Skip to content

docs(explanations): correct protocol behavior and fill gaps from audit - #160

Merged
thephez merged 1 commit into
dashpay:4.1.0from
thephez:4.1/expl-updates
Aug 17, 2026
Merged

docs(explanations): correct protocol behavior and fill gaps from audit#160
thephez merged 1 commit into
dashpay:4.1.0from
thephez:4.1/expl-updates

Conversation

@thephez

@thephez thephez commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Apply the pre-existing findings (v4.1.0 and earlier) from the explanations section audit against the platform source.

Corrections:

  • Groups are append-only rather than frozen at contract registration: existing groups are immutable, but a contract update can add groups at new positions.
  • The daily credit withdrawal limit is a fixed protocol constant, not a proportion of total credits on Platform that scales with the network.
  • Attribute state transition validation to the platform state machine rather than Tenderdash, and describe Drive storage as current state rather than a record of state transitions.
  • Scope the contract update index allowance to newly added document types, and widen the restriction to cover all index definitions rather than only unique ones.
  • Data triggers can bind to any document transition action, not just create, replace, and delete.
  • The fee multiplier is recorded and reported per epoch but is not applied when distributing collected fees.
  • Token cost minimum and maximum bounds are attached by the submitting client, not declared by the contract.
  • Perpetual distribution schedules can be epoch-based in addition to block- and time-based.
  • Spell the document create field as $prefundedVotingBalance.
  • Describe the platform chain as secured by evonode quorums anchored to the core chain, reserving Proof of Service for its glossary meaning.
  • Split the DAPI endpoint overview into per-transport bullets so the layer coverage of each is accurate.

Additions:

  • $creatorId base field, and a document transition base section covering the identity contract nonce and token payment info.
  • On-chain transfer, purchase, and pricing history for NFT document types.
  • Adding a token to an already registered contract.
  • Vote extensions and their use for quorum-signing withdrawals.
  • Storage refund front-loading and the minimum refundable size; storage refunds netting to a credit.
  • Shielded pool protocol version availability, plus change notes and the creation-failure fallback address.
  • Contract-level description field.
  • System data contract versioning notes on DPNS and DashPay.
  • Cross-references to the proofs explanation and to the token, NFT, and document tutorials.

Preview build: https://dash-docs-platform--160.org.readthedocs.build/en/160/

Apply the pre-existing findings (v4.1.0 and earlier) from the explanations section audit against the platform source.

Corrections:

- Groups are append-only rather than frozen at contract registration: existing groups are immutable, but a contract update can add groups at new positions.
- The daily credit withdrawal limit is a fixed protocol constant, not a proportion of total credits on Platform that scales with the network.
- Attribute state transition validation to the platform state machine rather than Tenderdash, and describe Drive storage as current state rather than a record of state transitions.
- Scope the contract update index allowance to newly added document types, and widen the restriction to cover all index definitions rather than only unique ones.
- Data triggers can bind to any document transition action, not just create, replace, and delete.
- The fee multiplier is recorded and reported per epoch but is not applied when distributing collected fees.
- Token cost minimum and maximum bounds are attached by the submitting client, not declared by the contract.
- Perpetual distribution schedules can be epoch-based in addition to block- and time-based.
- Spell the document create field as $prefundedVotingBalance.
- Describe the platform chain as secured by evonode quorums anchored to the core chain, reserving Proof of Service for its glossary meaning.
- Split the DAPI endpoint overview into per-transport bullets so the layer coverage of each is accurate.

Additions:

- $creatorId base field, and a document transition base section covering the identity contract nonce and token payment info.
- On-chain transfer, purchase, and pricing history for NFT document types.
- Adding a token to an already registered contract.
- Vote extensions and their use for quorum-signing withdrawals.
- Storage refund front-loading and the minimum refundable size; storage refunds netting to a credit.
- Shielded pool protocol version availability, plus change notes and the creation-failure fallback address.
- Contract-level description field.
- System data contract versioning notes on DPNS and DashPay.
- Cross-references to the proofs explanation and to the token, NFT, and document tutorials.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 17, 2026

Copy link
Copy Markdown

Caution

CodeRabbit couldn't post its review summary.

Error details
No server is currently available to service your request. Sorry about that. Please try resubmitting your request and contact us if the problem persists.

@thephez
thephez merged commit b84ac43 into dashpay:4.1.0 Aug 17, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant