All docs

DWELL security notes

Status: design stage. This is a threat model and plan, not a claim that the system has been audited. No independent audit has occurred.

Assets to protect

  1. Treasury funds (fee shares, pool funding, reserve).
  2. Correctness of each epoch's scores and root.
  3. Holder claims (must be claimable by the right wallet only).
  4. Signer and operator keys.
  5. User trust and the site itself (phishing, front-end tampering).

Threat model

Threat Impact Mitigation Residual risk
Wrong or manipulated root published Wrong payouts Public snapshot, verifier CLI, signers verify before approving, 2-of-3 approval Collusion of two signers
Indexer bug or data gap Scores wrong Deterministic scorer, replay tests, dual data source cross check on balances Upstream data provider errors
Sybil splitting Pool gaming Per wallet tenure, transfer-in exclusion, minimum balance per slice Funded fresh wallets that buy normally still count; cost is real trading capital
Dust then load (tenure farming) Unfair multiplier Token weighted blending on buys (open decision, see TECHNICAL.md 3.1) Present until decided
Wash trading to inflate fees Pool funded by self-trading Fees are paid by the trader, so wash trading costs the fee; monitor for patterns Self-dealing that recovers the creator share while capturing pool share
Creator linked wallets Pool capture Creator wallet excluded; flagged clusters may be excluded by a documented policy Hard to prove links
Front-end compromise Users sign malicious transactions Pinned dependencies, subresource integrity, hosting access with MFA, claim transactions show amounts Supply chain risk
Phishing and fake sites Users lose funds Single canonical domain, public warnings User behavior
Distributor program risk Funds locked or lost Use an existing audited open source program; pin version; fund only per epoch Program is third party; any bug is outside our control
RPC or provider outage Delayed epochs Retry, second provider, publication can wait Delay only
Key compromise Loss of funds See key custody See below

Sybil resistance

Score is linear in token balance and tenure is per wallet. Splitting one balance across N wallets produces the same total score as holding it in one wallet at the same tenure, so there is no gain from splitting alone. The remaining gaming vectors are the buy blending question and creator or insider clusters. Both are tracked as open items.

Indexer disputes

Process:

  1. Anyone can run the verifier CLI on a published epoch.
  2. A mismatch or suspected error is reported through a public dispute channel with the epoch, wallet and evidence.
  3. The dispute is acknowledged within 24 hours and given a status: open, confirmed, rejected.
  4. If confirmed, the team publishes a restatement: a new epoch record linked to the original, showing who is under or overpaid. Corrections are funded from the reserve first. Published roots are never silently replaced.
  5. Every dispute and result is logged publicly.

Target: no dispute stays unresolved beyond 72 hours during the pilot (see ROADMAP.md).

Key custody

  • No private keys in the repository. Secrets scanning in CI.
  • Treasury is a Squads 2-of-3 multisig. Signers use separate hardware wallets held by separate people or locations.
  • The payer key used by services lives only in the .secrets/ directory on the operator machine and holds a small float, enough for network fees. It cannot move treasury funds.
  • Signers verify roots independently with the CLI before approving.
  • Signer rotation procedure and recovery plan documented before mainnet.
  • Access to hosting, database and RPC accounts requires MFA.
  • The founder holds one signer role (gate: see LEGAL-NOTES.md and MAINNET-READINESS.md for signer assignment).

Incident runbook

Severity levels:

  • Sev 1: funds at risk or wrong root already funded.
  • Sev 2: epoch delayed or claims failing for many users.
  • Sev 3: isolated problem, cosmetic or single user.

Sev 1 steps:

  1. Declare the incident, name an incident lead.
  2. Pause: stop publishing roots, stop new launches (kill switch).
  3. Do not approve any pending Squads proposal.
  4. Assess: which epochs, which funds, which wallets.
  5. If a wrong root is set but unfunded, replace before funding. If funded, follow the distributor's available recovery options and prepare a restatement.
  6. If a key is suspected compromised: rotate the signer through the multisig using the remaining honest signers, move funds if needed.
  7. Communicate on the status channel within 2 hours: what is known, what is paused, next update time. No speculation, no promises of compensation unless approved by the founder.
  8. After resolution, publish a postmortem within 7 days with timeline, root cause and fixes.

Sev 2 steps: acknowledge within 1 hour, post status, retry or fall back to the second provider, publish the delayed epoch when verified. Delays shift when payouts arrive; they do not remove entitlement.

Drills: run the Sev 1 tabletop and a wrong root drill on devnet before the pilot.

Disclosure

A security contact address and a responsible disclosure policy must exist before public launch. Bounty budget is a founder decision.