Give up authority rather than promise not to use it
Mint authority is revoked. Freeze authority is never set. A capability that does not exist cannot be misused, stolen or subpoenaed.
Assurance
Security
Most token failures are not exotic. They are a retained authority, an unchecked account, or a rounding path nobody tested at the boundary.
No audit has been performed. No external review has taken place, because there is not yet a program stable enough to review. An external audit is a prerequisite for mainnet, not a formality after it.
Principles
Four things that do most of the work
The backend never holds mint authority
Off-chain systems compute eligibility. They cannot create supply and cannot move funds. A full compromise of the backend must not become a supply event.
Custom code stays out of the transfer path
Transfers are ordinary SPL Token instructions. The custom programs govern only when tokens may leave a vault.
Least privilege on every vault
Six vaults with distinct controllers, so a mistake or compromise in one area is bounded to that area.
Testing
What must be documented and tested
Supply invariant
PLANNEDTotal supply never exceeds the minted maximum. Enforced mechanically once mint authority is revoked, not by policy.
Unauthorised mint
PLANNEDNo path to new supply survives genesis. Tested by attempting a mint against a revoked authority.
Unauthorised treasury withdrawal
PLANNEDNo single key can move vault funds. Tested against every signer subset below threshold.
Duplicate reward claims
PLANNEDA deterministic claim PDA per claimant per epoch makes a second claim fail on account initialisation.
Replay attacks
PLANNEDEpoch identity is part of PDA derivation, so a proof valid in one epoch is invalid in another.
Incorrect mint attacks
PLANNEDEvery instruction validates that token accounts belong to the CGW mint specifically.
Account substitution
PLANNEDAll accounts are checked for owner, mint and PDA derivation rather than trusted positionally.
PDA validation
PLANNEDSeeds are re-derived and compared on every instruction; no PDA is accepted as passed.
Arithmetic rounding
PLANNEDInteger maths throughout, floor division, remainder settled on the final period. No float in any release path.
Vesting boundaries
PLANNEDBehaviour asserted at month 0, immediately before the cliff, at the cliff, and past the end of the duration.
Timestamp boundaries
PLANNEDClock manipulation within validator tolerance must not release more than the schedule allows.
Signer checks
PLANNEDEvery privileged instruction requires an explicit signer check, never an implied one.
Ownership checks
PLANNEDProgram ownership of every passed account is validated before deserialisation.
Malicious CPI
PLANNEDNo instruction assumes a caller is honest; CPI callers are treated as adversarial.
Program upgrade authority
PLANNEDHeld by multisig, moving to timelock and then immutability. Its current holder is always published.
Authority revocation
PLANNEDGenesis revocation steps are individually verified on-chain before the ceremony proceeds.
Happy-path tests are not evidence. Each item above is stated as an attack to attempt, not a behaviour to confirm. Programs are tested on a local validator against adversarial ordering, boundary timestamps and substituted accounts before any devnet deployment.
Secrets
Key and secret handling
No keys in the repository
No private key, keypair file or seed phrase is ever committed. Deployment keys live in hardware wallets and secret stores only.
No secrets in output
No process in this project prints a key. Environment files are never read, copied or logged.
Hardware custody for signers
Treasury signers use hardware wallets. The recovery signer exists specifically so losing one key is not terminal.
Audit
Audit strategy
Sequence
PLANNED- Internal review against the invariants above
- Property and fuzz testing on a local validator
- Devnet deployment and public testing
- External audit by an independent firm
- Remediation and re-review
- Publication of the full report, including unfixed findings
Commitment
PLANNEDThe audit report will be published in full, including findings the project chose not to fix and the reasoning for that choice. A summary that mentions only resolved issues is marketing, not assurance.
See the roadmap for where this sits relative to any mainnet step.