Security Report Request: High-severity logic flaw

[whitebrendan]

Hey there,

I've found a critical logic flaw in your contracts during a code review. I have prepared a PoC and a fix. What is the best private way to reach you to share this information securely?

Best regards,
White Brendan

[5kyguy]

Post the flaw here. This project is in development and not live for users. We can resolve it openly.

[whitebrendan]

Thanks for the clarification, SkyGuy. However, I must respectfully disagree with the assessment that this is not a vulnerability.

While the executor role is indeed restricted, the purpose of a Spending Policy is typically to act as a secondary guardrail precisely for when a privileged role (like the executor) is compromised or acts maliciously. If the policy itself relies on untrusted input (declaredUsdValue) from the very entity it is supposed to restrict, the enforcement becomes purely nominal.

In a robust security architecture, a policy should verify the state independently (e.g., via price oracles) rather than trusting the caller to declare the value of their own transaction. I hope you will reconsider the severity of this design flaw.

Best regards,
Security Researcher

[5kyguy]

Noted.

Rest assured, this project is not live yet. And the implementations for this apparatus to run are currently only on local.

We shall consider and rectify this before we go live.