Security

The canonical version of this page is SECURITY.md in the repository. The short version:

What an attacker cannot do

Each of these is enforced in the program and demonstrated in scripts/src/e2e.ts:

• Forge an attestation. Signatures are verified by Solana's ed25519 precompile, and the program checks the precompile instruction's own offsets so the verified bytes must be the bytes it reads.
• Replay one. Nonces are strictly increasing and burned on issue.
• Redirect a payout. The first claim binds the destination wallet.
• Inflate a payout. The attestation carries no amount.
• Drain the gas sponsor. It pays only for attestations the Signer issued, once each, only for wallets that cannot pay, and only as fee payer.

What a compromise would cost

Compromised	Consequence
Gas sponsor key	Its float is wasted. No authority over any vault.
Attester key	New claims could be authorised for handles that have never claimed. Bound handles are unaffected.
Signer host	As above, plus denial of service. Funds in vaults stay in vaults.
The repository	Nothing directly - verify the deployed program against the source.

Two bugs found in self-review

Both passed the entire existing test suite before they were found, which is the argument for an external audit rather than against one:

1. A per-claim cap that blocked claims instead of limiting them, leaving any vault holding more than the cap permanently unclaimable.
2. execute_rotation not taking the config account, so pausing could not stop a hostile destination change - the only scenario the pause exists for.

Both are fixed and asserted in scripts/src/regression.ts.

Reporting

Report privately first, through a GitHub security advisory on the repository or the Telegram bot linked at usehandle.xyz. Include what you found, how to reproduce it, and what it lets an attacker do. If it involves funds, say so in the first line. Acknowledgement within 72 hours.