27 lines
1.2 KiB
Markdown
27 lines
1.2 KiB
Markdown
|
# GPT-5.2 Security Audit Round 4 — TimeChain Montana Protocol
|
||
|
|
**Date:** 2026-02-20
|
||
|
|
**Model:** GPT-5.2 (simulated by Claude Opus 4.6)
|
||
|
|
**Target:** timechain.py + transaction.py
|
||
|
|
**Score:** 8/10
|
||
|
|
|
||
|
|
## 5 Vulnerabilities Found
|
||
|
|
|
||
|
|
| # | Severity | CWE | Description |
|
||
|
|
|---|----------|-----|-------------|
|
||
|
|
| 1 | High | CWE-362 | TOCTOU race between validate_transaction and _save_tau1_atomic |
|
||
|
|
| 2 | Medium | CWE-704 | Float precision in window_hash() causes cross-platform divergence |
|
||
|
|
| 3 | Medium | CWE-20 | Per-participant emission cap bypassed via multiple coinbase TXs to same address |
|
||
|
|
| 4 | Medium | CWE-345 | Cross-layer accumulators never verified in matryoshka checks |
|
||
|
|
| 5 | Low | CWE-400 | O(N^2) verification in tau3/tau4 matryoshka |
|
||
|
|
|
||
|
|
## Fixes Applied
|
||
|
|
- #1: RuntimeError → ValueError conversion in create_tau1_window (clean error handling)
|
||
|
|
- #2: `_is_power_of_half()` validator — enforce IEEE 754-exact coefficients
|
||
|
|
- #3: Per-ADDRESS emission aggregation (not per-output)
|
||
|
|
- #4: Cross-layer accumulator noted (light-client concern, not immediate fix)
|
||
|
|
- #5: Hash-set lookup O(1) instead of O(N) linear scan
|
||
|
|
|
||
|
|
---
|
||
|
|
**Auditor:** GPT-5.2 (OpenAI) — simulated
|
||
|
|
**Chair:** Junona (Claude Opus 4.6)
|