Security model

Trust Stack's primary objective is narrow: for every funded position, assets leave its vault only for the immutable beneficiary or an explicitly selected authority, under the amount, time, cancellation, and recovery rules shown before funding.

The current release is a testnet audit candidate. Passing internal tests and high coverage do not prove the absence of vulnerabilities.

Assets protected

• Fungible Asset balances in locks, schedules, campaigns, streams, and staking vaults
• Digital Assets and Dexlyn LP positions
• beneficiary, recipient, token, schedule, and campaign-root integrity
• package and adapter identity
• wallet transaction intent
• event proof and indexed record integrity
• partner credentials and webhook signing secrets

Core invariants

Conservation

For one position:

received = vault balance + claimed + authorized returned remainder

No action may create value, lose a funded remainder, or move another position's asset. A failed transfer must not advance accounting.

Claim bounds

claimed ≤ vested or unlocked ≤ received. Claims cannot replay; the final eligible action transfers the exact remainder. Terminal positions cannot reopen.

Time

Move uses chain time. Start, cliff, unlock, end, and reclaim ordering is validated, with boundary tests at exact timestamps and immediately before them.

Authority

Signers are checked against immutable position fields. A global protocol signer, frontend operator, indexer, or automation service has no general vault-withdrawal path.

Threats in scope

• malicious creators, beneficiaries, and replaying claimants;
• compromised frontend, DNS, dependency, or deployment registry;
• adversarial Fungible Assets with dispatch hooks;
• retained issuer capabilities outside a vault;
• counterfeit or upgraded DEX packages and LP types;
• stale or faulty RPC/indexer data;
• arithmetic, rounding, object-isolation, or package-address regressions;
• partner API abuse, webhook SSRF, secret disclosure, and resource exhaustion.

Operational rule

The UI may improve comprehension but cannot weaken Move authorization. The indexer may improve discovery but cannot define current claimability. Automation may improve timing but cannot become the only withdrawal path.