aldabra/crates
Kayos 9556b7812d fix(dao): audit H-2 + H-5 + H-6 (per memory/audit-aldabra-dao-2026-05-05)
H-2: drop ExUnits to 5M/2G for spend, 2M/1G for mint
  Was 14M/10G each = per-tx Conway cap. With 3 plutus contracts running
  (governor spend + stake spend + ProposalST mint), total claim 42M/30G
  exceeds per-tx limit and node rejects pre-phase-2.

H-5: propagate malformed wallet asset keys instead of silently dropping
  Previous filter_map silently dropped any key < 56 chars. Could let a
  corrupt Koios response burn assets on submit. Now returns explicit
  Err with the offending UTxO + key.

H-6: tighten StakeST detection to asset_name == stake_validator_hash
  Per Stake/Scripts.hs:188-190 (pscriptHashToTokenName), StakeST
  asset_name is the stake validator's script hash. Previous code took
  "first non-gov-token asset" which would silently pick a wrong policy
  if a stake UTxO accidentally carried a junk NFT. Regression test
  h6_junk_token_does_not_pollute_stake_st_detection added.

3 of 7 audit punch-list items closed. C-1 + C-2 + C-3 next.
2026-05-05 20:52:22 -07:00
..
aldabra-chain v0.2: 8 chain_* read-only Koios passthrough MCP tools 2026-05-05 07:01:32 -07:00
aldabra-core AUDIT4-3 fix: optional inline datum on wallet_send 2026-05-05 06:58:15 -07:00
aldabra-dao fix(dao): audit H-2 + H-5 + H-6 (per memory/audit-aldabra-dao-2026-05-05) 2026-05-05 20:52:22 -07:00
aldabra-mcp fix(dao): audit H-2 + H-5 + H-6 (per memory/audit-aldabra-dao-2026-05-05) 2026-05-05 20:52:22 -07:00