Security Analysis

Defense in Depth.
Layered Deterrence.

Sequential PoW dependency chains, memory-hard mining, consensus-enforced integer arithmetic, layered bond deterrence, entropy-derived audits, and dual-gate emergency authorization. Security is structural, not promised.

CONSENSUS | 100% integer arithmetic · Zero floating-point

51% Attack Resistance

Sequential Dependency
CONVERGENCEX

Each ConvergenceX attempt requires 8 GB RAM (4 GB dataset + 4 GB scratchpad) and 100,000 sequential rounds. Even an attacker with unlimited CPUs cannot speed up a single attempt — parallelism only adds more independent attempts. Node validation requires only ~500 MB via Transcript V2 (11-phase verification at ~0.2ms).

PropertyValue
RAM per attempt8 GB (4 GB dataset + 4 GB scratchpad)
Rounds per attempt100,000 (strictly sequential)
Intra-attempt parallelismEliminated by state dependency
Inter-attempt parallelismMultiple cores = multiple independent attempts
ASIC advantage estimateLow multiples over modern CPUs
Difficulty adjustmentcASERT per-block, stable regardless of hashrate
Node RAM (verify only)~500 MB (no dataset, no scratchpad — anyone can run a node)
Key insight: An attacker with 1,000 cores runs 1,000 parallel attempts, not 1,000× faster on a single attempt. The sequential dependency chain is the fundamental defense. As mining becomes profitable, network hashrate grows naturally, continuously raising the attack threshold.
Chain Selection & Fork Resolution

SOST uses best-chain-by-cumulative-work selection, not longest-chain. Each block contributes work = floor(2^256 / (target + 1)). The chain with the highest total accumulated work wins. This prevents attacks using many easy blocks to outpace a shorter chain with more real work. This is the same approach used by Bitcoin.

Chain selectionHighest cumulative work (NOT longest chain)
Block work formulafloor(2^256 / (target + 1))
Fork resolutionAtomic — full rollback on failure
Max reorg depth500 blocks (~3.5 days)
Orphan vs forkSeparated: orphans (parent unknown) vs fork candidates (parent known)
Mempool recoveryValid non-coinbase txs returned to mempool after reorg; conflicts discarded

Bond Deterrence

The bond does not make fraud impossible — it makes it costly. Four layers of deterrence combine to make large-scale systematic fraud economically irrational.

LAYER 1

Financial Bond

Up to 30% of gold value locked as SOST bond. Immediate financial cost on slash. Bond is fully lost and redistributed to PoPC Pool and Gold Funding Vault.

LAYER 2

Reputation Destruction

Permanent record. Stars reset to zero. Future contracts blocked at all levels. Rebuilding reputation requires starting from scratch with 0.5 oz limits.

LAYER 3

Wallet Blacklist

Known fraudulent wallets excluded at the application layer. This is not consensus and does not affect the base chain — it is PoPC policy enforcement.

LAYER 4

Size Limits

New users (0 stars) can only commit 0.5 oz maximum. Large commitments require proven track record (5 stars = max 10 oz). Slow unlock prevents mass fraud.

Audit & Oracle Resistance

Audit Manipulation Resistance
ENTROPY-DERIVED
PropertyAnalysis
Audit sourceConvergenceX block entropy triple (block_id, commit, checkpoints_root)
PredictabilityNone — depends on 100K-round PoW that hasn't occurred
InfluenceNo party can predict or influence the schedule
Post-audit fraud windowNext random audit within the period (5-30% probability)
Detection costFull bond slash
Continuous custodyHistorical balance sampling at deterministic checkpoints
Oracle Manipulation Resistance
NO ON-CHAIN ORACLE
PropertyAnalysis
Consensus oracle dependencyNone — all consensus uses chain-internal data only
Bond price source7-day TWAP from exchanges with verifiable liquidity (resistant to single-block manipulation)
Price data roleAdvisory for PoPC bond sizing, not consensus-critical
User consentRequired — user signs exact bond terms before submission
Malicious bulletinUsers simply refuse to sign — no funds at risk

cASERT Security

Asymmetric Defense
ANTI-WEAPONIZATION

The asymmetric cASERT policy prevents attackers from exploiting difficulty relaxation.

ScenarioSignalcASERT Response
Attacker with high hashrateChain fast (negative signal)NORMAL mode — no relaxation
Genuine hashrate dropChain slow (positive signal)Relaxed stability — liveness preserved
Attacker benefitNone — stability requirements remain at maximum

Relaxed stability is only available when the chain needs help (hashrate dropped), never when an attacker is dominating. This is the correct security trade-off.

ParameterV1 (blocks <1450)V2 (blocks ≥1450)
Halflife48 hours24 hours
Per-block delta cap6.25%12.5% symmetric
Target spacing600s (unchanged)

V2 activated at block 1450 (no regenesis). Faster response to hashrate changes while maintaining stability.

Emergency Procedures

Incident Response
SCENARIO TABLE
ScenarioResponse
Critical bugFoundation pauses new PoPC contracts. Existing contracts continue unaffected.
Exchange hackHeritage Reserve on Ethereum is sealed with no operational interaction. Gold Funding Vault requires Foundation authorization for all operations.
XAUT/PAXG issuer riskEmergency Catastrophe: rotate (E1) or liquidate-buy-redistribute (E2). Requires dual gate.
Issuer risk (future only)Foundation redirects future purchases without consensus. Existing assets sealed.
Chain death (90 days)Dead-man switch. 60-day dissolution notice. After notice, Foundation may access reserve for orderly wind-down.
Key Hygiene
OPERATIONAL
PracticeDetail
Institutional keysOffline (cold), never on public nodes
Public nodesLow-balance hot wallets, no reserve keys
Address rotationPublished with full traceability and proofs
Wallet encryptionAES-256-GCM + scrypt (N=32768, r=8, p=1)

Transaction Safety Layer

Wallet-Layer Security (No Consensus Change)
IMPLEMENTED
FeatureDetail
Build hardeningStack protector, ASLR (PIE), RELRO, FORTIFY_SOURCE
Wallet encryptionAES-256-GCM + scrypt (N=32768), key material wiped with OPENSSL_cleanse
ECDSA signinglibsecp256k1 with LOW-S enforcement, side-channel resistant context
Fee-rate orderingRational arithmetic (integer-only), no floating-point consensus bugs
P2P protectionBan system (100pts = 24h), 64 max inbound, 4 per IP
RPC securityLocalhost-only default, Basic Auth, dangerous method documentation
cASERT RPCReal-time profile from node (casert_profile, casert_lag), no wall-clock estimation
What did NOT change: Consensus rules, supply, mining, emission, block validation, chain history.
No fork required: All security features live above the consensus layer.
Wallet Safety Features
IMPLEMENTED
FeatureStatus
Trusted address bookComplete — local address whitelisting with 4 trust levels (trusted/known/new/blocked)
New-address cooldownComplete — first-send warning + high-value alert for unknown addresses
Pre-send summaryComplete — full transaction summary with confirmation prompt before broadcast
Treasury safety profileComplete — daily limits, per-TX limits, vault mode, policy file (~/.sost/wallet_policy.json)
RBF (Replace-by-Fee)Complete — full RBF mempool policy, higher fee-rate replacement, no consensus change
CPFP (Child-Pays-for-Parent)Complete — package fee-rate aware block template builder, miner policy only
SOST-PSBT offline signingComplete — JSON+base64 format, create/sign/combine/finalize/broadcast
Native multisig (sost3)Complete — redeemScript-hash M-of-N CHECKMULTISIG, 2-of-3 treasury support
HD wallet (BIP39)Complete — 12-word seed phrases, CLI + web wallet compatible

Implementation Status

Security Components
CURRENT STATUS
ComponentStatus
Transaction signing (libsecp256k1)Complete
Consensus validation (R1-R14, S1-S12, CB1-CB10)Complete
cASERT unified difficulty (bitsQ + equalizer, E4–H9 profiles)Complete
Mempool validation and relayComplete
Transaction confirmation in blocksComplete
RPC authentication (--rpc-user/--rpc-pass)Complete
Coinbase maturity filter (1000 blocks)Complete
Dynamic fee calculation (CLI v1.3)Complete
Wallet encryption (AES-256-GCM + scrypt)Complete
P2P DoS protection (ban scoring, peer limits)Complete
Checkpoints + reorg limit (500 blocks / ~3.5 days)Complete
P2P encryptionActive (X25519 + ChaCha20-Poly1305, default on)
Trusted address book (4 trust levels)Complete
New-address cooldown warningComplete
Pre-send confirmation summaryComplete
Treasury safety profile (vault mode)Complete
RBF (Replace-by-Fee) mempool policyComplete
CPFP (Child-Pays-for-Parent) miner policyComplete
HD wallet (BIP39 seed phrases)Complete — web + CLI compatible

Vulnerability Reporting

Responsible Disclosure
PRIVATE ONLY

Do not open a public issue for security vulnerabilities. Use the private contact form.

ChannelURL
Security vulnerability reportsostcore.com/sost-contact.html → Select: Security Vulnerability Report
General issuesgithub.com/Neob1844/sost-core/issues
REPORTING A VULNERABILITY
If you discover a security vulnerability in SOST Protocol, please report it
responsibly through our secure contact channel:

1. Go to the Contact page: https://sostcore.com/sost-contact.html
2. Select subject: “Security Vulnerability Report”
3. Include the following ticket code in your message: SEC-DISC-2026
4. Describe the vulnerability in detail:
   • Affected component (node, wallet, explorer, P2P, RPC, consensus)
   • Steps to reproduce
   • Potential impact assessment
   • Suggested fix (if any)
5. Do NOT disclose the vulnerability publicly until we have acknowledged
   and addressed it.

Response time: We aim to acknowledge reports within 48 hours and provide
an initial assessment within 7 days.

Severity classification:
  CRITICAL — Consensus bypass, double-spend, remote code execution
  HIGH     — Key exposure, fund theft, P2P network disruption
  MEDIUM   — Denial of service, information disclosure, RPC abuse
  LOW      — UI bugs, non-exploitable edge cases

Reports classified as CRITICAL or HIGH may be eligible for recognition
in the project’s Security Hall of Fame.
Scope
IN / OUT
In ScopeOut of Scope
Consensus rule bypassSocial engineering
Private key exposureAttacks requiring physical access
Remote code executionThird-party dependencies (report upstream)
P2P protocol exploitsDenial of service via network flooding
RPC authentication bypassExplorer HTML (client-side only)
Wallet encryption weakness
Response time: Receipt acknowledged within 72 hours. Critical vulnerabilities (consensus bypass, key compromise, remote code execution) are prioritized for immediate fix. A public advisory will be published after the fix is released.
License: SOST Protocol is licensed under the MIT License. The source code is fully open-source and free to use, modify, and distribute. See the LICENSE file for full terms.