What it protects,what it assumes,and where itstops.

1. T01An agent repeatedly submits identical or semantically equivalent transactions.
2. T02A compromised agent tries to exceed a transaction, hourly, daily or per-token budget.
3. T03A developer API key is stolen.
4. T04An attacker replays an earlier approved request or UserOperation.
5. T05An unauthorized user submits a policy update.
6. T06Concurrent requests race to spend the same budget.
7. T07The primary application server is compromised.
8. T08An enclave restarts, loses state or becomes unreachable.
9. T09RPC, bundler, fee estimator or indexer returns stale or inconsistent data.
10. T10A human approval expires, is replayed, or is applied to a different transaction.
11. T11A transaction changes materially between policy check and signing.
12. T12A whitelisted contract is upgraded or changes behaviour.

Generation

Inside the enclave. Never exported, logged or returned by any API.

Registration

Public key registered with the smart account's validation module.

Scope

Bound to one account and chain; cannot authorize outside policy.

Rotation and revocation

Controlled, authenticated, recorded; revocation is enforced on chain.

Measurement change

New build → new attestation → explicit approval before the signer is trusted.

Environments

Separate keys for development, staging and production.

No production release proceeds until every gate is met. None are met today: Ravelin Wall is pre-release.

• Reviewed threat model□ OPEN
• Audited smart-account enforcement design□ OPEN
• Attestation verification test suite□ OPEN
• Key management and recovery procedures□ OPEN
• Budget-concurrency and replay tests□ OPEN
• Direct-bypass tests□ OPEN
• Dependency and secret scanning□ OPEN
• Contract fuzzing and invariant tests□ OPEN
• Documented incident response□ OPEN
• Tested rollback procedure□ OPEN
• No unresolved critical findings□ OPEN

1. 01Contain

   Engage the global stop or pause the affected agent through the independent control path. New authorizations are denied immediately; nothing already denied can be signed.

2. 02Revoke

   Revoke compromised API credentials and, where needed, the signing identity registered with the smart account. Revocation of a signer is an on-chain action.

3. 03Investigate

   Reconstruct the timeline from the append-only audit trail by request ID, policy version and reason code. Reservations show what was authorized but not finalized.

4. 04Recover

   Release the stop only after health checks pass and an authorized operator confirms. Enclave or measurement changes are re-attested before signing resumes.

5. 05Disclose

   Notify affected organizations with the scope, the window and the audit references. Publish a post-incident note in the changelog.

6. 06Learn

   Add an adversarial test that reproduces the incident and a release gate that blocks its regression.

The repository is private during pre-release, so report suspected vulnerabilities directly to the maintainers, following SECURITY.md. A public private-disclosure channel is a release gate and will be published before the first public release. Do not test against systems you do not own.