> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molpha.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Model

> What verification guarantees, what it doesn't, and the current testnet trust assumptions.

## What a successful `verify()` proves

* At least `signaturesRequired` keys from the referenced `registryVersion` signed the payload.
* Every signer is inside the deterministic selection set for the round.
* The aggregate Schnorr signature is valid for the exact `DataUpdate`.

## What it does not prove

* That `feedId`, `value`, or `canonicalTimestamp` correspond to genuine Solana feed state — stateless verifiers store no feed state. That guarantee is economic: honest selected nodes only sign messages matching the canonical Solana feed they observe. Solana remains the source of truth for feed validity.
* Freshness or non-replay. Historical registry versions remain verifiable forever, by design. Consumers must enforce `maxStaleness` against `canonicalTimestamp` and track consumed payloads where replay matters.

## Defenses in the design

| Threat                                    | Defense                                                                                                                  |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Rogue-key attack on plain-sum aggregation | Mandatory Schnorr proof-of-possession at registration, per deployment                                                    |
| Signer-set forgery                        | `signersBitmap` is bound inside the signed message; coalition key recomputed from the registry snapshot                  |
| Selection grinding                        | Selection seed derived only from `(feedId, registryVersion, canonicalTimestamp)`; verifiers re-derive and enforce subset |
| Cross-context / cross-feed reuse          | Message binds `feedId`, `canonicalTimestamp`, `signersBitmap`, `value`                                                   |
| Unauthorized feed writes on Solana        | `submit_data_update` re-verifies the aggregate signature on every write; monotonic `canonical_timestamp`                 |
| Look-alike feed accounts                  | Consumers validate the `Feed` PDA with `seeds::program = MOLPHA_PROGRAM_ID`                                              |

## Current trust assumptions (Brebeneskul devnet)

* **Protocol admin** controls node registration (`addNode`/`removeNode`) and the redundancy buffer on every registry. The registered node set plus the admin are the entire trust root of the stateless verifiers.
* **Pre-audit.** No external audit has been completed; mainnet is gated on it.
* **Partial economic security.** Staking and reward accounting are live on devnet (settlement, finalize/dispute paths, reward claims). Slashing is not — `dispute_round` exists, but A3 (Chivchyn) must first ship Solana registry versioning with historical validation (the prerequisite for dispute adjudication), then broader proof-based operator slashing. The node set remains permissioned; devnet is not production-ready.