# HYBX OMNL — threat model and audit scope

## Trust boundaries

- **On-chain policy** (`PolicyMath`, `ComplianceCore`) is deterministic given inputs `(S0, S1, R)` from `IERC20.totalSupply` and `ReserveCommitmentStore`.
- **Economic truth of R** depends on **custodian attestation** and operational security of signing keys — not on PMM or spot price oracles.

## Threats and mitigations

| Threat | Impact | Mitigation |
|--------|--------|------------|
| Compromised `RESERVE_COMMITTER` key | Fake reserves | Multisig / HSM, key rotation, monitoring on `ReserveCommitted` |
| Compromised attestation signer set (`commitReserveAttested`) | Forged threshold commits | Rotate `isAttestationSigner`, raise `attestationThreshold`, monitor `lineAttestationNonce` |
| Compromised CCIP lane | Wrong mirror updates | `allowedSourceSelectors`, replay protection on `messageId` |
| Malicious ERC-20 (inflated totalSupply) | False compliance | Register only audited tokens; avoid rebasing tokens without adapter |
| Governance capture | Parameter / role theft | Timelock, split roles (`GUARDIAN`, `PAUSER`), multi-sig admin |
| API layer spoofing | Misleading dashboard | API reads **only** from published `ComplianceCore` addresses; publish ABIs |

## External audit scope (recommended)

1. `contracts/hybx-omnl/*.sol` — policy rounding, reentrancy (minimal external calls), access control.
2. `OMNLMirrorReceiver` — decoding, version monotonicity, selector allowlist.
3. Operational: HSM usage for `commitReserve`, CCIP operational runbooks.

Structured checklist: [EXTERNAL_AUDIT_CHECKLIST.md](EXTERNAL_AUDIT_CHECKLIST.md).

## Key ceremony (outline)

- Generate `RESERVE_COMMITTER` / admin keys in HSM; no plaintext long-lived prod keys in CI.
- Document signer roster on-chain (`bytes32` merkle root optional extension) for auditor parity.
