# DogeOS fund-safety remediation — 1 October 2026

Both source findings in the [DogeOS Chikyu audit](/audits/groth16/dogeos/) have been addressed. The DogeOS and Solana fixes were committed together, merged into staging through frontend PR 44 and relayer PR 18, and deployed to staging. See the deployment record (`fund-safety-staging-20261001.md`). No funded transaction was performed; MyDoge device qualification remains outstanding.

| Component | Base commit | Worktree |
| --- | --- | --- |
| Frontend | `ad8dea248ad64fa71aad56de28b999e20d855497` | `.codex-worktrees/dogeos-quotes-frontend` |
| Relayer | `50fbcf507094c88232a86e7e90c691d431a72e74` | `.codex-worktrees/dogeos-quotes-relayer` |

## D1 — Privacy-key changes no longer silently activate another private account

The DogeOS wallet signs the exact locally constructed derivation challenge twice, verifies the signing account and compares the original signature bytes. A mismatch refuses activation. Returning connections also check the signature's SHA-256 fingerprint against a persistent checkpoint. The original derivation challenge and seed hashing are unchanged, including preservation of compact signature bytes.

Before first activation in a browser, the wallet stays disconnected until the user saves a password-encrypted privacy-key file and selects that file to verify it. The file preserves the original derivation signature using AES-256-GCM with PBKDF2-SHA-256, 600,000 iterations, random salt and IV, and an authenticated wallet/network/pool/origin context. Only a fingerprint is written to browser storage. Signature validation and RPC errors are sanitized so the spending secret cannot enter diagnostics.

If a wallet update changes its signature or stops supporting the derivation signing method, the connection offers restoration of the original file. Recovery does not need the wallet to reproduce the old signature. Wrong passwords, altered ciphertext, scope mismatches, a changed existing checkpoint, account changes and cancelled operations refuse activation. Both the ordinary wallet and payment-page connection paths use the same gate.

Implementation: derivation and encrypted recovery (`.codex-worktrees/dogeos-quotes-frontend/src/base-app/helpers/dogeDerivationRecovery.ts`), wallet activation (`.codex-worktrees/dogeos-quotes-frontend/src/base-app/hooks/useBaseWallet.ts`), backup dialog (`.codex-worktrees/dogeos-quotes-frontend/src/base-app/components/DogePrivacyKeyRecovery.tsx`).

## D2 — Included or reorged transactions cannot replay cached payment success

The relayer now checks the durable original submission before mutable proof validation and before opening a new settlement. A retry reconciles the actual receipt, canonical block, consumed signer nonce and finalized head. L2 inclusion alone returns `pending`. A missing receipt or an unavailable finality check cannot replay an old success. The original raw transaction, nonce, gas reservation and nullifier claims remain durable; a reorg rebroadcasts those same bytes.

Changed calldata or an overlapping input set locates the outstanding original attempt and returns a conflict naming it, instead of reserving a competing spend. Submitted settlements never expire because a timer elapsed. The next signer nonce stays blocked until finality. Errors after durable attempt creation cannot mark that attempt as an unsigned refusal.

The browser applies the same finalized-head boundary to direct settlement, deposit evidence, balance synchronization and journal recovery. A fixed L2 confirmation count cannot prematurely release recovery records or report payout completion.

The Chikyu ledger marker advances to version 3 without deleting reservations or submissions. Old journal binaries reject it. Registry networks always use their submission journal even when the legacy outbox is enabled for Base. Existing unresolved legacy-outbox records block admission until reconciled. A legacy settlement missing its durable original submission requires operator reconciliation, rather than returning an unverified success.

Implementation: submission journal (`.codex-worktrees/dogeos-quotes-relayer/src/relayer/evm-submission-journal.js`), transaction handler (`.codex-worktrees/dogeos-quotes-relayer/src/relayer/transaction-handler.js`), browser finality (`.codex-worktrees/dogeos-quotes-frontend/src/joinsplit-v2/chainFinality.ts`).

## Verification

| Check | Result |
| --- | --- |
| Complete frontend source test suite | 158 suites / 1,177 tests passed |
| Final focused wallet and journal-recovery check, including four additional edge-case tests | 2 suites / 21 tests passed |
| Expanded relayer spend-policy, handler, submission, pool, quote, route, registry and gateway selection | 85 tests passed |
| Final relayer journal and handler check, including an additional stale-receipt regression | 33 tests passed |
| Frontend TypeScript and optimized production build | Passed |
| Changed-file Prettier and both Git whitespace checks | Passed |

The wallet regression uses two different valid EIP-712 signatures from the same test account, not a mocked validity result. It verifies refusal, unchanged seed derivation, restored access after a wallet-signature change or complete browser-storage loss, malformed backups, cancellation, unavailable local storage, compact signatures and an account switch. UI tests verify that download alone cannot activate the wallet, a mismatched selected file is refused, and late decryption cannot complete a cancelled connection.

The real relayer-handler regression recreates a reorg after inclusion, including the old binary's prematurely confirmed settlement row. It verifies a pending response, receipt reads, rebroadcast of one transaction identity, unchanged signing/reservation counts, refusal of changed calldata and a second nonce, and successful completion after canonical finality. Additional tests cover ledger migration, legacy-outbox admission and a failed final receipt recheck.

## Rollout and remaining limits

Stop old Chikyu relayer instances before upgrading; preserve the full ledger and reconcile outstanding legacy-outbox work. Deploy the corresponding frontend finality checks together. Waiting for finality reduces per-signer throughput and can delay subsequent withdrawals. Do not reset the ledger or downgrade its marker to bypass that wait. See the relayer rollout notes (`.codex-worktrees/dogeos-quotes-relayer/docs/EVM_POOL_RELAY.md`).

Actual MyDoge injected, WalletConnect and embedded-wallet device behavior remains unqualified. In particular, verify the two signing prompts, encrypted-file save and selection, fresh-browser restore, and delayed-finality recovery in each supported WebView before funded use. The device matrix (`.codex-worktrees/dogeos-quotes-frontend/docs/dogeos-mydoge-qualification.md`) remains unfilled; tests do not substitute for those observations.

Keep the derivation origin and deployment anchors stable. The key file does not contain note ciphertexts, so existing note backup and historical-chain recovery requirements still apply. A pre-upgrade original signature that was already lost cannot be reconstructed. The fix prevents new silent key changes and provides a recovery mechanism while the original key remains available.