Security
Threat model & security posture
No feature ships because it is impressive. It ships only when its maximum authority, failure mode, recovery path, and revocation path are explicit and tested. V1 adds no custody contract: the system reads verified GIGA contracts, constructs constrained plans, simulates them, and submits calls from your own address.
Threats → controls
| Threat | Failure | Required control |
|---|---|---|
| Keeper compromise | Unauthorized or excessive calls | On-chain target/selector/recipient/spend/frequency limits; short expiry; revoke; no unrestricted user key. |
| Malicious or buggy planner | Wrong recipient, swap, approval, or range | Deterministic plan validation; simulation; recipient invariant; approval caps; independent tests. |
| Price manipulation / stale quote | Bad swap or range | TWAP/oracle deviation guard; freshness deadline; pre-submit requote; minimum output. |
| MEV & sandwiching | Execution loss | Tight slippage, protected submission where supported, short deadlines, price-impact caps. |
| GIGA Protect violation | Forfeited rewards | Read live parameters; compute next eligible time; hard-block unsafe harvest/liquidity action. |
| Partial rerange | Assets temporarily held as wallet balances | Resumable state machine; no third-party custody; explicit recovery UX. |
| Approval exposure | Token drain through approved spender | Exact or capped approvals; canonical routers only; revoke after action when practical. |
| Indexer / RPC failure | Wrong recommendation or unavailable app | Multiple providers; block consistency; fail closed; direct-chain recovery view. |
| Delegation implementation risk | Account takeover or persistent authority | Battle-tested implementation; published audit; immutable/tightly governed code; independent revoke path. |
Launch security gates · current status
| Capability | Cannot launch until | Status |
|---|---|---|
| Guided Compound | Fork tests, mainnet simulation, recipient invariant, slippage tests, canonical-contract allowlist, canaries. | Live |
| Guided Rerange | All Compound gates + points-accounting confirmation, partial-step recovery, old/new NFT reconciliation. | Live |
| Autopilot | Independent review of account implementation + policy config, revocation drill, keeper-compromise test, bounded-loss analysis. | Live |
| Reward routing | Final Genesis ABI verification, GIGA Protect tests, destination verification, no-default-sell confirmation. | Live |
Noncustodial guarantees
✓Your address remains the recorded GIGA position user. Ownership, points identity, and withdrawal control are preserved.
✓Guided execution requires your signature on every plan. Simulation runs immediately before submission and fails closed.
✕No component holds an unrestricted user private key or has unilateral authority to move funds.
✕No pooled vault, transferable share, or custody contract exists in V1.
Open source & disclosures
Chain 4663 · contract registry on the verification page. Threat model, known limitations, and architecture are documented in /docs in the open-source repository (THREAT_MODEL.md, CONTRACTS.md, LIMITATIONS.md). Unattended delegation will not enable until an independent review of the account implementation and policy configuration is published.