Security Model

What a successful `verify()` proves

At least signaturesRequired keys from the referenced registryVersion signed the payload.
Every signer is inside the deterministic selection set for the round.
The aggregate Schnorr signature is valid for the exact DataUpdate.

That feedId, value, or canonicalTimestamp correspond to genuine Solana feed state — stateless verifiers store no feed state. That guarantee is economic: honest selected nodes only sign messages matching the canonical Solana feed they observe. Solana remains the source of truth for feed validity.
Freshness or non-replay. Historical registry versions remain verifiable forever, by design. Consumers must enforce maxStaleness against canonicalTimestamp and track consumed payloads where replay matters.

Threat	Defense
Rogue-key attack on plain-sum aggregation	Mandatory Schnorr proof-of-possession at registration, per deployment
Signer-set forgery	`signersBitmap` is bound inside the signed message; coalition key recomputed from the registry snapshot
Selection grinding	Selection seed derived only from `(feedId, registryVersion, canonicalTimestamp)`; verifiers re-derive and enforce subset
Cross-context / cross-feed reuse	Message binds `feedId`, `canonicalTimestamp`, `signersBitmap`, `value`
Unauthorized feed writes on Solana	`submit_data_update` re-verifies the aggregate signature on every write; monotonic `canonical_timestamp`
Look-alike feed accounts	Consumers validate the `Feed` PDA with `seeds::program = MOLPHA_PROGRAM_ID`

Protocol admin controls node registration (addNode/removeNode) and the redundancy buffer on every registry. The registered node set plus the admin are the entire trust root of the stateless verifiers.
Pre-audit. No external audit has been completed; mainnet is gated on it.
Partial economic security. Staking and reward accounting are live on devnet (settlement, finalize/dispute paths, reward claims). Slashing is not — dispute_round exists, but A3 (Chivchyn) must first ship Solana registry versioning with historical validation (the prerequisite for dispute adjudication), then broader proof-based operator slashing. The node set remains permissioned; devnet is not production-ready.