From 4c0ce011c30b9ed134b5fe1c359af4efbc0ff96f Mon Sep 17 00:00:00 2001 From: Carlos Paniagua Date: Tue, 1 Sep 2026 03:28:43 +0000 Subject: [PATCH 1/2] chore: explicitly scope contracts/asserter-consumer in SECURITY.md SECURITY.md's Scope section only said 'the contracts under contracts/' without naming asserter-consumer specifically, even though it calls out demo-consumer by name as out of scope. A reader skimming the doc had no way to tell whether asserter-consumer was deliberately in scope or just forgotten. Explicitly list contracts/tholos, contracts/tholos-v2, and contracts/asserter-consumer as in scope, per the issue's proposed wording. Closes #122 --- SECURITY.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 17d6fd4..da2706e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,7 +26,8 @@ issue to be triaged and, where applicable, patched before any public disclosure. ## Scope -In scope: the contracts under `contracts/` in this repository. Out of scope: -third-party dependencies (`soroban-sdk`, the Stellar network itself), and the -`contracts/demo-consumer` example, which exists to validate integration patterns -and is not intended for production use on its own. +In scope: the contracts under `contracts/` in this repository, including +`contracts/tholos`, `contracts/tholos-v2`, and `contracts/asserter-consumer`. +Out of scope: third-party dependencies (`soroban-sdk`, the Stellar network +itself), and the `contracts/demo-consumer` example, which exists to validate +integration patterns and is not intended for production use on its own. From 5d3e3a8bf89152603a474ed1825b1e97e5d4a832 Mon Sep 17 00:00:00 2001 From: Carlos Paniagua Date: Wed, 2 Sep 2026 17:00:33 -0600 Subject: [PATCH 2/2] Add rationale for why asserter-consumer differs from demo-consumer --- SECURITY.md | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index da2706e..806ebab 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,8 +26,20 @@ issue to be triaged and, where applicable, patched before any public disclosure. ## Scope -In scope: the contracts under `contracts/` in this repository, including -`contracts/tholos`, `contracts/tholos-v2`, and `contracts/asserter-consumer`. +In scope: `contracts/tholos`, `contracts/tholos-v2`, and `contracts/asserter-consumer`. + +`contracts/asserter-consumer` is, like `contracts/demo-consumer`, an integration +example rather than a production deployment — but it demonstrates a materially +different, more security-sensitive pattern. Where `demo-consumer` has the end +user sign and authorize the assertion directly, `asserter-consumer` uses the +`authorize_as_current_contract` pattern from +[INTEGRATION.md](docs/src/INTEGRATION.md), where the contract self-authorizes +a fund transfer on its own behalf with no human signer in the loop. That +self-authorization construction is exactly what a real integrator is expected +to copy into production, so a vulnerability in this reference implementation +carries direct downstream security impact even though the example itself +never holds real value. `demo-consumer`'s pattern has no comparable surface to +get wrong, which is why it stays out of scope below. + Out of scope: third-party dependencies (`soroban-sdk`, the Stellar network -itself), and the `contracts/demo-consumer` example, which exists to validate -integration patterns and is not intended for production use on its own. +itself), and `contracts/demo-consumer`.