Tracking issue for every open item, pending operational action, and planned hardening change disclosed in the STRIDE threat model (docs/threat-model.md v1.0) submitted to the SDF Soroban Security Audit Bank. Each line links the issue; the threat-model ID is in brackets.
Open items (threat model §4.1) and pending operational action (§4.2)
Planned hardening (from Section 3 treatments)
Backend (boundlessfi/boundless-nestjs)
Order of operations
Restore the upgrade timelock to 17,280 ledgers on both contracts (live escrow under a zero timelock) #123 Finish the 1.7.0 mainnet migration: run migrate_events + migrate on events, migrate on profile, record the apply #124 Small code changes before audit fieldwork: select_winners: use saturating arithmetic for the anchor index (Scout finding) #134 claim_milestone: record the claim before transferring, matching claim_prize #135 Make the profile calls in apply_to_bounty and claim_milestone best-effort (try_ variants) #128 process_cancel_batch: reject max_refunds == 0 #136 select_winners: reject duplicate recipients within a multi-release selection #130 Bind child op_ids to the authorizing address #129 Cap reputation_bump per award (events) and delta per call (profile) #133 submit: refuse writes to a slot once a selection exists; record last update time #131 Grant submissions are unreachable: add a grant application path or reject grants in submit explicitly #132 Align contracts/events/Cargo.toml version with contractmeta (1.6.0 → 1.7.0) #142
Design decisions to settle with the auditors: Recovery path when an accepted event manager's key is lost #125 process_cancel_batch: a refund transfer that cannot complete blocks the whole cancellation #126 start_cancel: extend the claimable-prize guard to multi-release awards with unpaid milestones #127 Dedicated validator role for crowdfunding milestone co-authorization (admin quorum is used today) #140
Process and observability: Runbook: verify the fee account holds a trustline before registering a token or rotating the fee account #141 Event schema: per-award, cancellation-started, and zero-refund events #138 unpause: extend time-based windows by the pause duration #139
When an item closes, update its status in the threat model so the document and the tracker agree.
Tracking issue for every open item, pending operational action, and planned hardening change disclosed in the STRIDE threat model (
docs/threat-model.mdv1.0) submitted to the SDF Soroban Security Audit Bank. Each line links the issue; the threat-model ID is in brackets.Open items (threat model §4.1) and pending operational action (§4.2)
Planned hardening (from Section 3 treatments)
Backend (boundlessfi/boundless-nestjs)
Order of operations
When an item closes, update its status in the threat model so the document and the tracker agree.