Skip to content
No audit has been commissioned

Nuvex is not deployed and has not been audited. Do not put value behind these programs. What follows is what the instructions actually enforce, and what is still only policy on paper.

Documents that state the limits, not a claim of safety

  • AUDIT_SCOPE
  • THREAT_MODEL
  • KEY_MANAGEMENT
  • INCIDENT_RESPONSE
  • UPGRADE_POLICY

No audit, and no report to point at

AUDIT_SCOPE.md is a scope, not a report: no audit has been commissioned. The verifier, solana-ecvrf 0.0.1, has no audit report either. Its published compute measurements are not treated as one.

ProgramsAnchor 1.2
  • oracle-corerequests, callbacksLive
  • oracle-registrynodes, stake, slashLive
  • verificationECVRF proofsLive

What the programs do enforce

Live

A forged proof is rejected. A second fulfil is rejected. The alpha binds the request account, so an old proof cannot be replayed. The callback CPI passes zero accounts and does not include the request.

VerificationRFC 9381
  1. COMMITTEDproof submitted with the output
  2. VERIFIEDECVRF checked by the program
  3. FINALIZED64-byte output written
  4. EXECUTEDcallback ran, no accounts passed
Illustration · not chain data

AUDIT_SCOPE.md

The scope a future auditor would be asked to cover: the three programs, the PDA seeds in crates/common, fee and stake arithmetic, callback account binding, and the upgrade and pause authorities.

THREAT_MODEL.md

A row per threat, naming the mitigation that exists today and the milestone that still owes one. Solana account state is authoritative; the API, indexer and dashboard are not.

KEY_MANAGEMENT.md

Four roles stay on separate keys. Development program keypairs are gitignored, and a leaked one is treated as burned: generate a new id and do not reuse the address.

INCIDENT_RESPONSE.md

Planned

Severity levels and a first hour that confirms a claim against the account rather than the API. The pause flag the procedure reaches for is not implemented.

UPGRADE_POLICY.md

Planned

Everything required before mainnet, none of it done: named multisig members and a threshold, a timelock, a public changelog with the buffer hash, an emergency pause, an independent audit and a devnet rehearsal.

SECURITY.md

Report privately through the repository's security advisory form, never a public issue. Include the program id, the instruction and a transaction that shows the issue on a local validator. There is no bug bounty.

Node identity

Signs fulfilment. On local and devnet a key path in NUVEX_NODE_KEY_PATH is acceptable; the node does not open the file yet.

Operator authority

Registers the node and moves stake. It is a separate pubkey and need not be the node authority.

Treasury and security fund

Planned

Would move fees once fees exist. Destinations are set at initialisation and stay empty until then, and the treasury, security fund and reward destinations must not be one key.

Upgrade authority

A multisig, never a hot node key and never the deploy keypair. Hardware or a KMS before mainnet.