Security and operations
What protects the money, who can do what, and what to do when something goes wrong. Written for whoever operates the network; read it before the first deploy.
The contracts
Immutable. No proxies, no upgrade path, so nobody, including us, can change the code under a user's stake or escrow. A logic change is a new deployment plus the migration in the repo (going to production); a parameter change is a governance call.
Every governance-owned contract uses two-step ownership: a transfer only nominates, and the new owner must accept, so a mistyped address cannot brick a contract. The owner after the handover is the Timelock, behind the Governor, so every parameter change is public for the delay before it lands.
The contracts that take money in carry an emergency pause with a guardian: the payments (new sessions, settlements, operator closes), staking (new stake, new delegations), the listing registry (new listings) and paid reviews (new requests). The guardian, a multisig that can act in minutes, can pause; only the owner can unpause, so a pause is a stop and never a seizure. What a pause never touches: a client reclaiming an idle session, an operator withdrawing what it earned, a delegator withdrawing after unbonding. Funds are not trapped by a pause.
Reentrancy guards on every function that moves value, SafeERC20 for every token transfer, EIP-712 vouchers bound to the chain, the contract and the session, cumulative amounts that only rise, fees capped at 100 percent in total, escrow per operator capped by its stake, bounded loops on every state-changing path.
Keys
| Key | Holds | Where |
|---|---|---|
| Deployer | Deploys, then hands over and renounces | An encrypted keystore (DEPLOYER_KEYSTORE_FILE), used once; never an environment variable on a server |
| Treasury and DAO | The supply, fees, parameters | A multisig; the Timelock in front of parameter changes |
| Guardian | Pause only | A multisig that can act in minutes |
| Operator (cold) | Stake, listings, withdrawals | The owner's machine; names a signer once |
| Signer (hot) | Settles, writes the node's address, proves identity | The node; cannot touch the stake |
| Relayers, facilitator, bundler | Gas only | Funded hot keys, one per instance, rate-limited |
The split between an operator's cold key and its node's hot signer is the validator pattern: a compromised node is worth its upstream keys and its transcripts, never its stake.
Before a deploy
forge testgreen, fuzz and invariant suites included; Slither clean at medium and above (slither.config.json, run in CI).- Sources verified on the explorer after the deploy:
npm run verify-sources. - The guardian set on every pausable contract and the handover done
(
npm run verify-deploychecks both). - Rate limits and in-flight caps on every public service, TLS everywhere, the private node on loopback.
When something goes wrong
- Pause. The guardian pauses the payments, and the staking and registry if the fault is there. Minutes, one transaction each. Announce it.
- Assess. What is wrong, what is at risk, what has already moved. The chain's events and the directory tell most of it; the nodes' ledgers and transcripts the rest.
- Protect exits. Reclaims, withdrawals and unbonding keep working through a pause by design; make sure people know they do.
- Fix. A parameter change goes through the Timelock. A code change is a new deployment and the migration, announced, with open sessions settling on the old contracts first.
- Unpause. The owner, through the Timelock, once the fix is live. Publish what happened.
Disclosure
Report vulnerabilities privately to the address on the site. A bug bounty follows the first public deployment. Prior review: findings and what held.
Known trade-offs
- The paid-review draw seeds on the hash of the block after the request. A block proposer can influence it within that block; a verifiable random function is the mainnet upgrade if paid reviews grow large enough to be worth steering.
- A pause stops settlements too, so an operator's earned-but-unsettled vouchers wait for the unpause. That is the price of being able to stop a faulty settlement path.