Contract verification matrix
What each Move module does, which behaviors are exercised, and where test evidence stops.
Trust Stack tests contracts at three different boundaries. Move tests execute the contract bytecode and prove expected state transitions or aborts. TypeScript tests exercise the exact builders, readers, event decoders, and reconciliation rules used by the dApp. Browser tests then verify that a person can reach each workflow, review a draft, connect a deterministic wallet, and receive actionable feedback on both desktop and mobile.
Those layers complement one another. A browser mock cannot prove Move conservation, and a Move test cannot prove that a labelled field remains usable on a phone.
Core package
The core package currently has 128 passing Move tests and 94.51% instruction coverage. Every value-bearing module has a successful lifecycle plus authorization, amount, time, replay, and custody tests appropriate to its state machine.
| Module | Public operation | Positive evidence | Adversarial and boundary evidence | Coverage |
|---|---|---|---|---|
foundation | version | Returns the package version | No signer, asset, or mutable state exists | 100.00% |
token_factory | create, mint, burn | Fixed and capped creation, creator minting, holder self-burn | Wrong creator, disabled capabilities, zero values, zero recipient, and cap enforcement | 89.88% |
fixed_lock | create, claim | Exact deposit and one-time beneficiary release | Early, wrong-beneficiary, duplicate, zero-value, dispatchable-asset, and issuer-capability cases | 96.31% |
vesting | create, claim | Cliff, linear, and stepped settlement with exact final remainder | Invalid schedules, wide arithmetic, early/duplicate/wrong-beneficiary claims, and hostile asset authority | 98.30% |
batch_distribution | send | Atomic distribution to the requested recipients | Empty, mismatched, oversized, duplicate, zero, overflowing, and dispatchable batches | 98.94% |
merkle_airdrop | create, claim, reclaim | Valid claims and post-deadline remainder recovery | Replay, recipient mismatch, invalid root/node/depth/window/allocation, duplicate reclaim, and vault isolation | 89.56% |
digital_asset_factory | create | One standard Digital Asset minted to its first owner | Empty identity/URI and zero-recipient rejection | 95.80% |
digital_asset_lock | create, claim | Exact owner-gated object custody and beneficiary release | Wrong owner/beneficiary, early/duplicate claim, retained transfer authority, and non-owner-gated assets | 95.18% |
payment_stream | create, claim, cancel | Accrual claims and exact cancel settlement | Wrong role, premature or repeated actions, invalid schedule/value, non-cancelable streams, and vault isolation | 93.55% |
staking_pool | create_pool, stake, claim, withdraw, reclaim_unallocated | Join-time reward accounting, repeated claims, withdrawal, and creator recovery | Wrong owner, early/duplicate/empty actions, live-stake recovery, denominator changes, and update-frequency neutrality | 96.02% |
Isolated packages
The Dexlyn V1 adapter is deliberately outside the core package. Its 9 tests exercise the isolated coin vault, exact release, pool-provenance guard, beneficiary authorization, timing, one-time claim, and zero-value boundaries. It has 87.17% instruction coverage. The thin public wrapper that calls Dexlyn's native router can only be completed against a registered testnet pool; the repository does not replace that external integration with a fake claim of coverage.
The fixed-supply test token has 5 passing tests and 94.90% coverage. They exercise one-time deployer initialization, exact supply, normal primary-store transfers, zero-recipient rejection, non-deployer rejection, and duplicate initialization.
What the browser suite proves
The browser suite covers every non-dynamic dApp route in Chromium and Pixel 7 emulation. It checks page status, headings, horizontal overflow, shared Shadcn controls, incomplete-draft feedback, grouped mobile navigation, deterministic StarKey connection, network recovery, and representative workflow transitions. Component integration tests then cover successful prepare, sign, finalize, event-match, and state-reread paths for every dApp operation without spending public testnet assets on each run.
Honest limits
Passing tests do not establish mainnet safety. The remaining external gates are a real registered Dexlyn LP lifecycle, independent review, a production asset-attestation policy, package-upgrade governance, and stronger proof-provider independence. These limits are release decisions, not lines that can be made green by weakening a test or inventing local chain evidence.