docs: surface known trust boundaries in Vault, MultiToken, Dripper - #35
Draft
alejoamiras wants to merge 1 commit into
Draft
docs: surface known trust boundaries in Vault, MultiToken, Dripper#35alejoamiras wants to merge 1 commit into
alejoamiras wants to merge 1 commit into
Conversation
This was referenced Aug 19, 2026
Documentation follow-ups from the 2026-08 security audit. No contract logic changes. - Vault (main.nr): a prominent block comment at the top records that the ~15 `Order matters: … reentrancy` orderings are necessary but NOT sufficient — they do not hold when the asset or shares token has an ARC-403 hook, because the hook runs inside the transfer before the balance moves (audit F-001/F-002). The recurring inline phrase "to neutralize ARC-403 reentrancy" asserted a guarantee the code does not provide; corrected to point at that note. - MultiToken (README): add a status warning. It was the only token contract with no per-file caveat, yet it carries the commitment trust-model issue (a commitment binds neither id nor amount, so it is not a payment guarantee). Kept severity-accurate: it references the repo-wide unaudited status rather than implying it is as unfinished as the Vault. - Dripper (README): the existing "dev/testing only" note did not name the mechanism. Sharpened to state it is an uncapped, permissionless minter whose sole safety boundary is never being a valuable token's minter (audit F-006). Validated: aztec-nargo fmt --check clean, aztec compile OK.
alejoamiras
force-pushed
the
stack/closeout-warnings
branch
from
August 19, 2026 16:16
decb90a to
441e309
Compare
Benchmark Comparison
Contract: escrow
Contract: logic
Contract: multitoken
Contract: nft
Contract: token
Contract: vault
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only. No contract logic changes.
Vault — the ordering comments asserted a guarantee the code does not provide
main.nrcarries ~15// Order matters: … to neutralize ARC-403 reentrancycomments. That reasoning holds only if a token transfer is indivisible. It isn't: when the asset or shares token has an ARC-403 hook, the hook runs inside the transfer, before the balance moves, so it observes the vault mid-operation — the exact state the ordering exists to exclude (audit F-001/F-002).Added one authoritative block comment at the top of the contract, and corrected the recurring inline phrase (16 sites) from "to neutralize ARC-403 reentrancy" to "to order effects safely (necessary but not sufficient against a hooked token — see the note at the top)". The two
enqueue settlement first…comments were left as-is: they describetotal_supplyordering, not a reentrancy guarantee, and are accurate.MultiToken — status warning
It had no per-file caveat while carrying the commitment trust-model issue (a commitment binds neither id nor amount, so it is not a payment guarantee).
Deliberately severity-accurate: it references the repo-wide unaudited status and points at the trust model, rather than copying the Vault's "not production-ready" language. Token and NFT also have no per-file banner — a Vault-style warning here would wrongly rank MultiToken below its clean siblings.
Dripper — name the mechanism
The existing "development and testing only" note didn't say why it matters. Now states it is an uncapped, permissionless minter whose only safety boundary is never being granted
minteron a token that holds real value (audit F-006).Validation
aztec-nargo fmt --checkclean ·aztec compileOK.