Smart Contract Threat Model
This threat model describes production smart-contract risks, existing mitigations, evidence, and residual risk. It should be reviewed before mainnet activation and whenever a protocol-pinned runtime profile, host import surface, registry policy, migration workflow, or contract-to-contract rule changes.
Assets
- Contract WASM bytecode, code hashes, manifests, and manifest hashes.
- Contract state key/value rows and state-root leaves.
- Bucket metadata, bucket access rules, bucket keys, and encrypted-record metadata.
- Local ciphertext availability and local encrypted payload store contents.
- Contract registry approvals, audit metadata, package status, and release workflow rows.
- Runtime activation governance, rollout policies, and validator attestations.
- Operator/admin credentials, governance authority, and validator identities.
- Wasmtime sidecar binary, sidecar protocol, runtime capabilities, and runtime profile.
- Contract events, structured call results, metrics, and alert feeds.
- Snapshot archives, backup-drill reports, checkpoints, and restored databases.
Trust Boundaries
- Caller or operator client to TypeScript node HTTP/API routes.
- Signed transaction envelope to deterministic block execution.
- Contract WASM module to host imports.
- TypeScript node to Rust Wasmtime sidecar.
- Contract runtime to bucket access and payload availability layers.
- Calling contract to called contract in contract-to-contract execution.
- Governance transactions to activation, registry, release, migration, and deactivation policy.
- Node-local readiness/metrics state to consensus contract state.
- Snapshot archive to restored database/checkpoint.
- Validator runtime membership to governance validator state.
Attacker Profiles
- Malicious contract author attempting sandbox escape, resource exhaustion, host import abuse, or misleading manifest/ABI data.
- Malicious caller attempting auth bypass, malformed args, replay divergence, or contract-to-contract abuse.
- Compromised contract owner attempting unsafe migration, deactivation bypass, package substitution, or bucket access expansion.
- Malicious or mistaken operator enabling the wrong runtime, approving an unsafe package, restoring stale state, or leaking credentials.
- Compromised validator or node serving stale data, broken sidecar capabilities, or unavailable local payloads.
- Contract callee/dependency attacker causing cycles, rollback surprises, fuel exhaustion, or dependency deactivation failures.
- Snapshot/backup tamperer modifying archived contract code, state, events, migrations, registry rows, or call results.
- Byzantine peer outside the current CFT production assumptions.
Existing Mitigations
- Rust Wasmtime sidecar with native fuel metering and memory limits.
- Protocol-pinned runtime profiles and compatibility vectors.
- Mandatory sidecar capability handshake and production preflight.
- Deterministic host import allowlist.
- Deterministic failure codes for metering, traps, import abuse, malformed modules, large payloads, and readiness failures.
- Manifest-declared method auth and bucket access requirements.
- Contract principal support in bucket access rules.
- Node-local readiness gates for buckets, permissions, payload availability, and runtime capabilities.
- Registry/catalog and release workflow with hashes, audit metadata, approval metadata, and status transitions.
- Contract-to-contract depth, auth, fuel, deactivation, cycle, ordering, and rollback rules.
- Per-contract state namespaces and state-root materialization.
- Migration proposals, jobs, batches, pinned hashes, resumable cursors, and release workflow integration.
- Event indexing and structured call-result persistence.
- Replay verification, runtime compatibility vectors, snapshot verification, archive import, and backup drills.
- Production alert rules, monitoring exports, readiness APIs, and operator runbooks.
Residual Risks
- Consensus is crash-fault-tolerant in the current production path, not Byzantine-fault-tolerant.
- Formal verification is not implemented for runtime rules, host imports, or contract logic.
- Fuzz/property testing is not yet a completed hardening layer.
- Contract author business logic remains a per-contract audit responsibility.
- Operator key custody, cloud posture, and CI/CD supply-chain controls are external to the node implementation.
- Upstream Wasmtime, Node.js, PostgreSQL, and OS vulnerabilities remain inherited dependency risks.
- Metrics and readiness are local operational surfaces; incorrect operator interpretation can still delay incident response.
Threat Table
| ID | Threat | Attacker | Impact | Existing Mitigation | Evidence | Residual Risk / Follow-Up |
|---|---|---|---|---|---|---|
| SC-T01 | Runtime escape or forbidden import abuse | Malicious contract author | Host compromise or non-deterministic behavior | Wasmtime sandbox, import allowlist, malformed/import abuse tests | npm run test:contract-runtime-security, npm run test:contract-wasm-host-imports | Track upstream Wasmtime advisories and release provenance |
| SC-T02 | Infinite loop or CPU exhaustion | Malicious contract author/caller | Validator stalls or denial of service | Native fuel metering, per-method and protocol max fuel | npm run test:contract-deterministic-metering | Add fuzz/property coverage for generated WASM shapes |
| SC-T03 | Memory or payload exhaustion | Malicious contract author/caller | Runtime crash or node pressure | Memory, args, event, return, and host IO limits | npm run test:contract-runtime-security, npm run test:contract-execution-limits | Expand soak with larger adversarial payload mixes |
| SC-T04 | Non-deterministic execution result | Contract author or runtime mismatch | Replay/state-root divergence | Protocol-pinned profiles, capability handshake, compatibility vectors | npm run test:contract-runtime-compatibility | External audit runtime profile upgrade process |
| SC-T05 | Host import writes applied before failure | Malicious contract | Partial state leakage after trap/failure | Intent staging and post-return application | npm run test:contract-wasm-host-imports, npm run test:contract-call-execution | Add property tests for host intent rollback |
| SC-T06 | Contract state isolation bypass | Malicious contract/caller | Unauthorized modification of another contract's state | Per-contract state namespaces, C2C rules, migration controls | npm run test:contract-to-contract-calls | Review every new host write import against isolation rules |
| SC-T07 | C2C cycles, depth, or rollback abuse | Malicious caller/callee | Unbounded execution or inconsistent nested state | Depth limit, cycle detection, nested rollback tests | npm run test:contract-c2c-adversarial | Add longer multi-contract graph fuzzing |
| SC-T08 | Auth bypass by user, organization, or contract principal | Malicious caller/contract | Unauthorized method invocation | Manifest method auth, caller/contract identity model | npm run test:contract-call-execution, npm run test:contract-to-contract-calls | Per-contract audit of auth design still required |
| SC-T09 | Registry bypass or package substitution | Compromised owner/operator | Unapproved code or manifest deployed | Registry policy, provenance checks, release workflow | npm run test:contract-registry, npm run test:contract-on-chain-provenance | External governance/key custody remains operational risk |
| SC-T10 | Bucket declaration or access bypass | Malicious contract author | Unauthorized bucket metadata or encrypted-record metadata access | Manifest declarations, readiness gates, bucket access rules | npm run test:contract-host-api, npm run test:contract-readiness | Recheck every new bucket host import against policy |
| SC-T11 | Local ciphertext availability leak | Malicious contract/operator | Local availability becomes consensus signal or data leak | Consensus snapshots redact ciphertext, readiness is local | npm run test:snapshots, npm run test:contract-backup-disaster-recovery | Operator handling of ciphertext backups remains sensitive |
| SC-T12 | Unsafe migration overwrite or destructive transform | Contract owner/operator | State loss or corrupted upgraded contract | Migration proposals/jobs/batches, pinned hashes, release workflow | npm run test:contract-state-migration-jobs, npm run test:contract-release-workflow | Contract-defined migration entrypoints need per-contract review |
| SC-T13 | Deactivation bypass | Malicious caller/callee | Calls continue against disabled/unsafe target | Deactivation state, dependency inspection, C2C target checks | npm run test:contract-deactivation, npm run test:contract-deactivation-dependencies | Operator must review dependency report before deactivation |
| SC-T14 | Snapshot or backup tampering | Backup tamperer/operator mistake | Restored node diverges or loses contract history | Archive hashes, verifier, state-root rebuild, checkpoint bootstrap | npm run test:snapshots, npm run test:contract-backup-disaster-recovery | External backup storage integrity is operational |
| SC-T15 | Monitoring blind spot or alert fatigue | Operator/process failure | Delayed incident response | Alert rules, JSON/Prometheus exports, runbooks | npm run test:contract-production-alerts, npm run test:contract-production-monitoring-integration | Alert routing and on-call ownership are deployment-specific |
| SC-T16 | Operator credential compromise | External attacker/insider | Unsafe approvals, activation, migration, restore | Operator auth, explicit guarded restore, documented procedures | npm run noos -- production preflight --profile validator | Secret custody and MFA are external controls |
| SC-T17 | Sidecar binary/config compromise | Operator/supply-chain attacker | Wrong runtime semantics or disabled metering | Capability handshake, runtime profile checks, preflight | npm run test:contract-runtime-preflight, npm run test:contract-wasmtime-sidecar-lifecycle | Reproducible builds and release signing are follow-up hardening |
| SC-T18 | Readiness evidence drift | Operator/release process failure | Activation with stale or missing evidence | Machine-readable launch gate and layer-readiness report | npm run test:contract-mainnet-launch-gate, npm run noos -- contracts layer-readiness --json | Human review still requires operational discipline |
Review Triggers
Re-run this threat model when any of these change:
- Wasmtime version, sidecar protocol, executor version, ABI version, or metering model.
- Host import names, signatures, payload limits, or failure codes.
- Contract-to-contract depth, rollback, fuel, or auth rules.
- Registry enforcement policy or release workflow states.
- Bucket access, ciphertext availability, or encrypted-record write semantics.
- Migration job, batch, transform, or contract-defined migration behavior.
- Snapshot format, archive import/export, replay checkpoint, or backup drill behavior.
- Production activation gate, preflight, readiness, monitoring, or alert rules.
Required Review Artifacts
- Completed Smart Contract Security Review Checklist.
- Current External Security Audit Package.
- Current Runtime Reproducible Builds provenance output.
- Runtime compatibility vector results.
- Production rollout and multi-node rehearsal results.
- Backup drill report for a contract-active environment.
- List of open security findings, waivers, owners, and expiry dates.