# Threat model Status: pre-audit design candidate. This document describes intended controls; it is not an audit report or a security guarantee. ## Assets and invariants Protected assets are the buyer's allowlisted stablecoin payment, the provider's stablecoin bond, immutable role/term/digest/deadline records, and deterministic terminal outcomes. The principal invariants are: 1. Only the buyer can fund, accept, or challenge its agreement. 2. Only the named provider can bond and submit evidence. 3. Only the named resolver can decide a live challenge. 4. No administrator, upgrade signer, resolver, or unrelated account can directly withdraw a live vault balance. 5. A payment vault and bond vault belong to one agreement and one mint only. 6. A state transition can execute once and increments a monotonic nonce. 7. Every reachable non-terminal state has a time-bounded or role-driven exit. 8. Pausing new exposure cannot disable exits for existing agreements. 9. Checked arithmetic is used for IDs, transition nonces, and derived deadlines. 10. A resolution records a commitment supplied by the resolver; the protocol never labels that commitment as objectively true. ## Trust assumptions - Solana consensus, runtime, system program, and legacy SPL Token program behave according to their audited implementations. - The allowlisted stablecoin issuer may still mint, freeze, blacklist, upgrade off-chain controls, or lose its peg. The escrow cannot remove issuer risk. - Buyer and provider independently assess their resolver before activation. A resolver can make a dishonest decision while its deadline remains open. - Solana's Clock sysvar is sufficiently accurate for multi-minute/day deadlines, but is not wall-clock exact. - Client software produces and verifies the documented canonical digest format. - Upgrade authority is an extremely privileged operational role even though the current source has no admin withdrawal. A malicious upgrade can change all rules. Front ends, RPC nodes, indexers, evidence hosts, and keepers are treated as untrusted and replaceable. Users must be able to reconstruct state directly from chain data and the reviewed IDL. ## Threats and controls ### Account substitution and vault confusion Attack: pass another agreement, mint, vault, or payout account to redirect funds. Controls: PDA seed verification, stored bumps, `has_one` role/mint/payout checks, legacy Token account owner/mint constraints, agreement authority constraints, and canonical associated token payout accounts fixed at creation. ### State replay and account recreation Attack: repeat release/refund, rewrite evidence, or recreate a closed agreement at the same PDA. Controls: exact-state guards, write-once non-zero digests, checked transition nonce, terminal states, drained vaults, and a persistent per-buyer monotonic sequence PDA that is never closed. Sequence overflow fails closed. ### Arithmetic and decimal confusion Attack: overflow amount/deadline math or substitute a mint with different decimals. Controls: positive `u64` obligations, checked additions, bounded `i64` periods, `transfer_checked`, mint-policy decimal snapshots, and mint equality checks. Values are base units; the program never converts to dollars. ### Malicious token behavior Attack: transfer hooks, transfer fees, withheld fees, rebasing, or arbitrary callback behavior alters escrow accounting. Controls: only the legacy SPL Token program is accepted. Token-2022 is rejected. Only administrator-created mint-policy PDAs permit new agreements. Residual risk: a legacy stablecoin issuer can freeze accounts or depeg. A frozen vault can prevent exit despite correct escrow code. Operations need issuer-risk monitoring, conservative allowlisting, clear disclosure, and an incident plan; the program must not add an admin seizure bypass disguised as recovery. ### Direct vault donations and griefing Attack: send one extra token directly to a vault so an exact-balance close fails. Controls: obligations require `balance >= expected`, and terminal paths drain the entire balance to the deterministic recipient before close. Direct donations can enrich that recipient but cannot select a new recipient or trap the vault. ### Resolver censorship or corruption Attack: resolver releases to a dishonest provider, refunds a dishonest buyer, or does nothing. Controls: provider activation consents to the immutable named resolver; resolution is binary and digest-committed; resolver silence has a deterministic timeout that returns payment to buyer and bond to provider. This neutral timeout does not pretend to determine fault. Residual risk: a live resolver decision is trusted human/institutional judgment. Future quorum resolution would be a separate audited version, not an implied oracle in this one. ### Evidence tampering, unavailability, and privacy Attack: mutate evidence, hash ambiguous bytes, remove off-chain content, or put personal data directly on-chain. Controls: 32-byte write-once commitments and events. Clients must use a versioned canonical encoding and independently retain the committed material. Residual risk: hashes prove byte equality only—not truth, authorship, timing, or availability. Low-entropy/private content can be guessed from its hash. Evidence storage, encryption, access control, and retention are off-chain responsibilities. ### Deadline manipulation and congestion Attack: exploit exact-boundary ambiguity or network congestion to miss an action. Controls: action deadlines are inclusive; timeouts require `now > deadline`; creation enforces ordered, bounded deadlines and minimum periods. Clients should submit well before a deadline and price priority fees appropriately. Residual risk: sustained Solana unavailability can prevent every party from transacting. No on-chain program can guarantee an exit during chain halt. ### Emergency pause abuse Attack: administrator pauses after deposits and traps funds. Controls: pause checks exist only on create, fund, and activate. It does not gate evidence, acceptance, challenge, resolution, timeout, distribution, or close. Residual risk: pausing between payment funding and provider activation blocks activation until unpaused; after the immutable activation deadline, payment can be refunded permissionlessly. ### Initialization and administrator takeover Attack: initialize the global config before the intended owner, or rotate admin to an unusable key. Controls: initialization requires the hard-coded disclosed bootstrap key. Admin rotation is two-step and the proposed key must sign acceptance. The config starts paused. Residual risk: bootstrap/admin key compromise permits pause and allowlist abuse. It does not permit withdrawal in this version, but program upgrade authority is more powerful. Production roles should be independent disclosed multisigs. ### Upgrade and supply-chain compromise Attack: deploy a binary that differs from reviewed source, compromise CI, or use upgrade authority to replace safe logic. Controls required before mainnet: pinned toolchains, locked dependencies, reproducible/verifiable build, published IDL and hashes, independent audit, multisig upgrade authority, timelock/notice policy where practical, and monitoring of ProgramData/authority changes. These controls are operational deployment gates; the source alone cannot enforce how the Solana loader authority is held. ## Out-of-scope and residual risks - Identity, sanctions, consumer protection, licensing, tax, and jurisdictional restrictions. - PVTY minting, token sale, price promises, SOL custody, swaps, liquidity, and market manipulation. - Objective verification of real-world work. - Front-end wallet safety, compromised browser extensions, phishing, RPC censorship, or incorrect transaction simulation. - Economic suitability of payment/bond sizes and resolver incentives. - Stablecoin insolvency, blacklist, freeze, or depeg. - Unknown vulnerabilities until independent review and adversarial testing.