# Groth16 / WASM finding status Checked: 12 October 2026 **18 findings remediated in source; 1 reopened (DogeOS D1, High).** Finding-status verification against staging source, dated remediation records and targeted regression tests. Not a full re-audit or blanket deployment attestation. ## Checked source revisions - frontend: `f14991e7d9f9a79c695d882dc72f45f4f2cf673f` - protocol: `ce21953aad7252a11f62f8a2a31d111026e0945c` - relayer: `ab747c2036f9731e982f7ab355530274d063b144` ## Verification - Current frontend targeted regressions: 129 tests passed across 13 suites. - Current relayer targeted regressions: 100 passed, 1 skipped, 0 failed. The PostgreSQL-backed funded-merge index/backfill suite was skipped because its test database was not configured; the event-decoding regression passed. - DogeOS wallet-hook fixture: 15 existing checks plus 1 added controlled D1 reproduction passed. The extra reproduction demonstrates the unresolved alternate-signature/storage-loss case, not remediation. - All cited fix and subsequent key-setup-change commits were confirmed ancestors of the checked staging revisions. - Historical remediation records supplement targeted reruns; the full original circuit, SDK and production-release suites were not repeated for this documentation update. ## evm-correctness / ZK-01 — Swap output secret durability **High · Remediated in source** Persist the output secret in an encrypted pending journal before broadcast; reconcile canonical receipt/events after hash loss or restart. Evidence / limits: September remediation record and current swap-output/journal regression checks. Remediation commits: frontend `ac2dc2a329c4587d55bf58744f1dd9324a792e85` ## evm-correctness / ZK-02 — Relayer rejects Flat V2 settlement selectors **Medium · Remediated in source** Canonical decoding supports all seven Flat V2 settlement selectors, with fee policy and simulation. Evidence / limits: September remediation record; current EVM handler and sponsorship checks. Remediation commits: relayer `34d35df705e566886435ef07e2d0ce39cbcbefe6` ## evm-correctness / ZK-03 — Production marker does not establish phase-2 verification **Medium · Remediated in source** The canonical production deployment path validates the complete signed release manifest before broadcast and binds runtime hashes. Evidence / limits: Release-gate implementation remains in staging. This source fix does not establish a completed production ceremony or attest deployed keys. Remediation commits: protocol `4860c121c9ad089df3ee7e3bd755b838d775ca8d` ## evm-adversarial / ADV-01 — Untrusted relayer gas spend **High · Remediated in source** Construct fee fields on the server; enforce gas, fee and durable global/per-signer spending limits, including mandatory simulation. Evidence / limits: Current spending-policy and handler regression checks; operator budgets and shared durable storage remain required. Remediation commits: relayer `bef98e7cddf993f7151d0fb80dc0885088f09245` ## evm-adversarial / ADV-02 — Incompatible Web Locks options **High · Remediated in source** Use ifAvailable without combining it with signal; check cancellation while retaining the lease until work settles. Evidence / limits: Current wallet-lock regressions. Remediation commits: frontend `bfc82d97d6d712b4e0153138e4ee40d59cd8f712` ## evm-adversarial / ADV-03 — Proxy requires redundant public-wallet field **Medium · Remediated in source** Authenticate the minimal V2 envelope by JWT; reject any supplied wallet alias that conflicts with the authenticated account. Evidence / limits: September actual-proxy and loopback regression record. Remediation commits: frontend `bfc82d97d6d712b4e0153138e4ee40d59cd8f712` ## evm-adversarial / ADV-04 — Mismatched HMAC protocols **Medium · Remediated in source** Use the same versioned method/path/query/body authentication transcript at the proxy and relayer, including route-alias checks. Evidence / limits: September loopback record and current HMAC regressions. Remediation commits: frontend `bfc82d97d6d712b4e0153138e4ee40d59cd8f712`; relayer `bef98e7cddf993f7151d0fb80dc0885088f09245` ## evm-adversarial / ADV-05 — Cancelled operations exhaust the active journal **Medium · Remediated in source** Archive proven pre-submit cancellations outside the active limit while preserving encrypted recovery material; keep ambiguous submissions recoverable. Evidence / limits: Current cancellation, pending-journal and archive regressions, including more than 64 historical records. Remediation commits: frontend `bfc82d97d6d712b4e0153138e4ee40d59cd8f712` ## evm-adversarial / ADV-06 — Bridge transaction hash-loss recovery **Medium · Remediated in source** Recover the bridge event only after canonical receipt, calldata, nullifier and order-ID validation. Evidence / limits: Current bridge recovery and private-bridge journal regressions. Remediation commits: frontend `bfc82d97d6d712b4e0153138e4ee40d59cd8f712` ## evm-adversarial / ADV-07 — SDK snapshot reads use latest state **Medium · Remediated in source** Pin reads using the ethers v6 transaction blockTag and update the packaged SDK. Evidence / limits: September SDK record and current pinned-pool-read regressions. Remediation commits: frontend `bfc82d97d6d712b4e0153138e4ee40d59cd8f712`; protocol `491fe1249e2b9c89566814023003bc62d843979e` ## solana / F1 — Definitive refusal becomes permanently pending **High · Remediated in source** Preserve the proven submissionNotAttempted refusal across HTTP; close only demonstrably unsigned intents. Evidence / limits: Current Solana route/recovery checks and October 8 recovery-resolution evidence. Remediation commits: frontend `618f64bb82d7a87784b4057310522ea1dc8feb61`; relayer `a6291150a630e0e5d079c58b91b0dcd466577583` ## solana / F2 — Recovery selects an unrelated PDA mention **High · Remediated in source** Search finalized history for the actual matching settlement event instead of treating the newest PDA mention as creation. Evidence / limits: Current leaf-discovery and recovery-security regressions. Remediation commits: frontend `618f64bb82d7a87784b4057310522ea1dc8feb61`; relayer `a6291150a630e0e5d079c58b91b0dcd466577583` ## solana / F3 — Zero-output withdrawals exhaust the journal **Medium · Remediated in source** Complete chain-validated withdrawals even when no output delivery is required. Evidence / limits: October remediation regression record and current recovery-security checks. Remediation commits: frontend `618f64bb82d7a87784b4057310522ea1dc8feb61`; relayer `a6291150a630e0e5d079c58b91b0dcd466577583` ## solana / F4 — Processed signature is retried with a fresh signature **Medium · Remediated in source** Retain the original signed attempt through uncertain submission; require canonical resolution before replacing it. Evidence / limits: Current Solana settlement regressions, including response loss and retry fencing. Remediation commits: frontend `618f64bb82d7a87784b4057310522ea1dc8feb61`; relayer `a6291150a630e0e5d079c58b91b0dcd466577583` ## solana / F5 — Settlement before durable note delivery **High · Remediated in source** Require acknowledged encrypted off-device journal backup before funded settlement; preserve delivery-pending state until recovery completes. Evidence / limits: Current journal-backup regressions; later October 8 devnet cold-restore and funded top-up evidence. Remediation commits: frontend `618f64bb82d7a87784b4057310522ea1dc8feb61`; relayer `a6291150a630e0e5d079c58b91b0dcd466577583` ## dogeos / D1 — Non-repeatable setup signatures can strand private notes **High · Reopened — partially mitigated** A same-browser fingerprint detects a changed signature, but the independent key backup/import flow and initial two-signature check were subsequently removed. The original recovery guarantee is no longer present. Evidence / limits: Reproduced in the current wallet hook: the same account and payload with a different valid signature is rejected with its saved fingerprint, but after clearing storage it connects with a different spending seed. No real wallet vendor is alleged to have produced this signature variation. If the original signature cannot be reproduced or restored, access to the original notes can be lost. Closure requires recoverable key material independent of signature repeatability, or a separately reviewed equivalent design. Changes affecting closure: frontend `063921d7b9374f2612350940d82491cc8a8d5052`; frontend `0973d621eed113c04dab6a9d1fe17d85f624eabe` ## dogeos / D2 — Reorg causes replay of stale transaction success **Medium · Remediated in source** Reconcile previously submitted and confirmed journal entries against canonical receipts; retain signed attempts and nonce claims so displaced transactions can be replayed safely. Evidence / limits: Current DogeOS regressions cover canonical inclusion, displaced-envelope replay, noncanonical receipts and unresolved consumed nonces. The current policy permits subsequent work after canonical inclusion; it does not promise L1-finality waiting. Remediation commits: relayer `436239e7e3ee9297c0f1069265acfbcdb317b3b6`; relayer `9eae24eef6a14a0bdc211f273f42b585e9051514` ## deposit-merge / F1 — Interrupted preparation reserves notes indefinitely **High · Remediated in source** Track disclosure and archive demonstrably undisclosed preparation failures; preserve and reconcile any attempt that might have been submitted. Evidence / limits: October 8 source follow-up and current deposit cancellation/merge regressions; later Solana recovery-resolution evidence. Remediation commits: frontend `9d8b37651906510f22bbdf7f893d5c7ecb199981` ## deposit-merge / F2 — Merged-note nullifiers absent from the recovery index **Medium · Remediated in source** Ingest the scalar DepositMerged nullifier and rebuild the previous index generation without duplicating insertion leaves. Evidence / limits: Current merged-event decoding regression passed; PostgreSQL index/backfill coverage is supported by the recorded October remediation run and was not rerun in this pass. October 9 DogeOS atomic-merge cutover includes funded recovery checks. This source status does not assert that every independently pinned recovery service was upgraded. Remediation commits: relayer `11bba0449acd308a302ccaaafbb5b448f4e54a57` ## Scope and remaining qualification - Original reports and their source hashes are preserved below the current-status addendum. The addendum takes precedence for current finding status. - Source remediation is distinct from deployed-service qualification. This check does not certify every contract, running worker, production key or operator setting. - Production ceremony/runtime attestation, a completed physical-device MyDoge qualification matrix and historical archival-recovery drills remain outside the completed evidence. - Later funded tests supplement the original review: October 8 Solana recovery/top-up and October 9 DogeOS atomic-merge tests. They do not resolve DogeOS D1 or constitute a new full audit.