# Baseline audit: VSC Protocol + CEBA DApp

Date: 2026-02-12
Scope: initial full-system baseline across architecture, contracts, integration, tests, UI/UX signals, security signals, and delivery workflow.

## Evidence run

### `jdelos/vsc-protocol`

- `npm run protocol:check`: pass.
- `npm run protocol:artifacts:check`: pass; committed artifacts match canonical production build.
- 34 protocol tests pass.
- CI covers build, typecheck, tests, docs, phase-1 package checks, and artifact sync.
- Reentrancy regression coverage exists for payment-asset callbacks.
- Repository documents Phase 1 as invite-only €120k escrow baseline; real deposits and production launch remain gated.

### `jdelos/ceba-dapp-clean`

- `npm run vsc:protocol:typecheck`: pass.
- `npm run vsc:protocol:test`: pass; 33 tests.
- `npm run vsc:local:test`: pass; 11 tests.
- `npm run vsc:env:test`: pass; 9 tests.
- Existing launcher synchronizes deployment addresses and artifacts from the canonical protocol checkout.
- Existing DApp CI does not run the full production build, browser E2E, artifact validation, or all local integration checks.

## Findings

### P0 — security gate: webhook verification behavior needs immediate review

`src/pages/api/webhooks/alchemy.ts` contains log paths indicating signature verification can be bypassed. Confirm exact runtime branch and whether any production event can mutate state without valid authentication. Disable any bypass outside an explicitly local-only mode, add negative tests, and audit all webhook handlers for the same pattern.

### P1 — cross-repo release process is coupled to mutable checkout state

DApp launcher resolves a sibling or configured `vsc-protocol` checkout and copies generated artifacts/address data. This works locally, but does not prove that a DApp commit consumes a reviewed protocol commit. Add a compatibility manifest containing protocol commit, artifact hash, chain ID, contract addresses, and deployment profile. CI must validate it.

### P1 — DApp CI does not prove production readiness

Current DApp CI runs launcher tests, protocol typecheck, and protocol unit tests. It does not visibly run `npm run build`, `npm run vsc:protocol:validate`, the local-stack integration check, or Playwright flow. Add deterministic CI tiers: fast checks on every PR; local protocol/DApp integration on protocol-affecting changes; browser smoke flow when environment permits.

### P1 — transaction UX needs a state contract

DApp has contribution and confirmation routes plus wallet/KYC/payment integrations, but audit has not yet verified every user-visible state. Define and test one shared state model: eligibility blocked, wallet rejected, signature pending, transaction submitted, confirmation pending, confirmed, reverted, replaced, stale deployment, and retry-safe recovery.

### P1 — multiple money and identity boundaries increase operational risk

DApp combines Dynamic wallet auth, on-chain eligibility, KYC, Stripe, NowPayments, and database state. Each boundary needs an explicit owner, idempotency key, timeout/retry policy, and reconciliation path. Existing tests cover important KYC and protocol helpers; end-to-end cross-boundary evidence remains incomplete.

### P2 — repository contains stale or noisy surfaces

Protocol README documents `simulate` and `sandcastle` commands whose targets no longer exist. DApp search finds debug `console.log` calls and bundled saved HTML/video assets that pollute security scans. Remove stale commands or mark them archival; remove production logs and exclude generated assets from scans.

### P2 — coordination was previously implicit

Independent repos had local steering and artifact sync, but no shared issue graph or architecture decision home. `jdelos/ceba-matt` now owns cross-repo issues, glossary, ADRs, audits, and integration contracts.

## Current strengths

- Protocol has strong externally observable tests, explicit Phase 1 scope, custom errors, and payment-asset reentrancy coverage.
- DApp has deterministic local launch tooling, stale deployment protection, artifact synchronization, protocol configuration tests, and KYC status tests.
- Both repos document Node/npm requirements and local development flows.

## Audit limits

This is baseline audit, not formal smart-contract security review, penetration test, legal review, or full UX usability study. Next audit pass must inspect every external webhook branch, admin route, contribution route, contract access-control path, and critical browser flow.

## First iteration order

1. Verify and close webhook bypass risk.
2. Create protocol/DApp compatibility manifest and CI gate.
3. Add full DApp CI checks and deterministic local integration job.
4. Define transaction-state UX contract and browser smoke coverage.
5. Remove stale commands/debug output and document production launch gates.