Summary

Eight parallel auditors fanned out across services lifecycle, payments/escrow, slashing, staking/MAD/LDV, beacon+bridges, governance/MBSM/blueprints, jobs/RFQ + indexer + bindings, and test-quality + gas. This PR lands the Tier-1 fixes: small, high-confidence, verified before patching, no interface-level redesigns or large refactors. Findings beyond this scope are listed at the bottom.

Security fixes

Service lifecycle

• H-1: register expireServiceRequest selector on TangleServicesFacet. The aa511c2 release shipped the function on ITangleServices but never registered the selector, so the cleanup path was unreachable on the proxy. The recent fix was incomplete.
• H-3: Active-status gate on every operator-exit entrypoint (scheduleExit, executeExit, forceExit, leaveService, forceRemoveOperator) so a stale operator can't fire exit paths on a Terminated service.
• M-1: approveService rejects requests past the expiry grace, mirroring rejectService. Closes the race where an operator could quietly activate a stale request.
• M-2: Reject duplicate operator entries in requestService*. Without this, req.operatorCount exceeds the unique approver count and the request can never reach activation.
• M-4: nonReentrant on terminateService and terminateServiceForNonPayment.

Slashing

• S-3: nonReentrant on proposeSlash and disputeSlash. Only executeSlash/executeSlashBatch/cancelSlash were guarded.
• S-2: TIMESTAMP_BUFFER symmetry on the Disputed branch of SlashingLib.isExecutable. The Pending branch had a 15s buffer; Disputed didn't.
• B-3: Reject bytes32(0) evidence in proposeSlash.
• bindings B-1: ITangleSlashing events realigned with what the protocol actually emits. SlashProposed is 8 fields (was 4), SlashExecuted is 4 fields (was 3); previously-missing SlashDisputed, SlashCancelled, SlashConfigUpdated declared. Rust consumers wired to the interface couldn't decode any slash event before this fix.

Quote signature binding (BREAKING)

• pay H-1 / jobs J-1: requester added to QUOTE_TYPEHASH and hashQuote ABI encoding. The field lived on the struct but was excluded from the typed data; an attacker who saw a signed quote could flip details.requester and the signature still recovered. Off-chain signers MUST update; existing pre-fix signatures are invalid against the new typehash. All in-tree signing helpers updated.

Payments

• H-2: _distributePaymentWithEffectiveExposure reverts when zero operators are active at billing time. The dev/treasury split was paying out while the operator+staker pool (default 60%) remained retained by the contract with no path back. Service owners recover escrow via terminateService -> withdrawRemainingEscrow.
• M-5: whenNotPaused on fundService, billSubscription, billSubscriptionBatch. Reward / refund claim paths remain unguarded so users can always exit.

Staking

• S-7: OperatorStatusRegistry.registerOperator resets per-(serviceId, operator) heartbeat / metrics state on (re-)register. Without this, isHeartbeatCurrent could return true before any new heartbeat landed.
• S-14: LiquidDelegationVault.requestRedeem rejects controller == address(0) so redeemer's burned shares aren't permanently locked.

Indexer

• I-1: SlashConfigUpdated event signature in indexer/config.yaml now declares all 6 fields (was 3); the old shape silently dropped every emission. Schema and handler updated.

Dead code removed

• src/exposure/ and test/exposure/ — orphan module reproducing bps math that already lives in src/core/PaymentsEffectiveExposure.sol. No production references. MockPriceOracle (still used by other suites) moved to test/mocks/.
• src/interfaces/IStreamingPaymentAdapter.sol — none of the four interfaces declared in this file are implemented or referenced anywhere.

Tests

• test/security/AuditFixesTest.t.sol pins five regressions: expire reach, approve-after-grace revert, duplicate-operator rejection, exit-on-terminated revert, zero-evidence slash revert.
• test_DisputeSlash_BondForfeitOnExecute warp adjusted by the new 15s buffer.

Bindings

Regenerated via cargo xtask gen-bindings. Version bumped to 0.12.0 for the breaking typehash + event-shape changes; CHANGELOG covers every fix.

Test plan

• forge build clean (0 errors)
• New regression tests pass: 5/5
• Impacted-area tests pass: 175/175 (slashing, services, quotes, RFQ, payments)
• Broad suite: 1391/1393 pass on this branch
• The 2 governance upgrade tests that fail (test_GovernorSelfUpgrade, test_TokenUpgradeViaGovernance) are pre-existing failures on origin/main — verified by stash + re-run. Not caused by this PR; recommend a separate fix.
• Reviewer to confirm the breaking typehash change is acceptable for the v0.12.0 bump given that all known off-chain signer paths in this repo are updated.

Findings deferred to follow-up PRs (out of scope)

Each was either too risky to bundle (architectural change, interface redesign) or needs design discussion before fixing:

• Beacon SSZ endianness (B-01) — auditor flagged little-endian uint64 extraction in BeaconChainProofs; tests pass because fixtures mirror the same packing. Needs spec verification against real EigenPod proofs before fixing.
• Cross-chain trust hardening — timelocks on setSlasher/setMessenger, hardened originalSender propagation.
• LDV redeem controller scoping (S-1) — interface change.
• registerAdapter migration logic (S-2) — needs deposit migration plan.
• ValidatorPodManager._slash (G-02) — O(N delegators) DoS; migrate to share-based pool.
• TNTLockFactory.getOrCreateLock (gov H-4) — front-run-able delegatee theft.
• MBSM authorization split (gov H-2/H-3) — re-pin and grace-period gates.
• Storage layout snapshot test for upgrade safety.
• ~20 missing event handlers in the indexer (I-2).
• RFQ payment trapping (pay H-3) — needs a new expireJobCall entrypoint.

🤖 Generated with Claude Code