SECHIVE VIZASL — Security Diamond Reactor

⚡ Fleet Sechive Status

Total Findings

POC Tests

Target Repos

Diamonds Mined

$50K

Current Target

Submitted (TN36)

🎯 Active Targets — Adelic Pouch Scan

Immunefi

The Graph

SOT / IAM / KMS

HIGH Ethena #012 — Insurance Fund = $0 · sUSDe haircut vector

POC-999 · 2/2 PASS · Fork: mainnet · Range: $10K–$75K+

CRITICAL Ethena #012 — Systematic USDe depeg (no insurance backstop)

POC-999-B · Coverage: 0 days at $150K/day · Max: 10% of $4.37B

MEDIUM LayerZero #001 — DVN trust model bypass (optionalDVNThreshold=1)

POC-001 · 3/3 PASS · Fork: mainnet · Range: $5K–$15K

MEDIUM Chainlink TN36 — Stale price feed in BaseAuction.sol

Report #76024 · SUBMITTED Day 88 · Status: PENDING TRIAGE

💎 Diamond Reactor

Diamonds light when proof-of-concept validates on mainnet fork

📦 Target Repositories

graphprotocol/contracts

374⭐ Sol

graphprotocol/graph-node

3128⭐ Rs

graphprotocol/indexer

257⭐ TS

graphprotocol/indexer-rs

31⭐ Rs

graphprotocol/graph-ts

218⭐ TS

Ethena / USDe

Sol

LayerZero / ULN

Sol

Chainlink / Feeds

Sol

🔍 Audit Trail — Trust Security Findings (The Graph)

H-1IndexingAgreement.collect() on CanceledByPayer — #1198

TRST-H-1 · Fixed · collect() callable after cancellation

H-2Only agreement owner can collect indexing fee — #1199

TRST-H-2 · Fixed · Missing access control on collect()

H-3collect() checks provision — #1200

TRST-H-3 · Fixed · collect without valid provision

M-1TYPEHASH type mismatch in RecurringCollector — #1201

TRST-M-1 · Fixed (twice: #1196, #1197) · EIP-712 signature mismatch

M-2shared collection window logic — #1202

TRST-M-2 · Fixed · Overlapping collection windows

M-3Nonce-based replay protection — #1203

TRST-M-3 · Fixed · Missing replay protection on signed messages

L-3Deterministic agreement ID — #1204

TRST-L-3 · Fixed · Non-deterministic IDs = frontrun vector

L-5Slippage protection — #1205

TRST-L-5 · Fixed · Missing slippage on token operations

L-6Agreement version check — #1206

TRST-L-6 · Fixed · Improper version validation

L-7update() documentation — #1207

TRST-L-7 · Documented · Missing NatSpec

L-9Cancel agreement if over-allocated — #1208

TRST-L-9 · Fixed · Over-allocation not detected

🦀 RUSTSEC Advisories — graph-node (Open)

RUSTSEC-2026-0114 Panic allocating table exceeding host memory — #6549

RUSTSEC-2026-0111 UTF-8 corruption in Diesel SQLite backend — #6547

RUSTSEC-2026-0104 Panic in CRL parsing — #6546

RUSTSEC-2026-0099 Name constraint bypass for wrong SANs — #6534

RUSTSEC-2026-0098 URI name constraint bypass — #6533

RUSTSEC-2026-0097 Rand unsound with custom logger — #6514-6516

RUSTSEC-2026-0096 🔴 Sandbox escape on aarch64 — #6506

RUSTSEC-2026-0095 🔴 Winch sandbox escape — #6503

RUSTSEC-2026-0094 Improperly masked table.grow return — #6509

RUSTSEC-2026-0093 Heap OOB in UTF-16 to latin1 — #6508

RUSTSEC-2026-0092 Panic on misaligned UTF-16 transcode — #6504

RUSTSEC-2026-0091 OOB write in component model transcode — #6511

RUSTSEC-2026-0088 Data leakage between pooling instances — #6507

RUSTSEC-2026-0087 Segfault with f64x2.splat — #6513

RUSTSEC-2026-0086 Host data leakage with 64-bit tables — #6510

RUSTSEC-2026-0085 Panic lifting flags component — #6512

RUSTSEC-2026-0049 CRL not authoritative by Distribution Point — #6448

RUSTSEC-2026-0037 DoS in Quinn endpoints — #6437

RUSTSEC-2026-0021 Panic adding excessive WASI HTTP fields — #6402

RUSTSEC-2026-0020 Guest-controlled resource exhaustion in WASI — #6401

RUSTSEC-2026-0007 Integer overflow in BytesMut::reserve — #6337

RUSTSEC-2026-0006 Segfault with f64.copysign — #6338

📊 KCF / COI / Actuarial

KCF Score (contracts)0.847

KCF Score (graph-node)0.912

COI (Complexity of Impact)HIGH

Actuarial Exposure$50K bounty

Trust Security Audits3 rounds

TRST Findings Total3H + 3M + 6L

Open RUSTSECs22

Wasmtime Sandbox Escapes2 🔴

Issues (contracts)78 issues + 922 PRs

Issues (graph-node)1,011+ items

Contract Files~50 .sol

Adelic DepthL3 (Gate Stack)

🗺️ SOT Graph Mapping — IAM / KMS Diamond Search

Staking.sol → stake/unstake/slash/delegate ↔ SOT: IAM role binding + permission escalation patterns

RewardsManager.sol → reward distribution + issuance ↔ SOT: KMS key rotation + reward claim authorization

GraphProxy.sol → upgradeable proxy pattern ↔ SOT: upgrade authority = root key rotation

Controller.sol / Governed.sol → governance + pause ↔ SOT: break-glass admin access / emergency procedures

BridgeEscrow.sol / L1GraphTokenGateway.sol → L1↔L2 bridge ↔ SOT: cross-boundary trust / federation token exchange

DisputeManager → dispute resolution + slashing ↔ SOT: incident response / security event adjudication

AllocationExchange.sol → allocation ↔ payment ↔ SOT: resource allocation authorization / quota management

RecurringCollector (TRST audit) → EIP-712 signed recurring payments ↔ SOT: signed authorization tokens / JWT rotation patterns

🏗️ Contract Architecture

📁 staking/5 files

📁 staking/libs/4 libs

📁 rewards/3 files

📁 curation/3 files

📁 discovery/3 files

📁 upgrades/4 proxies

📁 governance/4 files

📁 gateway/3 bridges

📁 l2/6 L2 files

📁 token/GraphToken.sol

📁 epochs/EpochManager

📁 payments/AllocationExchange

🔄 Pipeline Status

Fork Tests

5/5 PASS

Pelegos Scan

:9362 LIVE

Context Triad

:9370 LIVE

Moss Boards

113 seeded

Submissions

1 filed, 2 ready

Graph Scan

SCANNING

🔐 SECHIVE VIZASL