Audit status
Current internal review results, open risks, and release blockers.
As of August 29, 2026, Trust Stack remains an internally reviewed, testnet-only audit candidate. It has not completed the independent security review required for mainnet or meaningful-value assets.
Internal verification baseline
- Core Move package: 128 passing tests and 94.51% instruction coverage
- Isolated Dexlyn adapter: 9 passing tests and 87.17% instruction coverage
- Fixed-supply testnet fixture: 5 passing tests and 94.90% instruction coverage
- Shared TypeScript domain package: 120 passing tests in the current suite
- dApp: 159 passing component and domain tests in the current suite
- dApp browser E2E: 81 passing desktop/mobile scenarios, with one intentional desktop skip for the mobile-only navigation sheet; the separate marketing suite adds 10 passing scenarios
- Go controls include race-enabled tests, strict parsing, bounded HTTP behavior, and vulnerability scanning in CI
- deployment evidence records source commit, package transaction, ABI/bytecode hashes, and chain-ID-6 acceptance lifecycles
Coverage is evidence of exercised code, not a security score.
Resolved findings in the current candidate
| Severity | Finding | Resolution |
|---|---|---|
| High | Dexlyn dependency expanded the core trust boundary | Moved LP locking to a separately built/deployed adapter package |
| Medium | Staking reward rounding depended on interaction frequency | Added pool-level scaled remainder and regression coverage |
| Medium | Historical staking carry could cross a changed total-stake denominator | Scope the carry to one denominator and clear it before joins or withdrawals |
| Medium | Merkle proof replay across networks/packages | Added chain ID, package, module, campaign, asset, index, recipient, and amount domain binding |
| Medium | Partner limiter state could grow without bound | Authentication precedes allocation; limiter state is bounded |
| Medium | Cleartext remote RPC | Remote HTTP is rejected; only loopback development endpoints may use HTTP |
| Low | Accidental mainnet indexing | Runtime configuration accepts only chain ID 6 |
Open risks
- High: external Fungible/Digital Asset issuer capabilities need a production attestation or allowlist policy.
- High: compatible testnet package upgrade authority needs an independently reviewed mainnet disposition.
- Medium: Dexlyn upstream package and LP provenance remain third-party assumptions.
- Medium: public event proofs rely on one configured RPC linkage, not an independent light client or RPC quorum.
- Medium: partner resource quotas and retention need production policy before broad onboarding.
- Medium: the formal prover environment and authored specifications are not yet a meaningful verification claim.
- Medium: a real positive Dexlyn LP lifecycle remains a testnet integration gate.
The completed internal review covers every source-controlled Move module and test. Its detailed finding evidence and module-by-module disposition live in the repository security report. This page must be updated when source, deployment identity, or external audit evidence changes.