Security
PulseGrid settles real value on BOT Chain mainnet, so we are direct about what has and has not been reviewed. This page is the honest current posture. To report a vulnerability, see the security policy.
What protects funds
The guarantee is structural, not procedural: settleEpoch(deviceId, epoch) carries no amount, no verdict,
and no proof, and the vault re-derives pay-or-slash on-chain from device-signed facts and the policy. So the
security story is mostly "can anyone break that invariant," and it is backed by an adversarial test suite
(81 passing Foundry tests), including named tests that a keeper or agent cannot overpay, wrongly slash
an honest operator, pay an un-anchored or out-of-range interval, or double-settle. The
whitepaper states the threat model in full.
What review has happened
The contracts and app have had an internal, AI-assisted security and correctness review, run in two streams:
- Multi-agent code review. Six AI reviewers (one per area: contracts, Go agent, web reads, web writes, web UI, wiring and claims) read the code and reported findings; every finding was then re-checked by two independent AI skeptics, each defaulting to "not a defect" unless it could confirm one.
- Live drive. The running app exercised end-to-end: every route renders, every API endpoint returns real live-chain data, and error paths return the right status codes.
This is a self-conducted review using AI tooling. It is not a third-party audit and should not be read as one.
What it found (and fixed)
The review found and fixed a genuine critical bug: an early version of ServiceContract.setSLA authorized
against the caller-supplied funder rather than the stored one, which would have let an attacker overwrite a
device's policy and drain the honest funder's escrow. It is fixed (authorization is against the stored
operator or incumbent funder) with regression tests. Several lower-severity issues (retroactive SLA
repricing, a reorg ledger-duplication, a relayer ack-versus-inclusion gap, and others) were fixed or have a
documented, accepted residual. The full list, dispositions, and residual risks are maintained internally
and will be published alongside the external audit.
What has not happened yet
We would rather state the gaps than imply they are closed:
- No third-party audit. An independent audit of the contracts is the single largest outstanding trust item and is planned. See the roadmap.
- No paid bug bounty yet; also planned.
- Key custody is being decentralized. Today one operator key holds several roles; moving the treasury and contract owner to a multisig and running a second keeper are on the roadmap.
Reporting
Report suspected vulnerabilities privately to emmanuelolamiye@gmail.com (subject PulseGrid security).
Please do not open a public issue or exploit against mainnet. Good-faith researchers who follow
the policy have safe harbor.
Until an external audit is complete, treat the deployment accordingly and do not commit funds you cannot afford to lose (see the risk and disclaimer).