks mnemonic | covered under #12 | ✅ Closed 4/22 (`secrecy::SecretString`) | ## Also shipped this week off this sweep - #15 deployment script + checklist + address registry (verified 4/23) - #16 wLUNC/wUSTC native wrap (verified 4/22) - #17 CMM treasury custody + 1% fee split (verified 4/23) - #18 INV-SWAP-002 vectors (verified 4/22) ## Minor notes still standing (docs-only) The 9 minor notes (CW-04, CW-07, CW-18, CW-19, EVM-04, EVM-09, EVM-13) were documentation / deployer-footgun observations, not security blockers. Spec `UST1-Window-Security-Checklist.md` in ecosystem-qa retains them as invariant reference. ## Companion specs The UST1 pattern is being replicated for YO and DEX (dev's 11am request): - `YO-Security-Checklist-DRAFT.md` — pushed to ecosystem-qa today (`53f24a9`), lowest priority - `DEX-Security-Checklist.md` — pending peer draft Closing this tracker — sweep + all 9 findings accounted for.
Brouie (Migrated from gitlab.com) closed this issue 2026-04-23 09:20:54 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue/50
renovate/configure
No results found.
Labels
Clear labels   
enhancement

   
governance

   
QA

   
testing
No labels
enhancement
governance
QA
testing
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/ust1-window#5
No description provided.