Repository navigation
general-audit: main @ 401e2fc (2026-04-27) #413
Description
Main @ 401e2fc03d7a3d48e9d7d7cadb6c4b3370749ffd (merge of #410). Prior audit @ 2f26d91 (#391). Run via /general-audit.
Method
Spawn 8 parallel agents per concern. 7/8 stream-idle-timeout before writing findings (lessons issue follows). 1/8 (testcov) succeed. Main-context direct audit fill gaps. Second-pass grep verify each finding before file.
Concerns audited
- security: input-validation/DoS — direct
- security: auth/permissions — direct
- security: web/WASM — direct
- security: deps/supply-chain — direct (
cargo auditclean vs CI ignore list; all 5 warnings already tracked [DEP-01] rustls-webpki 0.103.10 has 3 open RUSTSEC advisories (name-constraint bypass + CRL panic) #223 [DEP-02] Three concurrentrandmajor versions + RUSTSEC-2026-0097 across all of them #246 [DEP-03] Workspace uses unmaintainedbincode 1.3for on-wire + on-disk serialization #247 [DEP-08] Unmaintainedpaste 1.0.15(RUSTSEC-2024-0436) — not in CI ignore list #316 [DEP-09] Unmaintainedproc-macro-error 0.4.12(RUSTSEC-2024-0370) — not in CI ignore list #317 [DEP-10] Unmaintainedatomic-polyfill 1.0.3(RUSTSEC-2023-0089) — not in CI ignore list #318) - tech debt — direct
- architecture (spec drift) — direct
- test coverage — agent
- general — direct
Strong areas (no findings)
- state crate purity: zero
tokio/iroh/std::fs/SystemTimeimports - wire deserialize defense-in-depth:
MAX_DESER_SIZE = 256 KB+ per-variantWireMessage::max_sizecap (crates/transport/src/lib.rs:36,154,crates/common/src/wire.rs:206) - event verify: signature + content-hash both checked on insert (
crates/state/src/dag.rs:117,event.rs:300) - pending-buffer cap:
DEFAULT_PENDING_MAX_ENTRIES = 10_000+ age-eviction (crates/state/src/sync.rs:139,142) - lock-ok comments present on every legitimate lib-crate lock (15 sites annotated; spec
docs/specs/2026-04-26-state-management-model-design.mdenforced) - no
unimplemented!()/todo!()/dbg!()/eprintln!()in lib code - TODOs all linked to design docs (sync-queue.md, profile-card.md, whisper-mode.md, reactions-pins.md) — well-tracked
- state machine: 109+ tests; all 24 EventKind + 5 Permission variants covered
- crypto: tampering / nonce-reuse / wrong-key paths tested
- HLC: 14 tests incl. overflow + drift
Findings (11 child issues)
Test coverage (10)
| # | Sev | Title |
|---|---|---|
| TC-1 | high | Voice mutation API (join_voice/leave_voice/toggle_mute/toggle_deafen/voice_peer_*) zero tests at any tier |
| TC-2 | high | Governance mutations (propose_grant_admin/propose_set_threshold/delete_role) no client-tier test |
| TC-3 | high | crates/client/src/mutations.rs 1023 LOC, 39 pub methods, zero in-file tests |
| TC-4 | high | Large untested client modules: listeners.rs (748), joining.rs (465), connect.rs (409), persistence_actor.rs (280), voice.rs |
| TC-5 | med | WASM-divergent code in lib crates has zero wasm_bindgen_test coverage (only crates/web/tests/browser.rs uses it) |
| TC-6 | med | crates/client/src/actions.rs no in-file tests |
| TC-7 | med | e2e/permissions.spec.ts wrong-tier: single-client conditional-rendering checks belong at wasm-pack tier |
| TC-8 | low | compare match/compare mismatch trust-badge flip only Playwright-covered; client-tier infra exists |
| TC-9 | low | Worker main.rs entrypoints (replay/storage/agent) no tests; CLI parsing + service wiring untested |
| TC-10 | low | Identity malformed-bytes paths (invalid hex EndpointId, malformed CBOR profile) under-tested |
Web security (1)
| # | Sev | Title |
|---|---|---|
| WS-1 | low | js_sys::eval(format!("…msg-{}…", msg_id.replace('\'', ""))) defense-in-depth: stripped only single-quote, swap for Element::scroll_into_view_with_options |
Dropped findings (verification falsified)
F4 ChannelRevive non-member-rejection test missing— exists atcrates/state/src/tests.rs:4147(non_member_cannot_revive_channelblock).F11— duplicate of [TEST-02]IrohNetworkgossip path integration-onlynetworkcrate critically under-tested for transport-layer code #340.F13 actor— duplicate of [TEST-04]performance.rs15#[ignore]d testsactorcrate tests all#[ignore]'d — zero default-CI coverage of actor runtime #232.
Existing-issue overlap noted (not re-filed)
Test density: #343 (overarching). Network coverage: #340. Relay coverage: #341. Actor ignore: #232. State integration: #274.
Worktrees
.worktrees/audit-{sec-input,sec-authperm,sec-webwasm,sec-deps,techdebt,arch,testcov,general} torn down post-file.
Activity