Vault v1.2.1 Audit | NUVA | Halborn Audit Reports

Summary

100% of all REPORTED Findings have been addressed

About this report

Assessment Type

Assurance Assessment

Date of Engagement

July 29th, 2026 - August 7th, 2026

Source Code

vault-8c68ce7a3e14a4bffbc7a95651669173fc1a383f.zip

Severity Breakdown

3Future Release
8Acknowledged
24Solved
35All Findings

Critical1
- 1Solved
High0
Medium2
- 2Solved
Low0
Informational32
- 21Solved
- 3F. Release
- 8Ack.

INTRODUCTION#

Nuva engaged Halborn to perform a security assessment of their vault module on July 29th, 2026. The assessment scope was limited to the smart contracts provided to Halborn. Commit hashes and additional details are available in the Scope section of this report.

The Nuva codebase in scope consists of a Go-based Provenance Blockchain module for tokenized, single-denomination vaults. It manages deposits and redemptions, share accounting, interest and AUM fees, internal NAV pricing, cross-chain share controls, P2P asset settlement, queued processing, and upgrade migrations.

This report is a diff review of the Provenance Blockchain vault module from release-line commit 69d9478 to the v1.2.1 target a2dbc9e. The module manages single-denomination tokenized vaults, share issuance and redemption, interest and AUM fees, internal NAV pricing, bridge-controlled share movement, P2P settlement, queues, and migrations.

ASSESSMENT SUMMARY#

Halborn was allocated 8 days for this engagement and assigned 1 full-time security engineer to conduct a comprehensive review of the smart contracts within scope. The engineer is an expert in blockchain and smart contract security, with advanced skills in penetration testing and smart contract exploitation, as well as extensive knowledge of multiple blockchain protocols.

The objectives of this assessment are to:

Identify potential security vulnerabilities within the smart contracts.
Verify that the smart contract functionality operates as intended.

In summary, Halborn identified several areas for improvement to reduce the likelihood and impact of security risks, which were addressed by the Nuva team. The main recommendations were:

Enforce marker transfer and identity restrictions on every swap-in funding path, including the bypassed deposit path, and add regression tests for frozen or otherwise ineligible depositors.
Protect existing shareholders by requiring the vault to be paused before repricing a held asset, applying a reprice timelock, and enforcing a nonzero minimum withdrawal delay.
Make fee collection and reconciliation resilient to restricted assets: treat an uncollectable fee as recoverable, constrain fee rates, and separate fee-recipient control from fee-rate authority.

TEST APPROACH AND METHODOLOGY#

Halborn conducted a combination of manual code review and automated security testing to balance efficiency, timeliness, practicality, and accuracy within the scope of this assessment. While manual testing is crucial for identifying flaws in logic, processes, and implementation, automated testing enhances coverage of smart contracts and quickly detects deviations from established security best practices.

The following phases and associated tools were employed throughout the term of the assessment:

Research into the platform's architecture, purpose and use.
Manual code review and walkthrough of the codebase to identify any logical issues.
Comprehensive assessment of the safety and usage of critical Go variables and functions within scope that could lead to arithmetic-related vulnerabilities.
Local testing using custom scripts (Go test).
Static security analysis of scoped contracts, and imported functions (staticcheck, gosec).

Risk Methodology#

Every vulnerability and issue observed by Halborn is ranked based on two sets of Metrics and a Severity Coefficient. This system is inspired by the industry standard Common Vulnerability Scoring System.

The two Metric sets are: Exploitability and Impact. Exploitability captures the ease and technical means by which vulnerabilities can be exploited and Impact describes the consequences of a successful exploit.

The Severity Coefficients is designed to further refine the accuracy of the ranking with two factors: Reversibility and Scope. These capture the impact of the vulnerability on the environment as well as the number of users and smart contracts affected.

The final score is a value between 0-10 rounded up to 1 decimal place and 10 corresponding to the highest security risk. This provides an objective and accurate rating of the severity of security vulnerabilities in smart contracts.

The system is designed to assist in identifying and prioritizing vulnerabilities based on their level of risk to address the most critical issues in a timely manner.

4.1 EXPLOITABILITY

Attack Origin (AO):

Captures whether the attack requires compromising a specific account.

Attack Cost (AC):

Captures the cost of exploiting the vulnerability incurred by the attacker relative to sending a single transaction on the relevant blockchain. Includes but is not limited to financial and computational cost.

Attack Complexity (AX):

Describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Includes but is not limited to macro situation, available third-party liquidity and regulatory challenges.

Metrics:

EXPLOITABILITY METRIC ( $m_e$ )	METRIC VALUE	NUMERICAL VALUE
Attack Origin (AO)	Arbitrary (AO:A)	1
Attack Origin (AO)	Specific (AO:S)	0.2
Attack Cost (AC)	Low (AC:L)	1
	Medium (AC:M)	0.67
	High (AC:H)	0.33
Attack Complexity (AX)	Low (AX:L)	1
	Medium (AX:M)	0.67
	High (AX:H)	0.33

Exploitability

E

is calculated using the following formula:

$E = \prod m_e$

4.2 IMPACT

Confidentiality (C):

Measures the impact to the confidentiality of the information resources managed by the contract due to a successfully exploited vulnerability. Confidentiality refers to limiting access to authorized users only.

Integrity (I):

Measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of data stored and/or processed on-chain. Integrity impact directly affecting Deposit or Yield records is excluded.

Availability (A):

Measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. This metric refers to smart contract features and functionality, not state. Availability impact directly affecting Deposit or Yield is excluded.

Deposit (D):

Measures the impact to the deposits made to the contract by either users or owners.

Yield (Y):

Measures the impact to the yield generated by the contract for either users or owners.

Metrics:

IMPACT METRIC ( $m_I$ )	METRIC VALUE	NUMERICAL VALUE
Confidentiality (C)	None (C:N)	0
	Low (C:L)	0.25
	Medium (C:M)	0.5
	High (C:H)	0.75
	Critical (C:C)	1
Integrity (I)	None (I:N)	0
	Low (I:L)	0.25
	Medium (I:M)	0.5
	High (I:H)	0.75
	Critical (I:C)	1
Availability (A)	None (A:N)	0
	Low (A:L)	0.25
	Medium (A:M)	0.5
	High (A:H)	0.75
	Critical (A:C)	1
Deposit (D)	None (D:N)	0
	Low (D:L)	0.25
	Medium (D:M)	0.5
	High (D:H)	0.75
	Critical (D:C)	1
Yield (Y)	None (Y:N)	0
	Low (Y:L)	0.25
	Medium (Y:M)	0.5
	High (Y:H)	0.75
	Critical (Y:C)	1

Impact

I

is calculated using the following formula:

$I = max(m_I) + \frac{\sum{m_I} - max(m_I)}{4}$

4.3 SEVERITY COEFFICIENT

Reversibility (R):

Describes the share of the exploited vulnerability effects that can be reversed. For upgradeable contracts, assume the contract private key is available.

Scope (S):

Captures whether a vulnerability in one vulnerable contract impacts resources in other contracts.

Metrics:

SEVERITY COEFFICIENT ( $C$ )	COEFFICIENT VALUE	NUMERICAL VALUE
Reversibility ( $r$ )	None (R:N)	1
	Partial (R:P)	0.5
	Full (R:F)	0.25
Scope ( $s$ )	Changed (S:C)	1.25
Scope ( $s$ )	Unchanged (S:U)	1

Severity Coefficient

C

is obtained by the following product:

$C = rs$

The Vulnerability Severity Score

S

is obtained by:

$S = min(10, EIC * 10)$

The score is rounded up to 1 decimal places.

Critical	High	Medium	Low	Informational
9 - 10	7 - 8.9	4.5 - 6.9	2 - 4.4	0 - 1.9

Scope#

(a) Submitted File: vault-8c68ce7a3e14a4bffbc7a95651669173fc1a383f.zip

(b) Items in scope:

174 files

vault

174 files

.changelog

22 files

unreleased

12 files

bug-fixes

5 files

219-paused-vault-fee-period.md

markdown

258-swap-out-retry-backoff.md

markdown

260-genesis-metadata-nav-denom.md

markdown

266-nav-scope-existence.md

markdown

266-stop-publishing-asset-nav-to-marker.md

markdown

client-breaking

1 file

265-gov-only-vault-creation-cli.md

markdown

features

1 file

vault174 files

.changelog22 files

unreleased12 files

bug-fixes5 files

219-paused-vault-fee-period.mdmarkdown

258-swap-out-retry-backoff.mdmarkdown

260-genesis-metadata-nav-denom.mdmarkdown

266-nav-scope-existence.mdmarkdown

266-stop-publishing-asset-nav-to-marker.mdmarkdown

client-breaking1 file

265-gov-only-vault-creation-cli.mdmarkdown

features1 file

259-remove-vault-nav.mdmarkdown

improvements1 file

257-paused-vault-queue-budget.mdmarkdown

state-machine-breaking3 files

259-nav-authority-acceptance.mdmarkdown

262-allow-nav-update-on-pause.mdmarkdown

265-gov-only-vault-creation.mdmarkdown

.gitkeep

add-change.shshell

change-template.mdmarkdown

combine-dep-lines.awk

config.tomltoml

dependabot-changelog.shshell

get-dep-changes.shshell

get-valid-sections.shshell

lint-unreleased.shshell

prep-release.shshell

README.mdmarkdown

api9 files

provlabs9 files

vault9 files

module1 file

v11 file

module.pulsar.gogo

v18 files

events.pulsar.gogo

genesis.pulsar.gogo

params.pulsar.gogo

query_grpc.pb.gogo

query.pulsar.gogo

tx_grpc.pb.gogo

tx.pulsar.gogo

vault.pulsar.gogo

interest2 files

interest_test.gogo

interest.gogo

keeper33 files

abci.gogo

export_test.gogo

genesis_test.gogo

genesis.gogo

injectable_keepers_test.gogo

keeper_test.gogo

keeper.gogo

migrations_test.gogo

migrations.gogo

migrator.gogo

msg_server_security_test.gogo

msg_server_test.gogo

msg_server.gogo

nav_test.gogo

nav.gogo

payout_restrictions_test.gogo

payout_test.gogo

payout.gogo

query_server_test.gogo

query_server.gogo

queue_test.gogo

queue.gogo

reconcile_test.gogo

reconcile.gogo

settlement_test.gogo

settlement.gogo

state_test.gogo

state.gogo

suite_test.gogo

valuation_engine_test.gogo

valuation_engine.gogo

vault_test.gogo

vault.gogo

proto11 files

provlabs7 files

vault7 files

module1 file

v11 file

module.proto

v16 files

events.proto

genesis.proto

params.proto

query.proto

tx.proto

vault.proto

buf.gen.gogo.yamlyaml

buf.gen.pulsar.yamlyaml

buf.gen.swagger.yamlyaml

generate.shshell

queue6 files

fee_timeout_test.gogo

fee_timeout.gogo

payout_timeout_test.gogo

payout_timeout.gogo

pending_swap_out_test.gogo

pending_swap_out.gogo

scripts11 files

check-provenance-version.shshell

create-marker.shshell

create-vault.shshell

get-key.shshell

get-marker-address.shshell

protoc-swagger-gen.shshell

query.shshell

swap-in.shshell

swap-out.shshell

tx.shshell

wait-tx.shshell

simapp15 files

simd3 files

cmd2 files

commands.gogo

root.gogo

main.gogo

app.gogo

app.yamlyaml

exchange_wiring_test.gogo

export.gogo

go.mod

go.sum

group.gogo

provenance.gogo

sim_bench_test.gogo

sim_test.gogo

test_helpers.gogo

vault_wiring_test.gogo

simulation9 files

estimate_accuracy_test.gogo

genesis_test.gogo

genesis.gogo

operations_test.gogo

operations.gogo

provenance.gogo

rand.gogo

setup.gogo

vault.gogo

spec6 files

01_concepts.mdmarkdown

02_state.mdmarkdown

03_messages.mdmarkdown

04_events.mdmarkdown

05_queries.mdmarkdown

06_blocker.mdmarkdown

types25 files

codec_test.gogo

codec.gogo

errors.gogo

events_test.gogo

events.gogo

events.pb.gogo

expected_keepers.gogo

genesis_test.gogo

genesis.gogo

genesis.pb.gogo

interest.pb.gogo

keys_test.gogo

keys.gogo

msgs_test.gogo

msgs.gogo

params.gogo

params.pb.gogo

payout.gogo

query.pb.gogo

query.pb.gw.gogo

suite_test.gogo

tx.pb.gogo

vault_test.gogo

vault.gogo

vault.pb.gogo

utils9 files

mocks1 file

vault.gogo

query1 file

query.gogo

accounts.gogo

math_test.gogo

math.gogo

shares_test.gogo

shares.gogo

slices.gogo

tools.gogo

.gitignore

.golangci.ymlyaml

buf.lock

buf.yamlyaml

CHANGELOG.mdmarkdown

CLAUDE.mdmarkdown

CONTRIBUTING.mdmarkdown

GEMINI.mdmarkdown

go.mod

go.sum

go.work

local.shshell

module.gogo

README.mdmarkdown

SECURITY.mdmarkdown

sims.mk

ee99ee81408702d4680bf523b0a2a4368a1dcc5e 6dd6b6f93a8aec1c311b87327f81a1861ba2d8df 76c76173f86f0b520598ab7d8a7814be13b0c1a1 534fecd3350155972c695405056ddeb4cb1cdfa2 cd6ff1f242f8a31b0dfca83edc9836457e1a188f 4bc8af468d1029acd8d29664613067b355d14375 6623bf2b545735e6922f09628226f8d819698cb4 83c3dac125db7ce193874e049b313df95936afa4 f102fb3539530d7d0a1621d4ca1ced680a98943e 720c18d09a7959396fa05fb3ec6aeaba3086eeaa 1861e16d08e1d1a1916af151e88d61080ddedc63 b148eebbf98d183c148bbdda942b24a1f55d9ebb d971e228f08f0420c957fd3b2e4dc172a00cf39e ef7ba2d30d6dfe0687d3c5b9d6f8f279299aadcb 6300e3c59ed9f8045279baf6094320f9e2d89bf7 ac1977f92e0f252eb234aec9614b514b29588e5d af319578b338888fda78278e3ee0f96aec9087ab 5ba7919686f5ae2bb2c3894933d5b9d2f1cc770a 19d0bcf03be3756782dcfb8b06cebead3510d56a 6e668a1a3a1c47171482714d3b0fdcb0daa91c2d 04d2c9f0da354fd2ae4edb3a278da213d0dabcad d1a73655f0b47525def99871c2da5c1b17c7f0b1 40fd46f4211d3f58216967e69e90907a783ae95e c04d47dfc8bd000871093c8cb37af865631883fd

Out-of-Scope: New features/implementations after the remediation commit IDs.

Assessment Summary & Findings Overview#

#	Title	Severity	Score	Status
HAL-01	Swap-In Bypasses the Underlying Marker Send Restrictions	Critical	10.0	Solved08/04/2026
HAL-02	Live Held-Asset NAV Reprice Extracts Value From Existing Shareholders	Medium	5.4	Solved08/04/2026
HAL-03	AUM-Fee Transfer to an Unattributed Tech-Fee Address Bricks a Restricted-Underlying Vault	Medium	5.0	Solved08/04/2026
HAL-04	Genesis Pending-Swap-Out With a Negative Shares Amount Halts the Chain in EndBlocker	Informational	1.7	Solved08/04/2026
HAL-05	Truncation Denies Sub-Unit Yield / Fee Under Frequent Reconciles	Informational	1.7	Future Release08/14/2026
HAL-06	Genesis Swap-Out Queue Accepts Duplicate Ids and Negative Times (InitGenesis Halt / Latent Auto-Pause)	Informational	0.8	Acknowledged08/14/2026
HAL-07	v1→v2 Migration Bricks the Upgrade When a Legacy Vault Fails the Current Validate()	Informational	0.4	Solved08/05/2026
HAL-08	The Shared Swap-Out Batch Budget Has No Fairness Control, So One Actor's Backlog Starves Other Vaults' Redemptions	Informational	0.3	Acknowledged08/14/2026
HAL-09	PayoutVerificationSet Is Not Round-Tripped in Genesis	Informational	0.2	Solved08/11/2026
HAL-10	PayoutVerificationSet Is Drained in Address Order, Not Insertion Order, Deferring High-Address Vaults While Churn Is Sustained	Informational	0.2	Solved08/10/2026
HAL-11	Marker Share-NAV Mirror Goes Stale After a Fee-Only Reconcile	Informational	0.1	Solved08/04/2026
HAL-12	Bridge-Address Rotation Strands the Old Bridge's Shares (Recoverable by Transfer)	Informational	0.1	Acknowledged08/12/2026
HAL-13	ExpDec (17-Term Maclaurin e^x) Sign-Inverts and Is Grossly Wrong for Large \|rt\|	Informational	0.1	Solved08/11/2026
HAL-14	Unbounded Per-Vault Internal-NAV Walk in GetTVV Inside ABCI	Informational	0.1	Solved08/06/2026
HAL-15	Interest Affordability Forecast Under-Estimates the Applied Window	Informational	0.1	Future Release08/14/2026
HAL-16	Validate() Permits PeriodTimeout / FeePeriodTimeout == math.MinInt64	Informational	0.1	Future Release08/14/2026
HAL-17	Delegated Management Authority Is an All-or-Nothing Bundle With No Default Interest-Rate Envelope	Informational	0.0	Acknowledged08/14/2026
HAL-18	EstimateSwapIn Query Panics on a Nil Asset Amount	Informational	0.0	Solved08/04/2026
HAL-19	Pro-Rata Share Math Uses Non-Safe Int.Add for the Virtual Offset	Informational	0.0	Solved08/04/2026
HAL-20	Dead Code: CalculateExpiration / CalculatePeriods Are Unreferenced and Carry Latent Long-Running-Loop, Unchecked Int64 and Unguarded Coin.Sub Hazards	Informational	0.0	Solved08/05/2026
HAL-21	Genesis Import Does Not Bound WithdrawalDelaySeconds, Bypassing the Swap-Out Withdrawal Delay	Informational	0.0	Solved08/04/2026
HAL-22	Unguarded sdk.Coin.Sub in BridgeMintShares Panics on a Broken Supply Invariant (Recovered on the Tx Path)	Informational	0.0	Solved08/05/2026
HAL-23	No Maximum-Age Bound on an Internal NAV Price Used for Valuation	Informational	0.0	Solved08/12/2026
HAL-24	Bridge Mint/Burn Sit Outside the Pause Circuit Breaker, and the Spec Contradicts Itself on Whether They Should	Informational	0.0	Solved08/10/2026
HAL-25	BridgeMintShares Carries No Idempotency Key, So the Chain Cannot Tell a Duplicate Bridge-In From a New One	Informational	0.0	Acknowledged08/14/2026
HAL-26	EstimateSwapOut Validates `shares` After the Expensive State Reads, With No Length Bound and Base-0 Parsing	Informational	0.0	Solved08/05/2026
HAL-27	handleReconciledVaults Splits the PayoutVerificationSet Removal and the Timeout Re-Enqueue Across Two Contexts, So an Error Between Them Leaves No Retry Handle	Informational	0.0	Solved08/10/2026
HAL-28	autoPauseVault Builds an Unvalidated `sdk.Coin` With a Nil Amount Inside the EndBlocker	Informational	0.0	Solved08/11/2026
HAL-29	The v1→v2 Fee Conversion Branch Is Unreachable, and a Test and Two Spec Sections Assert Otherwise	Informational	0.0	Acknowledged08/14/2026
HAL-30	OutstandingAumFee Is an Uncapped, Never-Aged Liability With No Signal When It Approaches Gross TVV	Informational	0.0	Solved08/11/2026
HAL-31	Timeout Reschedule Has No Compensating Re-Enqueue When Its Cached Half Fails	Informational	0.0	Solved08/10/2026
HAL-32	Swap-Out Retry Backoff Has No Jitter, So Co-Failing Entries Stay Permanently Synchronized	Informational	0.0	Solved08/06/2026
HAL-33	ExportGenesis Emits Internal-NAV Entries That InitGenesis Will Drop (Round-Trip Asymmetry)	Informational	0.0	Acknowledged08/14/2026
HAL-34	PendingSwapOutQueue.Dequeue Discards the IndexedMap.Has Error and Leaves Its Idempotent Contract Undocumented	Informational	0.0	Solved08/08/2026
HAL-35	The Interest-Disable Cleanup Performs a Full Chain-Wide Queue Scan That Finds Nothing, and Is Undone by the Next Reconcile	Informational	0.0	Acknowledged08/14/2026

Findings & Tech Details#

HAL-01Solved

Swap-In Bypasses the Underlying Marker Send Restrictions

Critical

10.0AO:A/AC:L/AX:L/R:N/S:C/C:N/A:N/I:H/D:H/Y:NAO:A/AC:L/AX:L/R:N/S:C/C:N/A:N/I:H/D:H/Y:N

Description

Proof of Concept

Recommendation

References

Provenance x/marker SendRestrictionFn: the WithBypass short-circuit at x/marker/keeper/send_restrictions.go:22-36, and the send-deny check at :130.
markertypes.WithBypass and HasBypass: x/marker/types/send_restrictions.go:16-38.
CWE-284: Improper Access Control.

Remediation Comment

Addressed in:

ee99ee81408702d4680bf523b0a2a4368a1dcc5e

HAL-02Solved

Live Held-Asset NAV Reprice Extracts Value From Existing Shareholders

Medium

5.4AO:A/AC:L/AX:M/R:N/S:U/C:N/A:N/I:L/D:H/Y:NAO:A/AC:L/AX:M/R:N/S:U/C:N/A:N/I:L/D:H/Y:N

Description

Proof of Concept

Recommendation

References

keeper/msg_server.go:904, UpdateVaultNAV, and keeper/msg_server.go:943, RemoveVaultNAV: RemoveVaultNAV rejects a denom with a nonzero principal balance at :955-957, but UpdateVaultNAV performs no equivalent check.
keeper/valuation_engine.go:188-221: GetTVV sums principal underlying plus every priced held denom, so TVV moves the instant a NAV entry is rewritten.
keeper/nav.go:95-96: the stored UpdatedBlockHeight and UpdatedTime on a NAV entry are written but never consulted by any staleness gate on swap-in or swap-out.
CWE-840: Business Logic Errors.

Remediation Comment

Addressed in:

6dd6b6f93a8aec1c311b87327f81a1861ba2d8df

HAL-03Solved

AUM-Fee Transfer to an Unattributed Tech-Fee Address Bricks a Restricted-Underlying Vault

Medium

5.0AO:A/AC:L/AX:M/R:P/S:C/C:N/A:C/I:N/D:H/Y:NAO:A/AC:L/AX:M/R:P/S:C/C:N/A:C/I:N/D:H/Y:N

Description

Proof of Concept

Recommendation

References

keeper/reconcile.go:355: the fee SendCoins names the vault as a transfer agent, which does not exempt the send unless the vault holds Access_Transfer on the underlying marker; keeper/reconcile.go:74: the error propagates out of reconcileVault, and the cache context is discarded so FeePeriodStart never advances and the uncollectable amount only grows.
Provenance x/marker keeper/send_restrictions.go:122 (transfer-agent short-circuit) and :160-186 (required-attribute enforcement on the send recipient).
Provenance x/attribute abci.go:16: DeleteExpiredAttributes runs every BeginBlock, so attribute loss is an ordinary on-chain event requiring no vault-module authority.
CWE-703: Improper Handling of Exceptional Conditions.
keeper/msg_server.go:830: UpdateParams sets TechFeeAddress with no constraint on the chosen address. keeper/msg_server.go:851-870: UpdateVaultAUMFeeBips authorizes on msg.Authority == params.TechFeeAddress only and caps the rate at 10,000 bips (100%/year).
keeper/reconcile.go:315: PerformVaultFeeTransfer collects the accrued fee up to the available principal balance on each reconcile.
CWE-284: Improper Access Control (the governance TechFeeAddress plus maximum AUM bips vector).

Remediation Comment

Addressed in:

Cosmos SDK genesis validation contract; BaseApp.InitChain does not recover a panic raised from InitGenesis
cosmossdk.io/collections indexes.Unique: the ref-key conflict is detected inside IndexedMap.Set and returned as collections.ErrConflict before the primary value is written
CWE-20: Improper Input Validation

Remediation Comment

Addressed in:

Validate() Permits PeriodTimeout / FeePeriodTimeout == math.MinInt64

Informational

0.1AO:S/AC:L/AX:H/R:P/S:U/C:N/A:L/I:N/D:N/Y:NAO:S/AC:L/AX:H/R:P/S:U/C:N/A:L/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

Remediation Comment

HAL-17Acknowledged

Delegated Management Authority Is an All-or-Nothing Bundle With No Default Interest-Rate Envelope

Informational

0.0AO:S/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:NAO:S/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

af319578b338888fda78278e3ee0f96aec9087ab

HAL-23Solved

No Maximum-Age Bound on an Internal NAV Price Used for Valuation

Informational

0.0AO:S/AC:H/AX:H/R:F/S:U/C:N/A:N/I:N/D:N/Y:NAO:S/AC:H/AX:H/R:F/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

References

Not applicable: CWE-1188 ("Initialization of a Resource with an Insecure Default", commonly cited as an unused/ineffective security control). It does not apply in either half. Nothing in the module ever asserted a freshness contract, proto/provlabs/vault/v1/vault.proto:169-172 documents both fields purely descriptively ("the block height at which this entry was last updated"), and vault.proto:150-152 / spec/02_state.md:137 say only that the module is the sole source of truth and that the NAV authority maintains the values. There is no control to be unused and no contract to violate.
Considered and rejected: CWE-672 ("Operation on a Resource after Expiration or Release"). Requires a resource with a defined lifetime; NAV entries have none, by design.
Applicable, for the documentation half: CWE-1059, *Insufficient Technical Documentation*. The attribution-only semantics of updated_block_height / updated_time are nowhere stated, which is what allowed them to be misread as an enforcement control in the first place.
Applicable, for the observability half: CWE-778, *Insufficient Logging*. EventNAVUpdated omits updated_time although the module stores it, leaving event-stream consumers unable to compute wall-clock price age directly.
keeper/nav.go:95-96, the only writer of the freshness stamps.
keeper/valuation_engine.go:78-134, :188-221, valuation reads price/volume only.
keeper/query_server.go:345, :387, the stamps ARE returned to clients.
types/events.go:396, proto/provlabs/vault/v1/events.proto:477-478, height on the event; time omitted.
keeper/settlement.go:42-63, spec/01_concepts.md:163, the existing holdings-scoped staleness control.
provenance@v1.3.2-0.20260720203940-3977c1b90e3c: proto/provenance/marker/v1/marker.proto:102-103, x/marker/keeper/keeper.go:370,385, x/marker/types/msgs.go:665-666, x/metadata/types/msgs.go:951, x/metadata/keeper/scope.go:875,937.
keeper/payout.go:108,117,139,145 → keeper/vault.go:504,511,515, why an age gate must not sit on the valuation path.
CWE-1059 (Insufficient Technical Documentation), CWE-778 (Insufficient Logging). CWE-1188 and CWE-672 do not apply; see *CWE mapping*.
Related: FIND-002 (confirmed), live held-asset NAV reprice. Different root cause, different fix.

Remediation Comment

Addressed in:

5ba7919686f5ae2bb2c3894933d5b9d2f1cc770a

HAL-24Solved

Bridge Mint/Burn Sit Outside the Pause Circuit Breaker, and the Spec Contradicts Itself on Whether They Should

Informational

0.0AO:S/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:NAO:S/AC:L/AX:L/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

Remediation Comment

Addressed in:

19d0bcf03be3756782dcfb8b06cebead3510d56a

HAL-25Acknowledged

BridgeMintShares Carries No Idempotency Key, So the Chain Cannot Tell a Duplicate Bridge-In From a New One

Informational

0.0AO:S/AC:L/AX:M/R:N/S:U/C:N/A:N/I:N/D:N/Y:NAO:S/AC:L/AX:M/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

PendingSwapOutQueue.Dequeue Discards the IndexedMap.Has Error and Leaves Its Idempotent Contract Undocumented

Informational

0.0AO:S/AC:L/AX:H/R:N/S:U/C:N/A:N/I:N/D:N/Y:NAO:S/AC:L/AX:H/R:N/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

Remediation Comment

Addressed in:

c04d47dfc8bd000871093c8cb37af865631883fd

HAL-35Acknowledged

The Interest-Disable Cleanup Performs a Full Chain-Wide Queue Scan That Finds Nothing, and Is Undone by the Next Reconcile

Informational

0.0AO:S/AC:L/AX:H/R:F/S:U/C:N/A:N/I:N/D:N/Y:NAO:S/AC:L/AX:H/R:F/S:U/C:N/A:N/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

Remediation Comment

Disclaimer#

Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.