All issues

Search results

SECURITY: the orchestrator beacon is owned by a compromised EOA on all three chains; #324 must not run until it is moved

Status: Open.

#335 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 29, 2026

Orchestrator beacon owner is pinned to the hot deploy EOA as permanent expected state, and the timelock migration structurally cannot reach it

Status: Open.

#333 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 27, 2026

Protofire 5.0 and 6.0 reports are cited across the tree but not in audit/protofire/

Status: Open.

#327 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 27, 2026

Orchestrator instance uses nonce-derived CREATE on a permissionless deploy(); use the rain-factory clone factory the repo already depends on

Status: Open.

#326 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 27, 2026

build-artifact + rainix-sol test red on main: live-chain grant/pin drift

Status: Open.

#322 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 22, 2026

foundry.toml's bare [package] warns on every forge invocation, and forge's suggested fix makes it worse

Status: Open.

#313 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 17, 2026

Nothing verifies the token tables are COMPLETE — enumerate deployments from chain, not from the pins

Status: Open.

#297 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 10, 2026

Beacon-set deployers: resolve BEACON_INITIAL_OWNER from the address registry so rotating it stops moving the Zoltu address

Status: Open.

#296 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 8, 2026

Authoriser: resolve initial admin from the address registry and deploy via open salt, so the pin stops depending on the deploy EOA

Status: Open.

#295 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 8, 2026

Hash-only and address-only pins across the repo: embed runtime bytecode on every deployed-artifact pin (ruling from #250)

Status: Open.

#293 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 4, 2026

Deterministic authoriser clones everywhere: chain-invariant address, pinned up-front, migrate Base off the nonce-based clone

Status: Open.

#292 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Aug 4, 2026

Authoriser grant invariant is presence-only: a post-deploy _ADMIN re-grant is invisible

Status: Open.

#281 In S01-Issuer/st0x.deploy;

· thedavidmeister opened on Jul 23, 2026