Skip to content

docs(stellar): add unified STRIDE threat model - #125

Open
TheWeirdDee wants to merge 1 commit into
wraith-protocol:developfrom
TheWeirdDee:docs/113-stellar-stride-threat-model
Open

docs(stellar): add unified STRIDE threat model#125
TheWeirdDee wants to merge 1 commit into
wraith-protocol:developfrom
TheWeirdDee:docs/113-stellar-stride-threat-model

Conversation

@TheWeirdDee

@TheWeirdDee TheWeirdDee commented Jul 23, 2026

Copy link
Copy Markdown

Summary

  • add a unified STRIDE threat model for all four core Stellar contracts
  • map every public contract entry point to at least one STRIDE category
  • document per-contract attack surfaces and implemented mitigations
  • reference relevant findings from existing contract audits
  • separate residual risks from mitigated threats
  • add contract-level READMEs linking to the unified threat model

Contracts covered

  • stealth-announcer
  • stealth-registry
  • stealth-sender
  • wraith-names

Validation

  • verified coverage against every public #[contractimpl] entry point
  • verified local Markdown links
  • ran git diff --check

Documentation-only change; no contract behavior was modified.

Closes #113

@drips-wave

drips-wave Bot commented Jul 23, 2026

Copy link
Copy Markdown

@TheWeirdDee Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@truthixify

truthixify commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

No CI signal on this branch. It predates recent workflow fixes on develop (pnpm 10 corepack pin, ci.yml trigger updates, etc). Rebase against latest develop and force-push; CI will fire on the new commit and I'll see the real state.

@TheWeirdDee
TheWeirdDee force-pushed the docs/113-stellar-stride-threat-model branch from 4d5ff75 to f61fe86 Compare August 7, 2026 10:28
@TheWeirdDee

TheWeirdDee commented Aug 7, 2026

Copy link
Copy Markdown
Author

No CI signal on this branch. It predates recent workflow fixes on develop (pnpm 10 corepack pin, ci.yml trigger updates, etc). Rebase against latest develop and force-push; CI will fire on the new commit and I'll see the real state.

Done, please can you check now?

@truthixify

truthixify commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Thanks for rebasing. Not mergeable yet: the threat model is stale against current develop. It misses public entry points like pause/unpause, multisig rotation, withdraw_many, bulk name actions, and auction methods. Please update the STRIDE table and residual risks for those surfaces, then push again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

STRIDE threat model for all four contracts

2 participants

@TheWeirdDee @truthixify