Security Model
Consensus threats
| Threat | Outcome | Why |
|---|---|---|
| Bot farm with enormous hashrate | Earns more USDn from a bounded pool; cannot reorg; from year six can win elected seats one per year, with a bond, never enough to finalise alone before year 12 | Mining has no consensus role |
| Up to 3 validators offline or faulty | Chain continues, finality continues (7 remain) | 7-of-10 quorum |
| 4–6 validators offline | Blocks continue, finality stalls until quorum returns | Liveness preferred over halting; finalized tag tells the truth |
| 4 validators collude to double-sign | Two conflicting attested blocks would exist; provable by the two signatures; slashable | Safety needs 2q − 10 ≥ f + 1 |
| 7+ validators collude (the company itself, years 1–8) | Full control of block production and censorship | This is the accepted trade-off of "validators have overriding power". Mitigations are transparency and the genesis-fixed decay |
| Reorg below finality | Impossible: nodes refuse conflicting headers | Rule, not probability |
| Clock manipulation | Blocks more than 2 s ahead are rejected; validators run NTP |
Economic threats
| Threat | Mitigation |
|---|---|
| Free state bloat | Base fee floor of 1,000 gwei; 30M gas per block |
| Proposer keeps more than 10% of fees | State root mismatch; block rejected by all nodes |
| Carbon Fund drained | Withdrawals only to the purchase process, 7-day timelock, purpose on-chain (mainnet contract) |
| USDn minted without backing | Mint requires 7 validator attestations of a real deposit; daily cap; pause switch (mainnet design). On testnet USDn is test money |
| CDRT minted without tonnes | Mint events carry the vault deposit reference; daily NAV oracle; auditor access |
Node hardening (inherited from the AgentChain audit)
- Sensitive RPC namespaces (
agent,personal,miner,admin,debug) are refused on non-loopback addresses unless explicitly allowed. - Agent wallet passwords are derived from a per-node secret; wallets survive restarts; keys never appear in RPC responses.
- Genesis is compiled in and hash-pinned by a test.
- Graceful shutdown over RPC (
agent_shutdown); optional per-block state persistence (--gcmode archive). - RPC batch limit, header-query bounds, secp256k1 point validation, ECIES checks.
- Every engine change is exercised on a ten-validator end-to-end run before release; unit tests cover the genesis pin and the share rules, and broader engine tests are on the roadmap (phase 5).
What is not yet done
- External audit of the consensus engine and the system contracts (planned before mainnet).
- Slashing and downtime accounting (with the ValidatorSet contract).
- Share-flood rate limiting: shares are verified before gossip and capped per block and per pool, but a peer sending streams of invalid shares is not yet penalised.
- A "do not seal out of turn with fewer than quorum − 1 peers" guard for the first minute after start.
Reporting
Security issues: see SECURITY.md in the repository. Please do not open public issues for exploitable findings.