f3d2961b97
Some checks failed
CI/CD Pipeline / Lint and Format (push) Failing after 46s
CI/CD Pipeline / Terraform Validation (push) Failing after 35s
CI/CD Pipeline / Kubernetes Validation (push) Successful in 37s
Deploy ChainID 138 / Deploy ChainID 138 (push) Failing after 1m50s
HYBX OMNL TypeScript & anchor / token-aggregation build + reconcile artifact (push) Failing after 2m19s
Validation / validate-genesis (push) Successful in 51s
Validation / validate-terraform (push) Failing after 39s
Validation / validate-kubernetes (push) Failing after 10s
CI/CD Pipeline / Solidity Contracts (push) Failing after 12m56s
Validation / validate-smart-contracts (push) Failing after 12s
CI/CD Pipeline / Security Scanning (push) Failing after 15m52s
Validation / validate-security (push) Failing after 10m59s
Validation / validate-documentation (push) Failing after 17s
Validate Token List / validate (push) Failing after 30s
OMNL reconcile anchor / Run omnl:reconcile and upload artifacts (push) Failing after 26s
Verify Deployment / Verify Deployment (push) Failing after 56s
1.8 KiB
1.8 KiB
HYBX OMNL — threat model and audit scope
Trust boundaries
- On-chain policy (
PolicyMath,ComplianceCore) is deterministic given inputs(S0, S1, R)fromIERC20.totalSupplyandReserveCommitmentStore. - Economic truth of R depends on custodian attestation and operational security of signing keys — not on PMM or spot price oracles.
Threats and mitigations
| Threat | Impact | Mitigation |
|---|---|---|
Compromised RESERVE_COMMITTER key |
Fake reserves | Multisig / HSM, key rotation, monitoring on ReserveCommitted |
Compromised attestation signer set (commitReserveAttested) |
Forged threshold commits | Rotate isAttestationSigner, raise attestationThreshold, monitor lineAttestationNonce |
| Compromised CCIP lane | Wrong mirror updates | allowedSourceSelectors, replay protection on messageId |
| Malicious ERC-20 (inflated totalSupply) | False compliance | Register only audited tokens; avoid rebasing tokens without adapter |
| Governance capture | Parameter / role theft | Timelock, split roles (GUARDIAN, PAUSER), multi-sig admin |
| API layer spoofing | Misleading dashboard | API reads only from published ComplianceCore addresses; publish ABIs |
External audit scope (recommended)
contracts/hybx-omnl/*.sol— policy rounding, reentrancy (minimal external calls), access control.OMNLMirrorReceiver— decoding, version monotonicity, selector allowlist.- Operational: HSM usage for
commitReserve, CCIP operational runbooks.
Structured checklist: EXTERNAL_AUDIT_CHECKLIST.md.
Key ceremony (outline)
- Generate
RESERVE_COMMITTER/ admin keys in HSM; no plaintext long-lived prod keys in CI. - Document signer roster on-chain (
bytes32merkle root optional extension) for auditor parity.