Security release/candidate 1#4109

Open

lionakhnazarov wants to merge 192 commits into

threshold-network:mainfrom

lionakhnazarov:security-release/candidate-1

Commits on May 4, 2026

Harden sensitive legacy surfaces
mswilkison
committed

Commits on May 5, 2026

Commits on May 6, 2026

docs(security): align operator-facing samples with diagnostics opt-in default
lrsaturnino
committed

Commits on May 8, 2026

security: update F-04 and F-05 findings status
piotr-roslaniec
committed
security: downgrade F-06 to Low/Informational -- on-chain BLS verify mitigates impact
piotr-roslaniec
committed
security: downgrade F-07 to Low/Mitigated by Design -- intentional cross-codebase pattern
piotr-roslaniec
committed
security: downgrade F-08 to Low/Informational -- intentional post-TIP-092 governance design
piotr-roslaniec
committed
security: mark F-09 remediated -- ReentrancyGuard added to submitRelayEntry
piotr-roslaniec
committed
security: close F-10 as Informational -- cipher is XSalsa20-Poly1305 (NaCl secretbox), sound
piotr-roslaniec
committed
security: update F-11 with self-correction (positive cache, not negative cache)
piotr-roslaniec
committed
security: update F-12 -- downgrade to Low/Informational, remove K8s context, note operational design
piotr-roslaniec
committed
security: update F-13 as fixed -- deduplicator TOCTOU race resolved
piotr-roslaniec
committed
security: close F-14 as informational -- v1 contracts deprecated, immutable, zero balance
piotr-roslaniec
committed
security: update F-15 as remediated -- exponent verified correct, test added
piotr-roslaniec
committed
security: close F-16 as informational -- aggregation functions have no production callers
piotr-roslaniec
committed
security: close F-17 as accepted -- single RPC endpoint is an architectural constraint
piotr-roslaniec
committed
security: update F-02 status to partially remediated; fix README findings link
piotr-roslaniec
committed
security: mark F-03 remediated -- HKDF-SHA256 with domain separation applied
piotr-roslaniec
committed
security: close F-01 as invalid -- persistence layer encrypts key shares at rest
piotr-roslaniec
committed
security: sync findings with latest remediations
piotr-roslaniec
committed
ci: grant pull-requests:read permission to paths-filter jobs
piotr-roslaniec
committed

Commits on May 12, 2026

Commits on May 22, 2026

Commits on May 23, 2026

Commits on Jun 11, 2026

Commits on Jun 12, 2026

Commits on Jun 15, 2026

test(signing): make Byzantine withhold test falsifiable
piotr-roslaniec
committed

Commits on Jun 17, 2026

Commits on Jun 23, 2026

Commits on Jul 3, 2026