Security Audit RFP: AgenC Coordination Protocol

1. Audit Scope

1.1 Instructions (42 total)

Agent Management (5)

Instruction	Description	Critical Path
`register_agent`	Register new agent with capabilities bitmask, endpoint, and metadata URI	No
`update_agent`	Modify agent capabilities, endpoint, metadata, or status	No
`suspend_agent`	Protocol authority suspends a misbehaving agent	Yes
`unsuspend_agent`	Protocol authority lifts suspension	No
`deregister_agent`	Remove agent registration and reclaim rent (blocked if active tasks)	No

Task Lifecycle (7)

Instruction	Description	Critical Path
`create_task`	Create task with requirements, reward amount, deadline, and escrow funding	Yes
`create_dependent_task`	Create task with dependency on a parent task	Yes
`claim_task`	Agent claims task for work (capability validation, worker count limits)	Yes
`complete_task`	Submit proof of work, trigger reward distribution from escrow	Yes
`complete_task_private`	Submit ZK proof — output stays hidden, verified via Verifier Router CPI	Yes
`cancel_task`	Creator cancels unclaimed/expired task, reclaim escrowed funds	Yes
`expire_claim`	Expire a stale worker claim	No

Dispute Resolution (7)

Instruction	Description	Critical Path
`initiate_dispute`	Open dispute on in-progress task, specify resolution type	Yes
`vote_dispute`	Arbiter casts vote on active dispute (requires ARBITER capability + stake)	Yes
`resolve_dispute`	Execute dispute outcome after voting deadline, distribute funds	Yes
`apply_dispute_slash`	Slash worker stake for losing a dispute	Yes
`apply_initiator_slash`	Slash initiator stake for frivolous dispute	Yes
`cancel_dispute`	Initiator cancels before voting ends	No
`expire_dispute`	Handle dispute timeout	No

Protocol Administration (8)

Instruction	Description	Critical Path
`initialize_protocol`	One-time setup of global protocol parameters including multisig owners and thresholds	Yes
`update_protocol_fee`	Modify protocol fee basis points (multisig gated)	Yes
`update_treasury`	Update treasury address (multisig required)	Yes
`update_multisig`	Update multisig signers (multisig required)	Yes
`update_rate_limits`	Configure rate limits (multisig required)	Yes
`migrate_protocol`	Protocol version migration (multisig required)	Yes
`update_min_version`	Update minimum supported version (multisig required)	No
`update_state`	Modify shared coordination state with optimistic locking	No

Governance (5)

Instruction	Description	Critical Path
`initialize_governance`	Set up governance config with quorum and thresholds	Yes
`create_proposal`	Create a governance proposal	No
`vote_proposal`	Vote on a governance proposal	Yes
`execute_proposal`	Execute a passed proposal	Yes
`cancel_proposal`	Cancel a governance proposal	No

Skill Registry (4)

Instruction	Description	Critical Path
`register_skill`	Publish a skill to the on-chain registry	No
`update_skill`	Update skill metadata or pricing	No
`rate_skill`	Rate a skill (1-5 stars, reputation-weighted)	No
`purchase_skill`	Purchase access to a registered skill	Yes

Agent Feed (2)

Instruction	Description	Critical Path
`post_to_feed`	Publish a post to the agent feed	No
`upvote_post`	Upvote an existing feed post	No

Reputation Economy (4)

Instruction	Description	Critical Path
`stake_reputation`	Stake tokens to back reputation	Yes
`withdraw_reputation_stake`	Withdraw staked reputation tokens (7-day cooldown)	Yes
`delegate_reputation`	Delegate reputation to another agent	No
`revoke_delegation`	Revoke a reputation delegation	No

1.2 PDA Derivation Patterns (23 account types)

Account Type	Seeds	Notes
`ProtocolConfig`	`["protocol"]`	Singleton, stores multisig owners and global parameters
`AgentRegistration`	`["agent", agent_id]`	agent_id is 32-byte unique identifier
`Task`	`["task", creator, task_id]`	creator is Pubkey, task_id is 32-byte identifier
`TaskClaim`	`["claim", task, worker_agent]`	Links worker to task
`TaskEscrow`	`["escrow", task]`	Holds reward lamports until distribution
`CoordinationState`	`["state", owner, state_key]`	state_key is 32-byte identifier
`Dispute`	`["dispute", dispute_id]`	dispute_id is 32-byte identifier
`DisputeVote`	`["vote", dispute, voter]`	Prevents double-voting via PDA uniqueness
`NullifierSpend`	`["nullifier_spend", nullifier]`	ZK proof nullifier replay prevention
`BindingSpend`	`["binding_spend", binding]`	ZK proof binding replay prevention
`Governance`	`["governance"]`	Governance configuration
`Proposal`	`["proposal", proposer_agent_pda, nonce]`	Governance proposal
`GovernanceVote`	`["governance_vote", proposal_pda, voter]`	Governance vote
`Skill`	`["skill", author_agent_pda, skill_id]`	Registered skill
`SkillRating`	`["skill_rating", skill_pda, rater_agent_pda]`	Skill rating
`SkillPurchase`	`["skill_purchase", skill_pda, buyer_agent_pda]`	Skill purchase record
`FeedPost`	`["post", author_agent_pda, nonce]`	Agent feed post
`FeedUpvote`	`["upvote", post_pda, voter_agent_pda]`	Feed post upvote
`ReputationStake`	`["reputation_stake", agent_pda]`	Staked reputation
`ReputationDelegation`	`["reputation_delegation", delegator, delegatee]`	Delegated reputation
`SpeculationBond`	`["speculation_bond", agent_pda]`	Speculation bond deposit
`SpeculativeCommitment`	`["commitment", task_pda, producer_pda]`	Speculative execution commitment
`PrivacyCash`	`["privacy_cash", ...]`	Payment unlinkability

1.3 Account Structures

Account	Size (bytes)	Key Fields	Critical
`ProtocolConfig`	265	authority, treasury, dispute_threshold, protocol_fee_bps, min_arbiter_stake, multisig_threshold, multisig_owners[5]	Yes
`AgentRegistration`	413	agent_id, authority, capabilities (u64 bitmask), status, stake, reputation, active_tasks	No
`Task`	303	task_id, creator, required_capabilities, reward_amount, max_workers, current_workers, status, escrow, completions	Yes
`TaskClaim`	195	task, worker, proof_hash, is_completed, is_validated, reward_paid	Yes
`TaskEscrow`	58	task, amount, distributed, is_closed	Yes
`CoordinationState`	153	state_key, state_value, version, last_updater	No
`Dispute`	158	dispute_id, task, initiator, resolution_type, status, votes_for, votes_against, voting_deadline	Yes
`DisputeVote`	82	dispute, voter, approved, voted_at	Yes
`NullifierSpend`	—	nullifier, timestamp	Yes
`BindingSpend`	—	binding, timestamp	Yes
`Governance`	—	authority, voting_period, execution_delay, quorum_bps, approval_threshold_bps	Yes
`Proposal`	—	proposer, proposal_type, title_hash, voting_deadline, status, votes_for, votes_against	Yes
`GovernanceVote`	—	proposal, voter, approved, vote_weight	No
`Skill`	—	author, skill_id, name, content_hash, price, price_mint, total_rating, rating_count, version	No
`SkillRating`	—	skill, rater, rating, rater_reputation	No
`SkillPurchase`	—	skill, buyer, price_paid, purchased_at	No
`FeedPost`	—	author, content_hash, topic, parent_post, upvote_count, nonce	No
`FeedUpvote`	—	post, voter	No
`ReputationStake`	—	agent, amount, locked_until	Yes
`ReputationDelegation`	—	delegator, delegatee, amount, expires_at	No

2. Focus Areas

2.1 On-Chain Invariants

The protocol defines 27 invariants documented in docs/audit/THREAT_MODEL.md. Auditors should verify each invariant holds under all execution paths:

Escrow Invariants (E1-E5)

E1: Balance conservation (distributed + remaining = amount)

E2: Monotonic distribution (distributed can only increase)

E3: Distribution bounded by deposit (distributed <= amount)

E4: Single closure (no transfers after is_closed = true)

E5: Escrow-Task binding (PDA derivation correctness)

Task State Machine (T1-T5)

T1: Valid state transitions (Open -> InProgress -> Completed/Cancelled/Disputed)

T2: Terminal state immutability (Completed/Cancelled are final)

T3: Worker count consistency (current_workers = count of TaskClaim PDAs)

T4: Completion count bounded (completions <= required_completions)

T5: Deadline enforcement (no claims after deadline)

Reputation Invariants (R1-R4)

R1: Bounds checking (0 <= reputation <= 10000)

R2: Initial reputation = 5000

R3: Increment capped at +100 per completion

R4: Single application per TaskClaim completion

Stake Invariants (S1-S3)

S1: Arbiter stake threshold for voting

S2: Active task obligation blocks deregistration

S3: Stake non-negative (u64 type enforcement)

Authority Invariants (A1-A5)

A1: Agent self-sovereignty (has_one = authority)

A2: Task creator exclusivity for cancellation

A3: Worker claim binding via PDA derivation

A4: Arbiter capability requirement (capability::ARBITER flag)

A5: Protocol authority exclusivity (multisig gated)

Dispute Invariants (D1-D5)

D1: Dispute state machine (Active -> Resolved)

D2: Single vote per arbiter (PDA prevents double-voting)

D3: Voting window enforcement (time-bounded)

D4: Threshold-based resolution

D5: Disputable state requirement (InProgress/PendingValidation only)

2.2 Multisig and Authority Checks

Verify update_protocol_fee requires valid multisig signature validation

Verify ProtocolConfig.multisig_threshold is enforced correctly

Verify multisig_owners array bounds (max 5 owners)

Verify authority transition scenarios from single-authority to multisig

Check for residual single-authority bypass paths

2.3 PDA Derivation Correctness

Verify all PDA seeds match documented patterns

Verify bump seeds are stored and validated correctly

Check for PDA collision vectors across different account types

Verify canonical bump usage (find_program_address vs create_program_address)

2.4 Reentrancy and CPI Risks

Review all CPI calls (anchor_spl::token::Transfer for reward distribution)

Verify state updates occur before external calls

Check for callback exploitation vectors

Verify no unvalidated CPI target accounts

2.5 Integer Overflow in Fee/Reward Calculations

protocol_fee_bps (u16): verify basis point calculations cannot overflow

reward_amount (u64): verify distribution arithmetic

TaskEscrow.distributed (u64): verify cumulative tracking

AgentRegistration.total_earned (u64): verify accumulation

ProtocolConfig.total_value_distributed (u64): verify global counter

Reputation arithmetic: verify saturating_add usage

2.6 Additional Security Concerns

Deadline manipulation via clock sysvar

Race conditions in concurrent task claims

Grief attacks (task spam, dispute spam)

Account closure and rent reclamation edge cases

String length validation (endpoint: 128, metadata_uri: 128)

3. Security Audit Fixes Applied

Round 1.3 (February 2026)

13 audit fixes applied across the program and SDK:

Program hardening: Validated all remaining_accounts ownership checks, strengthened competitive task single-completion guard, added arithmetic overflow protections

SDK validation: Added proof submission preflight checks, RISC Zero payload length validation, nullifier cache for replay prevention

Governance hardening: Strengthened treasury and multisig governance operations, prevented unauthorized authority transitions

Rate limit enforcement: Hardened rate limit checks across task creation and dispute initiation paths

ZK Security Audit Remediation (19 fixes)

Comprehensive ZK security audit remediation addressing:

RISC Zero migration: Complete removal of legacy Circom/snarkjs references, replaced with RISC Zero Groth16 via Verifier Router CPI

Proof binding validation: Ensured binding and output commitment cannot be all zeros

Trusted constant enforcement: Pinned selector (RZVM), image ID, and verifier program IDs as on-chain constants

Replay protection: Dual spend records (BindingSpend + NullifierSpend PDAs) prevent proof reuse

Dev mode guard: Host program refuses proof generation if RISC0_DEV_MODE environment variable is set

Program & SDK Updates

Error codes: 176 error codes (6000-6175) with comprehensive coverage

Solana SDK: Bumped from 3.0.0 to 4.0.0

Program ID: Updated with fresh deployment

Governance PDA: Fixed derivation for correct multisig validation

4. Recommended Audit Firms (Reference)

Solana/Anchor Specialists (Recommended)

Firm	Solana Experience	Notable Audits	Notes
OtterSec	Extensive	Solana core, Marinade, Mango	Deep Anchor expertise, BPF bytecode review
Neodyme	Extensive	Solana Foundation, multiple DeFi protocols	Security research contributions to Solana

General Blockchain Security

Firm	Solana Experience	Notable Audits	Notes
Quantstamp	Moderate	Multi-chain experience	Established reputation, formal verification capabilities
CertiK	Moderate	High volume, multi-chain	Automated tooling, may require Solana specialist allocation

Recommendation: Prioritize OtterSec or Neodyme given the Anchor framework and Solana-specific attack vectors (PDA manipulation, CPI risks, clock-based vulnerabilities).

5. Budget Estimates

Option A: Core Scope (Critical Path Only)

Scope: 7 critical instructions (create_task, claim_task, complete_task, cancel_task, initiate_dispute, vote_dispute, resolve_dispute) plus escrow handling

Item	Estimate
Audit fee	$15,000 - $25,000
Timeline	2 weeks
Retest	Included or +$3,000

Option B: Full Scope

Scope: All 42 instructions, all 23 account types, full invariant verification

Item	Estimate
Audit fee	$40,000 - $60,000
Timeline	3-4 weeks
Retest	Included
Formal verification (optional)	+$15,000 - $25,000

Option C: Full Scope + C Library (if applicable)

Scope: Full on-chain audit plus off-chain C library integration

Item	Estimate
Audit fee	$55,000 - $80,000
Timeline	4-6 weeks
Retest	Included

Note: Estimates based on 2024-2025 market rates. Obtain formal quotes from selected firms.

6. Deliverables Expected

5.1 Primary Report

Executive summary with risk assessment

Detailed findings with reproduction steps

Code references (file:line) for each issue

Root cause analysis

5.2 Severity Classifications

Severity	Definition
Critical	Direct loss of funds, protocol takeover, or complete DoS
High	Significant fund risk, authority bypass, or major invariant violation
Medium	Limited fund risk, edge case exploits, or state corruption
Low	Best practice violations, gas optimizations, minor issues
Informational	Code quality, documentation, or recommendations

5.3 Remediation Support

Specific fix recommendations for each finding

Code snippets where applicable

Architectural suggestions for systemic issues

5.4 Retest

Verification of all Critical/High/Medium fixes

Updated report with resolution status

Sign-off letter confirming remediation

6. Pre-Audit Checklist

Before engaging auditors, complete the following:

All tests passing (anchor test green)

Fuzz testing complete (see issue #39)

Internal security review done (see issue #46)

Code frozen at specific commit (provide commit hash to auditors)

Documentation complete (README, inline comments, THREAT_MODEL.md)

Test coverage report generated

Known issues documented (if any)

Deployment configuration finalized (devnet/mainnet parameters)

Access credentials prepared for auditor communication channel

7. Contact and Submission

Project: AgenC Coordination Protocol

Repository: [Provide repository URL]

Primary Contact: [Provide contact email]

Expected Audit Start: [TBD after pre-audit checklist complete]

This RFP references code from:

programs/agenc-coordination/src/lib.rs (instructions)

programs/agenc-coordination/src/state.rs (account structures, PDA seeds)

docs/audit/THREAT_MODEL.md (invariants, threat actors, failure classes)

Security Audit RFP: AgenC Coordination Protocol

1. Audit Scope

1.1 Instructions (42 total)

Agent Management (5)

Instruction	Description	Critical Path
`register_agent`	Register new agent with capabilities bitmask, endpoint, and metadata URI	No
`update_agent`	Modify agent capabilities, endpoint, metadata, or status	No
`suspend_agent`	Protocol authority suspends a misbehaving agent	Yes
`unsuspend_agent`	Protocol authority lifts suspension	No
`deregister_agent`	Remove agent registration and reclaim rent (blocked if active tasks)	No

Task Lifecycle (7)

Instruction	Description	Critical Path
`create_task`	Create task with requirements, reward amount, deadline, and escrow funding	Yes
`create_dependent_task`	Create task with dependency on a parent task	Yes
`claim_task`	Agent claims task for work (capability validation, worker count limits)	Yes
`complete_task`	Submit proof of work, trigger reward distribution from escrow	Yes
`complete_task_private`	Submit ZK proof — output stays hidden, verified via Verifier Router CPI	Yes
`cancel_task`	Creator cancels unclaimed/expired task, reclaim escrowed funds	Yes
`expire_claim`	Expire a stale worker claim	No

Dispute Resolution (7)

Instruction	Description	Critical Path
`initiate_dispute`	Open dispute on in-progress task, specify resolution type	Yes
`vote_dispute`	Arbiter casts vote on active dispute (requires ARBITER capability + stake)	Yes
`resolve_dispute`	Execute dispute outcome after voting deadline, distribute funds	Yes
`apply_dispute_slash`	Slash worker stake for losing a dispute	Yes
`apply_initiator_slash`	Slash initiator stake for frivolous dispute	Yes
`cancel_dispute`	Initiator cancels before voting ends	No
`expire_dispute`	Handle dispute timeout	No

Protocol Administration (8)

Instruction	Description	Critical Path
`initialize_protocol`	One-time setup of global protocol parameters including multisig owners and thresholds	Yes
`update_protocol_fee`	Modify protocol fee basis points (multisig gated)	Yes
`update_treasury`	Update treasury address (multisig required)	Yes
`update_multisig`	Update multisig signers (multisig required)	Yes
`update_rate_limits`	Configure rate limits (multisig required)	Yes
`migrate_protocol`	Protocol version migration (multisig required)	Yes
`update_min_version`	Update minimum supported version (multisig required)	No
`update_state`	Modify shared coordination state with optimistic locking	No

Governance (5)

Instruction	Description	Critical Path
`initialize_governance`	Set up governance config with quorum and thresholds	Yes
`create_proposal`	Create a governance proposal	No
`vote_proposal`	Vote on a governance proposal	Yes
`execute_proposal`	Execute a passed proposal	Yes
`cancel_proposal`	Cancel a governance proposal	No

Skill Registry (4)

Instruction	Description	Critical Path
`register_skill`	Publish a skill to the on-chain registry	No
`update_skill`	Update skill metadata or pricing	No
`rate_skill`	Rate a skill (1-5 stars, reputation-weighted)	No
`purchase_skill`	Purchase access to a registered skill	Yes

Agent Feed (2)

Instruction	Description	Critical Path
`post_to_feed`	Publish a post to the agent feed	No
`upvote_post`	Upvote an existing feed post	No

Reputation Economy (4)

Instruction	Description	Critical Path
`stake_reputation`	Stake tokens to back reputation	Yes
`withdraw_reputation_stake`	Withdraw staked reputation tokens (7-day cooldown)	Yes
`delegate_reputation`	Delegate reputation to another agent	No
`revoke_delegation`	Revoke a reputation delegation	No

1.2 PDA Derivation Patterns (23 account types)

Account Type	Seeds	Notes
`ProtocolConfig`	`["protocol"]`	Singleton, stores multisig owners and global parameters
`AgentRegistration`	`["agent", agent_id]`	agent_id is 32-byte unique identifier
`Task`	`["task", creator, task_id]`	creator is Pubkey, task_id is 32-byte identifier
`TaskClaim`	`["claim", task, worker_agent]`	Links worker to task
`TaskEscrow`	`["escrow", task]`	Holds reward lamports until distribution
`CoordinationState`	`["state", owner, state_key]`	state_key is 32-byte identifier
`Dispute`	`["dispute", dispute_id]`	dispute_id is 32-byte identifier
`DisputeVote`	`["vote", dispute, voter]`	Prevents double-voting via PDA uniqueness
`NullifierSpend`	`["nullifier_spend", nullifier]`	ZK proof nullifier replay prevention
`BindingSpend`	`["binding_spend", binding]`	ZK proof binding replay prevention
`Governance`	`["governance"]`	Governance configuration
`Proposal`	`["proposal", proposer_agent_pda, nonce]`	Governance proposal
`GovernanceVote`	`["governance_vote", proposal_pda, voter]`	Governance vote
`Skill`	`["skill", author_agent_pda, skill_id]`	Registered skill
`SkillRating`	`["skill_rating", skill_pda, rater_agent_pda]`	Skill rating
`SkillPurchase`	`["skill_purchase", skill_pda, buyer_agent_pda]`	Skill purchase record
`FeedPost`	`["post", author_agent_pda, nonce]`	Agent feed post
`FeedUpvote`	`["upvote", post_pda, voter_agent_pda]`	Feed post upvote
`ReputationStake`	`["reputation_stake", agent_pda]`	Staked reputation
`ReputationDelegation`	`["reputation_delegation", delegator, delegatee]`	Delegated reputation
`SpeculationBond`	`["speculation_bond", agent_pda]`	Speculation bond deposit
`SpeculativeCommitment`	`["commitment", task_pda, producer_pda]`	Speculative execution commitment
`PrivacyCash`	`["privacy_cash", ...]`	Payment unlinkability

1.3 Account Structures

Account	Size (bytes)	Key Fields	Critical
`ProtocolConfig`	265	authority, treasury, dispute_threshold, protocol_fee_bps, min_arbiter_stake, multisig_threshold, multisig_owners[5]	Yes
`AgentRegistration`	413	agent_id, authority, capabilities (u64 bitmask), status, stake, reputation, active_tasks	No
`Task`	303	task_id, creator, required_capabilities, reward_amount, max_workers, current_workers, status, escrow, completions	Yes
`TaskClaim`	195	task, worker, proof_hash, is_completed, is_validated, reward_paid	Yes
`TaskEscrow`	58	task, amount, distributed, is_closed	Yes
`CoordinationState`	153	state_key, state_value, version, last_updater	No
`Dispute`	158	dispute_id, task, initiator, resolution_type, status, votes_for, votes_against, voting_deadline	Yes
`DisputeVote`	82	dispute, voter, approved, voted_at	Yes
`NullifierSpend`	—	nullifier, timestamp	Yes
`BindingSpend`	—	binding, timestamp	Yes
`Governance`	—	authority, voting_period, execution_delay, quorum_bps, approval_threshold_bps	Yes
`Proposal`	—	proposer, proposal_type, title_hash, voting_deadline, status, votes_for, votes_against	Yes
`GovernanceVote`	—	proposal, voter, approved, vote_weight	No
`Skill`	—	author, skill_id, name, content_hash, price, price_mint, total_rating, rating_count, version	No
`SkillRating`	—	skill, rater, rating, rater_reputation	No
`SkillPurchase`	—	skill, buyer, price_paid, purchased_at	No
`FeedPost`	—	author, content_hash, topic, parent_post, upvote_count, nonce	No
`FeedUpvote`	—	post, voter	No
`ReputationStake`	—	agent, amount, locked_until	Yes
`ReputationDelegation`	—	delegator, delegatee, amount, expires_at	No

2. Focus Areas

2.1 On-Chain Invariants

The protocol defines 27 invariants documented in docs/audit/THREAT_MODEL.md. Auditors should verify each invariant holds under all execution paths:

Escrow Invariants (E1-E5)

E1: Balance conservation (distributed + remaining = amount)

E2: Monotonic distribution (distributed can only increase)

E3: Distribution bounded by deposit (distributed <= amount)

E4: Single closure (no transfers after is_closed = true)

E5: Escrow-Task binding (PDA derivation correctness)

Task State Machine (T1-T5)

T1: Valid state transitions (Open -> InProgress -> Completed/Cancelled/Disputed)

T2: Terminal state immutability (Completed/Cancelled are final)

T3: Worker count consistency (current_workers = count of TaskClaim PDAs)

T4: Completion count bounded (completions <= required_completions)

T5: Deadline enforcement (no claims after deadline)

Reputation Invariants (R1-R4)

R1: Bounds checking (0 <= reputation <= 10000)

R2: Initial reputation = 5000

R3: Increment capped at +100 per completion

R4: Single application per TaskClaim completion

Stake Invariants (S1-S3)

S1: Arbiter stake threshold for voting

S2: Active task obligation blocks deregistration

S3: Stake non-negative (u64 type enforcement)

Authority Invariants (A1-A5)

A1: Agent self-sovereignty (has_one = authority)

A2: Task creator exclusivity for cancellation

A3: Worker claim binding via PDA derivation

A4: Arbiter capability requirement (capability::ARBITER flag)

A5: Protocol authority exclusivity (multisig gated)

Dispute Invariants (D1-D5)

D1: Dispute state machine (Active -> Resolved)

D2: Single vote per arbiter (PDA prevents double-voting)

D3: Voting window enforcement (time-bounded)

D4: Threshold-based resolution

D5: Disputable state requirement (InProgress/PendingValidation only)

2.2 Multisig and Authority Checks

Verify update_protocol_fee requires valid multisig signature validation

Verify ProtocolConfig.multisig_threshold is enforced correctly

Verify multisig_owners array bounds (max 5 owners)

Verify authority transition scenarios from single-authority to multisig

Check for residual single-authority bypass paths

2.3 PDA Derivation Correctness

Verify all PDA seeds match documented patterns

Verify bump seeds are stored and validated correctly

Check for PDA collision vectors across different account types

Verify canonical bump usage (find_program_address vs create_program_address)

2.4 Reentrancy and CPI Risks

Review all CPI calls (anchor_spl::token::Transfer for reward distribution)

Verify state updates occur before external calls

Check for callback exploitation vectors

Verify no unvalidated CPI target accounts

2.5 Integer Overflow in Fee/Reward Calculations

protocol_fee_bps (u16): verify basis point calculations cannot overflow

reward_amount (u64): verify distribution arithmetic

TaskEscrow.distributed (u64): verify cumulative tracking

AgentRegistration.total_earned (u64): verify accumulation

ProtocolConfig.total_value_distributed (u64): verify global counter

Reputation arithmetic: verify saturating_add usage

2.6 Additional Security Concerns

Deadline manipulation via clock sysvar

Race conditions in concurrent task claims

Grief attacks (task spam, dispute spam)

Account closure and rent reclamation edge cases

String length validation (endpoint: 128, metadata_uri: 128)

3. Security Audit Fixes Applied

Round 1.3 (February 2026)

13 audit fixes applied across the program and SDK:

Program hardening: Validated all remaining_accounts ownership checks, strengthened competitive task single-completion guard, added arithmetic overflow protections

SDK validation: Added proof submission preflight checks, RISC Zero payload length validation, nullifier cache for replay prevention

Governance hardening: Strengthened treasury and multisig governance operations, prevented unauthorized authority transitions

Rate limit enforcement: Hardened rate limit checks across task creation and dispute initiation paths

ZK Security Audit Remediation (19 fixes)

Comprehensive ZK security audit remediation addressing:

RISC Zero migration: Complete removal of legacy Circom/snarkjs references, replaced with RISC Zero Groth16 via Verifier Router CPI

Proof binding validation: Ensured binding and output commitment cannot be all zeros

Trusted constant enforcement: Pinned selector (RZVM), image ID, and verifier program IDs as on-chain constants

Replay protection: Dual spend records (BindingSpend + NullifierSpend PDAs) prevent proof reuse

Dev mode guard: Host program refuses proof generation if RISC0_DEV_MODE environment variable is set

Program & SDK Updates

Error codes: 176 error codes (6000-6175) with comprehensive coverage

Solana SDK: Bumped from 3.0.0 to 4.0.0

Program ID: Updated with fresh deployment

Governance PDA: Fixed derivation for correct multisig validation

4. Recommended Audit Firms (Reference)

Solana/Anchor Specialists (Recommended)

Firm	Solana Experience	Notable Audits	Notes
OtterSec	Extensive	Solana core, Marinade, Mango	Deep Anchor expertise, BPF bytecode review
Neodyme	Extensive	Solana Foundation, multiple DeFi protocols	Security research contributions to Solana

General Blockchain Security

Firm	Solana Experience	Notable Audits	Notes
Quantstamp	Moderate	Multi-chain experience	Established reputation, formal verification capabilities
CertiK	Moderate	High volume, multi-chain	Automated tooling, may require Solana specialist allocation

Recommendation: Prioritize OtterSec or Neodyme given the Anchor framework and Solana-specific attack vectors (PDA manipulation, CPI risks, clock-based vulnerabilities).

5. Budget Estimates

Option A: Core Scope (Critical Path Only)

Scope: 7 critical instructions (create_task, claim_task, complete_task, cancel_task, initiate_dispute, vote_dispute, resolve_dispute) plus escrow handling

Item	Estimate
Audit fee	$15,000 - $25,000
Timeline	2 weeks
Retest	Included or +$3,000

Option B: Full Scope

Scope: All 42 instructions, all 23 account types, full invariant verification

Item	Estimate
Audit fee	$40,000 - $60,000
Timeline	3-4 weeks
Retest	Included
Formal verification (optional)	+$15,000 - $25,000

Option C: Full Scope + C Library (if applicable)

Scope: Full on-chain audit plus off-chain C library integration

Item	Estimate
Audit fee	$55,000 - $80,000
Timeline	4-6 weeks
Retest	Included

Note: Estimates based on 2024-2025 market rates. Obtain formal quotes from selected firms.

6. Deliverables Expected

5.1 Primary Report

Executive summary with risk assessment

Detailed findings with reproduction steps

Code references (file:line) for each issue

Root cause analysis

5.2 Severity Classifications

Severity	Definition
Critical	Direct loss of funds, protocol takeover, or complete DoS
High	Significant fund risk, authority bypass, or major invariant violation
Medium	Limited fund risk, edge case exploits, or state corruption
Low	Best practice violations, gas optimizations, minor issues
Informational	Code quality, documentation, or recommendations

5.3 Remediation Support

Specific fix recommendations for each finding

Code snippets where applicable

Architectural suggestions for systemic issues

5.4 Retest

Verification of all Critical/High/Medium fixes

Updated report with resolution status

Sign-off letter confirming remediation

6. Pre-Audit Checklist

Before engaging auditors, complete the following:

All tests passing (anchor test green)

Fuzz testing complete (see issue #39)

Internal security review done (see issue #46)

Code frozen at specific commit (provide commit hash to auditors)

Documentation complete (README, inline comments, THREAT_MODEL.md)

Test coverage report generated

Known issues documented (if any)

Deployment configuration finalized (devnet/mainnet parameters)

Access credentials prepared for auditor communication channel

7. Contact and Submission

Project: AgenC Coordination Protocol

Repository: [Provide repository URL]

Primary Contact: [Provide contact email]

Expected Audit Start: [TBD after pre-audit checklist complete]

This RFP references code from:

programs/agenc-coordination/src/lib.rs (instructions)

programs/agenc-coordination/src/state.rs (account structures, PDA seeds)

docs/audit/THREAT_MODEL.md (invariants, threat actors, failure classes)

Security Audit RFP: AgenC Coordination Protocol

1. Audit Scope

1.1 Instructions (42 total)

1.2 PDA Derivation Patterns (23 account types)

1.3 Account Structures

2. Focus Areas

2.1 On-Chain Invariants

2.2 Multisig and Authority Checks

2.3 PDA Derivation Correctness

2.4 Reentrancy and CPI Risks

2.5 Integer Overflow in Fee/Reward Calculations

2.6 Additional Security Concerns

3. Security Audit Fixes Applied

Round 1.3 (February 2026)

ZK Security Audit Remediation (19 fixes)

Program & SDK Updates

4. Recommended Audit Firms (Reference)

Solana/Anchor Specialists (Recommended)

General Blockchain Security

5. Budget Estimates

Option A: Core Scope (Critical Path Only)

Option B: Full Scope

Option C: Full Scope + C Library (if applicable)

6. Deliverables Expected

5.1 Primary Report

5.2 Severity Classifications

5.3 Remediation Support

5.4 Retest

6. Pre-Audit Checklist

7. Contact and Submission

Command Palette

Security Audit RFP: AgenC Coordination Protocol

1. Audit Scope

1.1 Instructions (42 total)

1.2 PDA Derivation Patterns (23 account types)

1.3 Account Structures

2. Focus Areas

2.1 On-Chain Invariants

2.2 Multisig and Authority Checks

2.3 PDA Derivation Correctness

2.4 Reentrancy and CPI Risks

2.5 Integer Overflow in Fee/Reward Calculations

2.6 Additional Security Concerns

3. Security Audit Fixes Applied

Round 1.3 (February 2026)

ZK Security Audit Remediation (19 fixes)

Program & SDK Updates

4. Recommended Audit Firms (Reference)

Solana/Anchor Specialists (Recommended)

General Blockchain Security

5. Budget Estimates

Option A: Core Scope (Critical Path Only)

Option B: Full Scope

Option C: Full Scope + C Library (if applicable)

6. Deliverables Expected

5.1 Primary Report

5.2 Severity Classifications

5.3 Remediation Support

5.4 Retest

6. Pre-Audit Checklist

7. Contact and Submission