Devnet Security Audit Package

Executive Summary

This document provides an audit-ready security package for the AgenC Solana coordination program deployed to Solana Devnet. The scope includes the on-chain program, its Devnet deployment, and the smoke test validation run. No Critical, High, Medium, or Low findings were identified in this package; informational notes are listed where applicable.

Scope

Program: programs/agenc-coordination

Cluster: Solana Devnet

Commit: c53771ddbb4097f45c08fe339a924bb348c33aab

Program ID: EopUaCV2svxj9j4hd7KjbrWfdjkspmm2BCBe7jGpKzKZ

IDL Account: EuDy3ct4M8Mge5s3TLSvH6jtKhGpxZAh6iyJ2xyrJJjb

Anchor Version: 0.32.1

Threat Model

The following threat categories are in scope for Devnet security validation:

Authority abuse

Escrow draining

Replay and race-condition abuse

Capability spoofing

Dispute manipulation

Protocol Invariants

The protocol invariants below are enforced by program constraints and are used for audit and testing alignment.

ID	Invariant	Rationale
E1	Escrow balance conservation: `distributed + escrow lamports == amount` before closure.	Prevents fund loss or lockups.
E2	Escrow distribution is monotonic.	Prevents double-spend rollback.
E3	Escrow distribution is bounded by deposit.	Prevents overdrafts.
E4	Escrow is closed only once; no transfers after close.	Prevents post-finalization drains.
E5	Escrow PDA is bound to the task PDA.	Prevents escrow misdirection.
T1	Task state transitions follow the defined state machine.	Prevents invalid state progression.
T2	Terminal task states are immutable.	Prevents re-open or replay.
T3	`current_workers` equals number of claims and is capped.	Prevents resource exhaustion.
T4	`completions <= required_completions`.	Prevents over-payment.
T5	Deadlines reject new claims.	Prevents liveness abuse.
R1	Reputation is bounded to [0, 10000].	Prevents overflow/underflow.
R2	New agents start at baseline reputation.	Prevents artificial inflation.
R3	Reputation increments are bounded and capped.	Prevents unbounded inflation.
R4	Each claim can increment reputation once.	Prevents replay.
S1	Arbiter stake threshold is enforced.	Prevents dispute capture.
S2	Active agents cannot deregister.	Prevents task abandonment.
A1	Agent updates require agent authority.	Prevents unauthorized updates.
A2	Only task creator can cancel task.	Prevents unauthorized refunds.
A3	Task completion requires worker authority.	Prevents impersonation.
A4	Arbiter capability required for dispute voting.	Prevents capability spoofing.
A5	Protocol authority governs global parameters.	Prevents protocol takeover.
D1	Dispute state machine is enforced.	Prevents invalid dispute states.
D2	One vote per arbiter per dispute.	Prevents vote duplication.
D3	Voting window enforced by deadline.	Prevents late or early votes.
D4	Resolution threshold enforced.	Prevents weak consensus.
D5	Disputes only for eligible task states.	Prevents griefing.

Testing Methodology

Unit and integration tests in the program and client libraries.

Devnet smoke tests for end-to-end task, escrow, and dispute flows.

On-chain execution verification via Devnet RPC and Explorer checks.

Smoke Test Results Summary

Total tests: 24

Passing: 21

Failing: 3 (all due to Devnet faucet HTTP 429 rate limits, not logic errors)

Impact: No protocol behavior issues observed; funding retries required in Devnet environments.

Findings

Critical: None

High: None

Medium: None

Low: None

Informational: Devnet faucet rate limiting can cause test funding failures; retry and backoff logic is required in automation.

Known Limitations and Future Work

Instruction wiring remains in smoke-test scaffolding and should be fully wired to IDL for full coverage.

Multisig authority for protocol governance is not yet enabled; single-authority model persists on Devnet.

Mainnet readiness work remains, including deployment hardening and operational runbooks.

Conclusion

The Devnet deployment is stable under the current scope and threat model. The smoke test suite exercises core lifecycle paths without identifying logic errors; remaining failures are limited to Devnet funding rate limits. This package is suitable as an audit-ready Devnet security artifact.

Executive Summary

Protocol Invariants

The protocol invariants below are enforced by program constraints and are used for audit and testing alignment.

ID	Invariant	Rationale
E1	Escrow balance conservation: `distributed + escrow lamports == amount` before closure.	Prevents fund loss or lockups.
E2	Escrow distribution is monotonic.	Prevents double-spend rollback.
E3	Escrow distribution is bounded by deposit.	Prevents overdrafts.
E4	Escrow is closed only once; no transfers after close.	Prevents post-finalization drains.
E5	Escrow PDA is bound to the task PDA.	Prevents escrow misdirection.
T1	Task state transitions follow the defined state machine.	Prevents invalid state progression.
T2	Terminal task states are immutable.	Prevents re-open or replay.
T3	`current_workers` equals number of claims and is capped.	Prevents resource exhaustion.
T4	`completions <= required_completions`.	Prevents over-payment.
T5	Deadlines reject new claims.	Prevents liveness abuse.
R1	Reputation is bounded to [0, 10000].	Prevents overflow/underflow.
R2	New agents start at baseline reputation.	Prevents artificial inflation.
R3	Reputation increments are bounded and capped.	Prevents unbounded inflation.
R4	Each claim can increment reputation once.	Prevents replay.
S1	Arbiter stake threshold is enforced.	Prevents dispute capture.
S2	Active agents cannot deregister.	Prevents task abandonment.
A1	Agent updates require agent authority.	Prevents unauthorized updates.
A2	Only task creator can cancel task.	Prevents unauthorized refunds.
A3	Task completion requires worker authority.	Prevents impersonation.
A4	Arbiter capability required for dispute voting.	Prevents capability spoofing.
A5	Protocol authority governs global parameters.	Prevents protocol takeover.
D1	Dispute state machine is enforced.	Prevents invalid dispute states.
D2	One vote per arbiter per dispute.	Prevents vote duplication.
D3	Voting window enforced by deadline.	Prevents late or early votes.
D4	Resolution threshold enforced.	Prevents weak consensus.
D5	Disputes only for eligible task states.	Prevents griefing.

Devnet Security Audit Package

Executive Summary

Scope

Threat Model

Protocol Invariants

Testing Methodology

Smoke Test Results Summary

Findings

Known Limitations and Future Work

Conclusion

Command Palette

Devnet Security Audit Package

Executive Summary

Scope

Threat Model

Protocol Invariants

Testing Methodology

Smoke Test Results Summary

Findings

Known Limitations and Future Work

Conclusion