Security panel
Honest status of every security requirement. Unaudited testnet demo.
Contracts
Deployment and verification status.
Ethereum Sepolia
not deployed yet
Base Sepolia
coming next
Not deployed yet (Base Sepolia testnet ETH needed).
Pause & roles simulated
Live status from the demo chain.
Ethereum Sepolia
active
Base Sepolia
active
ORG_ADMIN / PAUSER: created on first allocation
Emergency pause never locks funds forever: unclaimed funds are refundable by ORG_ADMIN after expiry (time-locked recovery).
Requirements checklist
From SECURITY-REQUIREMENTS.md. Pending items name their owner.
Commitments only on-chain (no identities, no per-recipient amounts)
Double-hashed Merkle leaves (second-preimage protection)
Nullifiers bound to allocation, usable once across all chains
chainId bound into every commitment (cross-chain replay fails)
Claim tickets encrypted client-side (AES-GCM, PBKDF2 600k)
Transaction preview before every claim (simulate-first)
Chain restricted to Sepolia + Base Sepolia
No keys in code, repo or browser storage; zod-validated input
Contracts: unit, fuzz and invariant tests passing (42/42)
Slither clean (0 high/medium), Aderyn clean (0 high)
Contracts deployed and verified on Ethereum Sepolia (source + ABI public)
Strict CSP / HSTS / X-Frame-Options / Referrer-Policy
CI: forge test, coverage, slither, lint, next build — security & docs workstream