# Obsidio — Security & Audit Checklist (Gate 3)

**Scope:** testnet surface live on OBSIDIO.NETWORK  
**Date:** 2026-09-23  
**Status:** Pre-external-audit self-check (not a substitute for a paid audit)

## Cryptography

| Item | Status | Notes |
|------|--------|-------|
| Dilithium-3 consensus QC (`pq-real`) | Done | Real `pqc_dilithium`; no BLS/Ed25519 |
| ML-KEM-768 messenger seal | Done | Kyber via `pqc_kyber` |
| Winterfell L2 STARK (`OBSD-STARK-v2`) | Done | Prove+verify on batch path |
| TFHE-rs governance tallies | Done | `tfhe-real`, keys at `/opt/obsidio/tfhe_keys.bin` |
| FHE DEX / lending ciphertexts | Partial | DEX uses TFHE-rs compare (`gt`) when `tfhe-real`; lending TFHE |
| View keys / IVK-OVK | Stub | Poseidon path in specs; wallet UX incomplete |
| Key management HSM / MPC | Open | Single-process Dilithium/FHE keys on disk |

## Consensus & networking

| Item | Status | Notes |
|------|--------|-------|
| HotStuff multi-validator (4/3) | Done | TCP mesh, length-prefixed bincode |
| Eclipse / peer scoring | Done | Mesh dial/broadcast skips banned; shared scorer with RPC |
| State persistence | Done | RPC + durable `bridge_db.json` |
| Byzantine fault injection tests | Done | `consensus` byzantine_tests (weak QC / equivocation) |

## Bridge & light clients

| Item | Status | Notes |
|------|--------|-------|
| Dilithium bridge attestation 3/4 | Done | |
| Eth beacon light client | Partial | `OBSIDIO_ETH_BEACON` → `/eth/v1/beacon/headers`; fallback execution RPC |
| Bitcoin PoW light client | Partial | Synthetic headers only |
| Replay / nonce safety | Done | Hash set + durable bridge DB |

## Application surface

| Item | Status | Notes |
|------|--------|-------|
| JSON-RPC auth / rate limit | Done | Key on prod deploy; rate 60/min; nginx `limit_req` zone |
| Wallet extension `window.obsidio` | Done | MV3 |
| Mobile Expo (iOS/Android) | Scaffold | Needs Apple/Play accounts |
| Group ML-KEM chat | Done | Fan-out mailboxes |
| Shielded notes + PoI stub | Partial | PoI + sanction gate |
| Private lending API | Done | |
| Private Launchpad | Done | |
| Compliance (view keys / travel rule) | Done | |
| Metrics / monitoring | Done | `obsidio_health` + `/opt/obsidio/monitor.jsonl` |

## Ops & compliance

| Item | Status | Notes |
|------|--------|-------|
| Secret rotation (server passwords leaked in chat historically) | **Action** | Rotate root/stilys; prefer SSH keys only |
| TFHE key file permissions | Check | `chain:chain`, mode should be `600` |
| Travel-rule / sanctions proofs | Partial | Travel-rule envelopes + demo OFAC list + PoI RPC live |
| External audit (Trail of Bits / NCC / Kudelski) | Deferred | No budget — see `/docs/INTERNAL_AUDIT.md` (disclose “not externally audited”) |
| Bug bounty | Open | `/bounty/` live; rewards TBD until treasury |
| Legal drafts | Draft | `/docs/TERMS.md` · `PRIVACY.md` · `JURISDICTION.md` |
| Key ceremony | Guide ready | `/docs/KEY_CEREMONY.md` — execute before mainnet |

## Mainnet gate (must be green)

1. ~~External crypto audit~~ → **Internal review + public disclosure** (`INTERNAL_AUDIT.md`) until funded  
2. RPC auth + DDoS limits + monitoring — **Done** (testnet hardened)  
3. Durable bridge + Eth beacon headers — **Partial/Done** (headers; not full attestation)  
4. Key ceremony for genesis validators + encrypted backups — **Guide ready; not executed**  
5. Legal: ToS, privacy, jurisdiction — **Drafts ready; publish + adopt entity**

## Smoke commands (testnet)

```bash
curl -s https://obsidio.network/rpc/ -H 'content-type: application/json' \
  -d '{"method":"obsidio_getStatus","id":1}' | jq '.result | {pq_real,stark_engine,fhe_engine}'
```