Acme Protocol — Full-system review

The vault settles balances after invoking a user-controlled fee plugin. An attacker can register a malicious plugin that re-enters settle() before the vault state is updated, draining funds across positions.

Apply checks-effects-interactions: write final balances and update internal accounting before invoking any external plugin. Add a non-reentrant guard on settle() and on every external function that mutates shares. Consider isolating plugin execution via a stateless adapter contract to remove the call from the trust boundary.

Admin impersonation issues a session inheriting the target user's role without re-validating the operator's permission scope on subsequent requests. After admin role is downgraded or revoked, the impersonated session retains elevated permissions until natural expiry.

Re-validate operator scope on every request that uses an impersonated session. Persist impersonation as a server-side state (not just JWT claim) and invalidate immediately on operator role change. Cap impersonation TTL to minutes, not hours, and require explicit re-authentication for impersonation.

The daily withdrawal limit is checked before acquiring the row-level lock on the user balance. Two concurrent withdrawals can each see the pre-debit limit and pass validation, allowing the user to withdraw up to 2x their daily cap.

Acquire the row-level lock on the user balance before evaluating limit. Compute remaining limit inside the same transaction. Add an idempotency key on the withdrawal API and reject duplicate-or-concurrent requests at the edge.

Settlement reads the oracle price without verifying timestamp staleness or deviation against the previous round. During an oracle stall or sudden depeg, settlement uses an arbitrarily old or manipulated price.

Require updatedAt to be within a configurable max-age (e.g. 30 minutes for slow assets, 1 minute for fast). Add a max-deviation guard against the previous round. Pause settlement on oracle failure rather than continuing on stale data.

The S3 bucket used for signed user uploads grants s3:ListBucket to anonymous principals on the /tmp/* prefix. While individual objects use random keys, the listing exposes their names and enables enumeration of all in-flight uploads.

Remove ListBucket from the public principal set entirely. Make the bucket fully private and serve uploads through pre-signed GET URLs only. Apply a bucket policy that denies any anonymous request as a backstop.

The GitHub OIDC trust policy on the production deployment role conditions on repository but not on workflow or branch. Any workflow in the repository — including PR-triggered workflows on untrusted forks — can request a token assuming the production role.

Constrain the OIDC trust policy on sub: claim to specific protected branches (e.g. refs/heads/main and tagged releases), and to specific workflow files. Require environment protection rules with mandatory reviewers for production deploys.

The admin user-search endpoint queries the users table without filtering on deleted_at. Soft-deleted user records — including email and KYC document IDs — remain searchable indefinitely after account deletion.

Filter on deleted_at IS NULL in the search query. Add a separate audited path for legitimate access to deleted records, with explicit reason logging and tighter ACL.

The password reset endpoint rate limits per IP at 60 requests per minute. Distributed clients can trigger reset emails for arbitrary users at scale, enabling targeted email-flooding harassment and engagement-cost attacks.

Add a per-target-account rate limit (e.g. 5 reset requests per hour per email), independent of IP. Return identical responses for known and unknown accounts to prevent enumeration as a side-effect of the limit.

The login endpoint returns subtly different responses for unknown email versus wrong password. While the textual message is identical, response timing differs by ~80ms in a way that allows user enumeration.

Use a constant-time path that performs a dummy bcrypt compare for unknown users. Audit all auth-adjacent endpoints for similar timing leaks.

Unhandled errors in production return a JSON body containing the full stack trace, including absolute file paths. Useful intel for an attacker mapping the system.

Strip stack traces in production responses. Log them server-side with a correlation ID returned to the client for support.