# Threat Model — {protocol / client name} | | | | ------------------- | ------------------------------------------------- | | **Audit #** | audit_{n} | | **Commit** | `{full 40-char SHA}` | | **Built by** | {threat-modeler agent / human-in-loop} | | **Mode** | {auto / interactive / bootstrap / bootstrap → interview} | | **Source** | code + `worksheets/context/*` + `intake.md` §6 {+ `bootstrap/` — see §6} | --- ## 1. Asset Inventory (Crown Jewels) | Asset | Class | Where it lives (account / PDA) | Defined / held @ | Worst-case if compromised | | ----- | ----- | ------------------------------ | ---------------- | ------------------------- | | {Vault balance} | Funds | {`vault_token_account`, PDA `["vault", authority]`} | {`state.rs#L120`} | {total TVL drained} | | {Upgrade authority} | Authority | {program upgrade authority} | {deploy config / `Anchor.toml`} | {arbitrary code, full compromise} | | {Admin role} | Authority | {`config.admin`} | {`state.rs#L44`} | {params/pause abused} | | {Oracle price} | Data | {`price_feed` account} | {`deposit.rs#L61`} | {mispriced mint/redeem} | | {Share supply} | Data | {`shares_mint.supply`} | {`state.rs#L88`} | {accounting broken, dilution} | | {…} | {…} | {…} | {…} | {…} | --- ## 2. Actor × Capability Table | Actor | Trust level | Can do (privileges) → instruction @ | Must NOT be able to | Trust assumption | | ----- | ----------- | ----------------------------------- | ------------------- | ---------------- | | **Permissionless user** | Untrusted | {call `deposit` @ `deposit.rs#L20`} | {move another user's funds; mint shares without deposit} | none — the attacker | | **LP / depositor** | Untrusted | {`deposit`, `withdraw` own @ …} | {withdraw more than deposited; withdraw others'} | none | | **Keeper / crank** | Semi-trusted | {`update_index` @ `crank.rs#L15`} | {reorder/withhold to grief; feed stale index} | assumed live & honest-ordering | | **Admin / manager** | Trusted | {`set_fee`, `pause` @ `admin.rs#L…`} | {drain vault; change others' balances directly} | assumed honest & key-secure | | **Upgrade authority** | Trusted | {upgrade program} | {— (out of threat model; see §3)} | assumed honest, key-secure, ideally multisig+timelock | | **Oracle** | Trusted-external | {supply price → read @ `deposit.rs#L61`} | {report price outside enforced confidence/staleness bounds} | assumed accurate & live within bounds | | **CPI callee** | {trusted (hardcoded) / untrusted (caller-supplied)} | {receives invoke @ …} | {re-enter before guarded state is written} | {validated target / adversarial} | > A capability an actor holds that overlaps its "Must NOT" column is a candidate > finding. A "Must NOT" that no guard enforces is where §4 attacker goals aim. --- ## 3. Trust-Boundary Map | # | Boundary crossing | Kind | @ file:line | What crosses | Validated? | | - | ----------------- | ---- | ----------- | ------------ | ---------- | | TB-1 | {program → SPL Token `transfer_checked`} | CPI | {`withdraw.rs#L88`} | {PDA-signed authority} | {target hardcoded ✓} | | TB-2 | {caller-supplied `destination` account} | Account | {`withdraw.rs#L34`} | {where funds land} | {owner/mint check? cite or ✗} | | TB-3 | {`amount` arg → subtraction} | Input | {`withdraw.rs#L52`} | {value bound} | {range-checked? cite or ✗} | | TB-4 | {`remaining_accounts[]`} | Input | {`batch.rs#L20`} | {arbitrary account set} | {count/type check? cite or ✗} | | TB-5 | {CPI to caller-supplied program} | CPI | {`route.rs#L40`} | {control flow → untrusted code} | {program-id validated? cite or ✗} | | {…} | {…} | {…} | {…} | {…} | {…} | --- ## 4. Attacker Goals to Test | ID | Goal (attacker wants to…) | Target asset (§1) | Enabled by (§2 must-not / §3 crossing) | Maps to | Evidence | | -- | ------------------------- | ----------------- | -------------------------------------- | ------- | -------- | | AG-1 | {Drain a vault through a re-targeted `has_one`} | {Vault balance} | {TB-2; withdraw "must NOT pay a non-owner"} | {checklist 01, KV-004} | {target@1a2b3c4 (REMOVED `has_one = authority`), prior report F-3} | | AG-2 | {Drain a vault without owning it} | {Vault balance} | {TB-2 unvalidated destination; user "must NOT move others' funds"} | {checklist 01 (account validation), KV access-control} | | | AG-3 | {Mint shares without depositing} | {Share supply} | {deposit "must NOT credit without transfer"} | {checklist 06 (economic), KV first-depositor} | | | AG-4 | {Reorder crank to extract value} | {Oracle/index data} | {keeper ordering; TB-1} | {checklist 06, KV oracle/MEV} | | | AG-5 | {Escalate to admin via reinit} | {Admin role} | {`init_if_needed` overwrites authority} | {checklist 01, KV-014 reinit} | | | AG-6 | {Brick a critical path (DoS)} | {Withdrawal availability} | {TB-3/TB-4 unbounded input} | {checklist 03/07, KV DoS} | | | AG-7 | {Re-enter before state write} | {Vault balance} | {TB-5 untrusted CPI callee} | {KV-003 reentrancy (untrusted callee)} | | | {…} | {…} | {…} | {…} | {…} | {…} | **Leads** — code elsewhere with the same shape as an evidenced bug. Where to look, not evidence. - {AG-1: `withdraw_v2.rs#L41` — same account struct, same constraint} --- ## 5. Notes & Unknowns - {UNKNOWN — {what} @ {file:line} — needs manual review} - {owner-stated, unverified — {claim} — affects {§2 cell / AG-n} — verify by {check}} - {UNMAPPED — {evidence ref} — no matching surface at this commit} - {retired seed row {id} — {reason}} --- ## 6. Provenance & Inputs | Input | Kind | Reference (path or URL @ commit, sha256) | Read via | Status | | ----- | ---- | ---------------------------------------- | -------- | ------ | | {In-scope code} | code | `{repo} @ {40-char SHA}` | {Read / Grep} | {used} | | {Git history} | history | `bootstrap/history.md` (pin `{SHA}`) | {collector} | {used / shallow — incomplete} | | {Fork parent} | parent | `{https URL or path} @ {SHA}`, fork point `{SHA}` | {collector} | {used / detected, not cloned / none} | | {Prior audit} | prior-audit | `{file} sha256:{…}` | {pdftotext / Read / Markdown} | {used / unreadable — {why}} | | {…} | {…} | {…} | {…} | {…} |