A key limitation of the system: sign_entity and verify_entity protect against modification of existing entries, but not against their deletion. If an attacker deletes an entry from `evm_transac…
Well, the absence of zeroize was supposed to make me think over. Gonna be fixed.
The gap issue is already partially bounded by the checked_add overflow guard. Splitting the tracker per flow would require every request type to carry a flow-type tag in the protobuf message,…
The finding is valid but requires a product decision before it can be fixed. The current implementation collects approvals only from currently connected operators — it has no awareness of how…
The finding does not apply to the current implementation. The bootstrap token is consumed and the key registered only inside verify_solution after the challenge-response signature check passes,…