All issues

Search results

Attestation trust root: which PCRs are pinned, and can a debug enclave pass?

Status: Open.

#30 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Lockbox nonce lifecycle: verify encrypted secret nonce is consumed after partial sign

Status: Open.

#29 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Browser wallet stores seed phrase and signing material unencrypted in localStorage

Status: Open.

#28 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Bindings never re-evaluate recorded confirmed spends after reorgs

Status: Open.

#27 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Duplicate-sweep freeze window: late-discovered bindings block or strand value

Status: Open.

#26 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

MTP taken from tip block mediantime; single unauthenticated time oracle

Status: Open.

#25 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Network::Signet hardcoded in transfer chain-facts derivation

Status: Open.

#24 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Single-Esplora trust for all chain facts (tip, MTP, UTXOs, outspends, broadcast)

Status: Open.

#23 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

All state locktimes are always already-final; stale updates have no time disadvantage

Status: Open.

#22 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Lockbox uses assert() on secp256k1 failures; release builds compile the checks out

Status: Open.

#21 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Tracking: no stale-state recovery path in wallet (StateUpdate rebinding is test-only)

Status: Open.

#20 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026

Optional token_server_url config is unconditionally unwrapped in deposit token check

Status: Open.

#19 In stutxo/mercurylayer;

· Rob1Ham opened on Sep 5, 2026