141 lines
7.7 KiB
Markdown
141 lines
7.7 KiB
Markdown
# cp138 — Pre-launch deep-deep audit (94-task plan)
|
|
|
|
Started: 2026-05-25. Triggered by Ken's "do a full deep deep on absolutely
|
|
everything" directive after cp137 closed.
|
|
|
|
Numbers in `[T-NN]` brackets are task IDs. Tasks marked **DONE** below
|
|
have been completed and findings logged in `FINDINGS.md`.
|
|
|
|
## Phase A — Hostile-chain-op review (17 tasks)
|
|
Per Ken's "what if every op was hostile" sweep. Re-walk each handler with
|
|
fresh eyes, looking for: missing input validation, unchecked actor
|
|
authority, replay/race, integer overflow, time-of-check-time-of-use,
|
|
schema-deviation bypasses, type confusion via JSON, prototype pollution.
|
|
|
|
- [T-01] `block.ts` handler — block-tip-tracking hostile review
|
|
- [T-02] `chat.ts` handler — `morphit_chat_v1` hostile review
|
|
- [T-03] `chatIdentity.ts` handler — `morphit_chat_identity_v1` hostile review
|
|
- [T-04] `chatRead.ts` handler — `morphit_chat_read_v1` hostile review
|
|
- [T-05] `featureBid.ts` handler — `morphit_featurebid_v1` hostile review
|
|
- [T-06] `feedback.ts` handler — `morphit_feedback_v1` hostile review
|
|
- [T-07] `feedbackResponse.ts` handler — `morphit_feedback_response_v1` hostile review
|
|
- [T-08] `operatorBlock.ts` handler — `morphit_operator_block_v1` hostile review
|
|
- [T-09] `operatorPaymentMethod.ts` handler — `morphit_operator_payment_method_v1` hostile review
|
|
- [T-10] `operatorRegister.ts` handler — `morphit_operator_register_v1` hostile review
|
|
- [T-11] `order.ts` handler — `morphit_order_v1` hostile review
|
|
- [T-12] `orderCancel.ts` handler — `morphit_order_cancel_v1` hostile review
|
|
- [T-13] `orderReplace.ts` handler — `morphit_order_replace_v1` hostile review
|
|
- [T-14] `profile.ts` handler — `morphit_profile_v1` hostile review
|
|
- [T-15] `release.ts` handler — `morphit_release_v1` hostile review
|
|
- [T-16] `strangerFee.ts` handler — `morphit_stranger_fee_v1` hostile review
|
|
- [T-17] Dispatcher — `dispatcher.ts` cross-op invariants (op-name spoofing, idempotency, ordering)
|
|
|
|
## Phase B — HTTP/API surface hostile review (8 tasks)
|
|
Each indexer + relay HTTP endpoint reviewed for: auth, rate limit, body
|
|
cap, content-type, CORS, CSRF (if cookie-based), open redirect, SSRF,
|
|
SQL injection, path traversal, ReDoS in regex params, leaks via error.
|
|
|
|
- [T-18] Indexer public `/v1/*` endpoints (orderbook, orders, profile, instance, etc.)
|
|
- [T-19] Relay HTTP — public endpoints (altcha, posting, blurt RPC proxy)
|
|
- [T-20] Relay HTTP — authenticated endpoints
|
|
- [T-21] Server-side rate-limit + body-cap + timeout consistency
|
|
- [T-22] Error message leakage — any 500 surfacing stack/secret/path/host?
|
|
- [T-23] Internal endpoints' auth (health, metrics)
|
|
- [T-24] CORS posture review
|
|
- [T-25] Open-redirect surface (any param that ends up in a `Location` header or `<a href>`)
|
|
|
|
## Phase C — Crypto & secrets review (12 tasks)
|
|
- [T-26] Argon2id parameters (memory, iterations, parallelism) vs OWASP recommended floor
|
|
- [T-27] PBKDF2 / scrypt usage anywhere — review params
|
|
- [T-28] AEAD nonce/IV uniqueness — any reuse risk?
|
|
- [T-29] MAC vs encrypt — constant-time compare everywhere?
|
|
- [T-30] Secret storage — any secret ever written to log/stderr/error?
|
|
- [T-31] Hardcoded secrets / placeholders in repo (beyond known `CHANGE_ME`)
|
|
- [T-32] Crypto primitive choices (SHA-1, MD5, etc — should be zero use except for non-security)
|
|
- [T-33] Key derivation paths (BIP-32, BIP-39) — validation, normalization
|
|
- [T-34] Random number sources — only `crypto.getRandomValues` / `crypto.randomBytes`?
|
|
- [T-35] Constant-time comparisons everywhere needed
|
|
- [T-36] Forward secrecy posture — keystore + chat
|
|
- [T-37] YubiKey HMAC-SHA1 challenge response — known-weak protocol, mitigations
|
|
|
|
## Phase D — Database & persistence review (10 tasks)
|
|
- [T-38] DB schema dead-field sweep (columns never written or never read)
|
|
- [T-39] DB schema migration linearization (no gaps, no reorders since launch — we're pre-launch so should be fine)
|
|
- [T-40] Index coverage on hot queries (orderbook, profile, conversations)
|
|
- [T-41] FK integrity (referential, cascade-delete posture)
|
|
- [T-42] Race conditions in upsert/transaction paths
|
|
- [T-43] SQL injection — every dynamic query reviewed
|
|
- [T-44] LIKE-pattern injection (user controls a LIKE pattern?)
|
|
- [T-45] Connection pool exhaustion under load
|
|
- [T-46] Long-running query timeouts
|
|
- [T-47] Locks held across I/O
|
|
|
|
## Phase E — Frontend security review (10 tasks)
|
|
- [T-48] XSS — chat message rendering, address pills, link-pills, code blocks
|
|
- [T-49] CSP — adequate `default-src`, `script-src`, `style-src`, `connect-src`, `frame-ancestors`
|
|
- [T-50] SRI — external CDN scripts (any?)
|
|
- [T-51] PostMessage handlers — origin checks
|
|
- [T-52] Local/Session storage — any secret stored?
|
|
- [T-53] IndexedDB — any secret stored unencrypted?
|
|
- [T-54] Service worker — caching of authenticated content?
|
|
- [T-55] Tor/I2P metadata leak surfaces (assets loaded from external CDNs)
|
|
- [T-56] Auto-submit forms / click-jacking — frame-ancestors set?
|
|
- [T-57] localStorage cleared on logout?
|
|
|
|
## Phase F — Static code-quality sweep (10 tasks)
|
|
- [T-58] Dead code / unused exports
|
|
- [T-59] Orphan files (files unreferenced by anything)
|
|
- [T-60] TODO / FIXME / XXX backlog count and triage
|
|
- [T-61] Inconsistent error handling (some throws, some returns null)
|
|
- [T-62] Missing `Promise.allSettled` where appropriate
|
|
- [T-63] Unbounded `await` in loops (rate-limit risk)
|
|
- [T-64] `setTimeout` / `setInterval` without cleanup (memory leak risk)
|
|
- [T-65] Closures holding large objects in scope
|
|
- [T-66] `JSON.parse` of untrusted input without try/catch
|
|
- [T-67] Any non-strict equality (`==` vs `===`)
|
|
|
|
## Phase G — Regex accuracy (5 tasks)
|
|
- [T-68] Every regex in the codebase reviewed for ReDoS
|
|
- [T-69] Every regex reviewed for anchoring (`^` / `$` to prevent partial-match bypass)
|
|
- [T-70] Every regex reviewed for Unicode handling
|
|
- [T-71] Address-validation regexes vs canonical specs
|
|
- [T-72] TXID-validation regexes vs canonical specs
|
|
|
|
## Phase H — Smokes + tests audit (7 tasks)
|
|
- [T-73] Smoke drift — any smoke asserting an outdated invariant?
|
|
- [T-74] Smoke staleness — any smoke that hasn't fired in N audits?
|
|
- [T-75] Test coverage gaps — areas of code with low/no test
|
|
- [T-76] Vitest skipped tests — why? Are they real or stale?
|
|
- [T-77] Smoke tamper-test rotation — do all critical smokes have a tamper-test in the smoke comment?
|
|
- [T-78] Property-based testing surface — could fast-check find more?
|
|
- [T-79] Mutation testing — would a mutant survive?
|
|
|
|
## Phase I — Documentation accuracy (8 tasks)
|
|
- [T-80] README.md accuracy (top-level)
|
|
- [T-81] OPERATIONS.md accuracy (every step works as documented)
|
|
- [T-82] RUN-A-MORPHIT-NODE.md accuracy (every step works as documented)
|
|
- [T-83] FAQ accuracy (every Q has an accurate A vs current code)
|
|
- [T-84] ADR accuracy (every Decision still reflects current code)
|
|
- [T-85] Broken intra-doc references (link targets exist)
|
|
- [T-86] SECURITY.md accuracy + disclosure process
|
|
- [T-87] PRIVACY.md / METADATA-LEAK-CATALOG.md accuracy
|
|
|
|
## Phase J — Wiring & i18n drift (5 tasks)
|
|
- [T-88] Locale-key orphans (keys defined but never referenced)
|
|
- [T-89] Code-referenced i18n keys missing from locale files
|
|
- [T-90] Locale parity (already done; re-verify)
|
|
- [T-91] Component wiring (any component imported but never rendered)
|
|
- [T-92] Route wiring (any route registered but unreachable, or vice versa)
|
|
|
|
## Phase K — Failover/fallback completeness (2 tasks)
|
|
- [T-93] Every external dependency (RPC, indexer, relay, image-gen) has a fallback path
|
|
- [T-94] Every user-facing error has an actionable next step (never "wtf is going on?")
|
|
|
|
---
|
|
|
|
## Working notes
|
|
|
|
- Sandbox-only constraints: no DAST, no fuzzing of live targets, no real
|
|
YubiKey hardware. All findings via source-code review + static analysis.
|
|
- Each finding goes into `FINDINGS.md` with severity + fix-status.
|
|
- All fixes ship in cp138.
|