assets-components.json

{
  "nodes": [
    {
      "id": "asset-treasury-funds",
      "type": "asset",
      "title": "Treasury funds",
      "summary": "Protocol or organization funds held under privileged control. Confidentiality of keys and integrity of spend authority both matter.",
      "domains": ["governance-treasury"],
      "status": "proposed",
      "tags": ["treasury", "funds"],
      "roles": ["multisig-signer", "governance-participant"],
      "lifecycle": ["normal-operations", "incident-response"]
    },
    {
      "id": "asset-user-funds",
      "type": "asset",
      "title": "User funds",
      "summary": "Value users hold in the protocol or send through its interface. A compromised frontend or contract can drain it without touching the treasury.",
      "domains": ["onchain-systems", "infrastructure"],
      "status": "proposed",
      "tags": ["users", "funds"],
      "lifecycle": ["normal-operations"]
    },
    {
      "id": "asset-governance-authority",
      "type": "asset",
      "title": "Governance authority",
      "summary": "Power to pass proposals, change parameters, or upgrade contracts. Capture here rewrites the rest of the system.",
      "domains": ["governance-treasury"],
      "status": "proposed",
      "tags": ["governance", "upgrades"],
      "roles": ["governance-participant"],
      "lifecycle": ["normal-operations", "upgrade"]
    },
    {
      "id": "asset-source-code",
      "type": "asset",
      "title": "Source code",
      "summary": "Repositories that define contracts, off-chain services, and the frontend. Integrity failures become production failures.",
      "domains": ["development-supply-chain"],
      "status": "proposed",
      "tags": ["source", "repository"],
      "roles": ["engineer-developer"],
      "lifecycle": ["development", "upgrade"]
    },
    {
      "id": "asset-deployment-authority",
      "type": "asset",
      "title": "Deployment authority",
      "summary": "Permission to publish frontend builds, ship packages, or upgrade on-chain code. Whoever holds it can change what users run.",
      "domains": ["development-supply-chain", "onchain-systems"],
      "status": "proposed",
      "tags": ["deploy", "release"],
      "roles": ["engineer-developer", "infrastructure-operator"],
      "lifecycle": ["development", "pre-launch", "upgrade"]
    },
    {
      "id": "asset-domain-control",
      "type": "asset",
      "title": "Domain control",
      "summary": "Registrar, DNS, and names that users type. Losing it lets an attacker present a convincing drain site as the real product.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["dns", "domain", "registrar"],
      "roles": ["infrastructure-operator"],
      "lifecycle": ["normal-operations"]
    },
    {
      "id": "asset-secrets-credentials",
      "type": "asset",
      "title": "Secrets and credentials",
      "summary": "API keys, cloud roles, CI secrets, and account passwords. One leak often becomes infrastructure takeover.",
      "domains": ["devices-identity", "infrastructure"],
      "status": "proposed",
      "tags": ["secrets", "credentials"],
      "roles": ["engineer-developer", "infrastructure-operator"],
      "lifecycle": ["normal-operations"]
    },
    {
      "id": "asset-signer-keys",
      "type": "asset",
      "title": "Signer keys",
      "summary": "Private keys and devices that approve multisig or privileged transactions. Compromise is equivalent to authorized theft.",
      "domains": ["governance-treasury", "devices-identity"],
      "status": "proposed",
      "tags": ["keys", "signers", "hardware-wallet"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations", "incident-response"]
    },
    {
      "id": "asset-community-trust",
      "type": "asset",
      "title": "Community trust",
      "summary": "Willingness of users and partners to believe official announcements and click official links. Social engineering spends this asset first.",
      "domains": ["community-communications", "people"],
      "status": "proposed",
      "tags": ["community", "trust"],
      "roles": ["community-manager", "founder-executive"],
      "lifecycle": ["normal-operations"]
    },
    {
      "id": "component-smart-contracts",
      "type": "component",
      "title": "Smart contracts",
      "summary": "On-chain programs that custody funds or enforce protocol rules, including proxies and upgrade modules.",
      "domains": ["onchain-systems"],
      "status": "proposed",
      "tags": ["contracts", "evm"],
      "roles": ["engineer-developer"],
      "lifecycle": ["design", "development", "upgrade"],
      "framework": "external-security-reviews"
    },
    {
      "id": "component-multisig",
      "type": "component",
      "title": "Protocol multisig",
      "summary": "The multi-signature account that holds treasury, upgrade, or pause authority for the protocol.",
      "domains": ["governance-treasury"],
      "status": "proposed",
      "tags": ["multisig", "safe"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations", "upgrade"],
      "framework": "multisig-for-protocols"
    },
    {
      "id": "component-signers",
      "type": "component",
      "title": "Signers",
      "summary": "People and devices that hold shares of a privileged multisig. Their laptops and judgment are part of the control system.",
      "domains": ["people", "governance-treasury"],
      "status": "proposed",
      "tags": ["signers", "people"],
      "roles": ["multisig-signer"],
      "lifecycle": ["normal-operations"]
    },
    {
      "id": "component-founders-executives",
      "type": "component",
      "title": "Founders and executives",
      "summary": "High-authority people who are attractive phishing and coercion targets and often also hold signer or admin roles.",
      "domains": ["people"],
      "status": "proposed",
      "tags": ["leadership", "executives"],
      "roles": ["founder-executive"],
      "lifecycle": ["normal-operations"]
    },
    {
      "id": "component-hiring-pipeline",
      "type": "component",
      "title": "Hiring pipeline",
      "summary": "Recruiting, contracting, and access-granting steps that can admit a planted operator into code or infrastructure.",
      "domains": ["people"],
      "status": "proposed",
      "tags": ["hiring", "contractors", "dprk"],
      "roles": ["founder-executive"],
      "lifecycle": ["normal-operations"],
      "framework": "opsec"
    },
    {
      "id": "component-cloud-infrastructure",
      "type": "component",
      "title": "Cloud infrastructure",
      "summary": "Accounts, servers, and admin consoles that host backends, build agents, and operational tooling.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["cloud", "aws"],
      "roles": ["infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "infrastructure"
    },
    {
      "id": "component-rpc-endpoints",
      "type": "component",
      "title": "RPC endpoints",
      "summary": "JSON-RPC or similar nodes the product trusts for chain state and transaction broadcast.",
      "domains": ["infrastructure", "onchain-systems"],
      "status": "proposed",
      "tags": ["rpc", "nodes"],
      "roles": ["infrastructure-operator", "engineer-developer"],
      "lifecycle": ["normal-operations"],
      "framework": "infrastructure"

    },
    {
      "id": "component-frontend",
      "type": "component",
      "title": "Web frontend",
      "summary": "The site or app users load before connecting a wallet. Integrity failures here steal user funds without touching contracts.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["frontend", "ui"],
      "roles": ["engineer-developer", "infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "front-end-web-app"
    },
    {
      "id": "component-dns-registrar",
      "type": "component",
      "title": "DNS and registrar accounts",
      "summary": "Registrar logins, DNS panels, and nameserver configuration that decide where a domain points.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["dns", "registrar"],
      "roles": ["infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "infrastructure"
    },
    {
      "id": "component-ci-cd",
      "type": "component",
      "title": "CI/CD pipeline",
      "summary": "Build and release automation that can inject code, leak secrets, or publish a malicious artifact as a trusted release.",
      "domains": ["development-supply-chain"],
      "status": "proposed",
      "tags": ["ci", "cd", "build"],
      "roles": ["engineer-developer"],
      "lifecycle": ["development", "upgrade"],
      "framework": "devsecops"
    },
    {
      "id": "component-dependency-graph",
      "type": "component",
      "title": "Dependency graph",
      "summary": "Third-party packages, lockfiles, and registries the build consumes. A poisoned package becomes your code.",
      "domains": ["development-supply-chain"],
      "status": "proposed",
      "tags": ["dependencies", "npm", "supply-chain"],
      "roles": ["engineer-developer"],
      "lifecycle": ["development"],
      "framework": "supply-chain"
    },
    {
      "id": "component-developer-devices",
      "type": "component",
      "title": "Developer and signer devices",
      "summary": "Laptops, phones, and browsers used to write code, approve CI, or sign transactions.",
      "domains": ["devices-identity"],
      "status": "proposed",
      "tags": ["endpoint", "devices"],
      "roles": ["engineer-developer", "multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "opsec"
    },
    {
      "id": "component-governance-module",
      "type": "component",
      "title": "Governance module",
      "summary": "On-chain or off-chain proposal machinery that can move treasury or change protocol rules.",
      "domains": ["governance-treasury"],
      "status": "proposed",
      "tags": ["governance", "proposals"],
      "roles": ["governance-participant"],
      "lifecycle": ["normal-operations", "upgrade"],
      "framework": "governance"
    },
    {
      "id": "component-monitoring-stack",
      "type": "component",
      "title": "Monitoring stack",
      "summary": "On-chain watchers, logs, and alerting that decide whether an attack is noticed in time to contain it.",
      "domains": ["detection-incident-response"],
      "status": "proposed",
      "tags": ["monitoring", "alerting"],
      "roles": ["security-engineer", "incident-responder"],
      "lifecycle": ["normal-operations", "incident-response"],
      "framework": "monitoring"
    },
    {
      "id": "component-community-channels",
      "type": "component",
      "title": "Community channels",
      "summary": "Discord, Telegram, support inboxes, and social accounts that attackers impersonate or hijack.",
      "domains": ["community-communications"],
      "status": "proposed",
      "tags": ["discord", "social"],
      "roles": ["community-manager"],
      "lifecycle": ["normal-operations"],
      "framework": "community-management"
    },
    {
      "id": "component-identity-accounts",
      "type": "component",
      "title": "Identity and admin accounts",
      "summary": "Cloud, GitHub, registrar, and SaaS identities that grant privileged access when taken over.",
      "domains": ["devices-identity", "infrastructure"],
      "status": "proposed",
      "tags": ["iam", "accounts"],
      "roles": ["infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "iam"
    }
  ]
}