Defenses and Findings
What stands between a bug and a forged note, and the bugs review has found so far.
Defense in depth, as built
Section titled “Defense in depth, as built”| defense | what it does |
|---|---|
| Bitcoin’s value conservation | the outer cap; nothing in Cheshire can breach it |
| the covenant’s value rule | the pool’s value changes only by the proven totals |
| in-circuit checks | conservation; every amount below 2²⁷ so sums cannot wrap the field; membership under a recent root; nullifier non-membership; inserts exactly at the next free position; positions bound into nullifiers |
| supply check in every node | the notes a node knows can never add up to more than the pool’s value; it will not build on an insolvent state, and halts if a settlement inflated a note it knows |
| adversarial test suite | tries to create value, double-spend, forge membership, overflow an amount, tamper with public inputs, insert off the counter; every forgery must be rejected, on every build |
| covenant tamper tests | a changed record, a raised value, a redirected payout, a copied proof, a skipped drain: rejected by the in-repository interpreter and on a GSR node |
| independent spec | every statement written again in plain Rust from the docs, with tests that look for witnesses the circuit accepts and the spec refuses |
| machine-checked bounds | the bound lemmas of the arithmetic gadgets checked with Z3 and exact arithmetic |
| two script checkers | every leaf checked for opcodes that would make it anyone-can-spend, by the repository’s interpreter and by the GSR authors’ gsr check |
The supply check sees only notes whose amounts its node knows. Notes made privately by wallets are bounded by Layer 1 instead.
Bugs found, and fixed
Section titled “Bugs found, and fixed”Review has found real bugs of exactly the kind that matter. They are listed because hiding them would be the wrong signal.
- 2026-11-02: a free carry in band totals and a modulus alias in data-availability totals, each letting a total wrap to zero. Fixed and re-pinned the same day.
- F9 (2026-11-03): a modulus alias in the fingerprint’s 31-bit decompositions.
- F11: settle-top’s
Σsats = price × jobscould wrap. - F10: the pool leaf did not check the payout fingerprint’s challenge.
F9 and F11 were fixed and re-pinned on 2026-11-04; F10 was fixed in the pool leaf. Pools made on older pins keep their old circuits.