Internal review · 16 August 2026
Security review of protocol v8
This is not an independent third-party audit. The same people who wrote the cryptography wrote this page. Passing tests are not an outside review. The v4 inflation class is closed. New risk lives in light clients, a browser that stores a seed, and a network that is still small.
NFL2, genesis 061a052d…8d4b20de,
build 0.7.0. Full text:
AUDIT-2026-08-16.md.
The v4 write-up stays at
AUDIT-2026-08-12.md.
Closed — the v4 class
Unlimited mint, negative amounts, fake inputs, unsigned bodies,
cleartext recipients, height-based fork choice, world-readable seeds,
public wallet RPC. All closed. Locked by
exploit_regression.rs. Do not weaken that file.
Open on this chain
| # | Finding | Severity |
|---|---|---|
| I-01 | No review by anyone outside the project. This page is not that review. | High |
| H-01 | Hashrate is small. A laptop farm can reorg recent blocks. | High |
| L-01 | Phone and browser trust a node for what they show. The node cannot spend. | High |
| L-02 | The web wallet keeps the seed in localStorage. Script on that page = theft. The 24 words are the wallet. | High |
| L-03 | The website Worker sees every web-wallet scan_feed and submit_tx. | High |
| A-01 | Anonymity set = the other transactions in the same block. The network is tiny. | High |
| G-01 | Graph is mixed inside a block, not erased. No cut-through (one-sided payments). | Medium |
| N-11 | Stem/fluff is not full Dandelion++. A hop onto an old node still broadcasts. | Medium |
| N-12 | Tor is on by default. If it is down, the node falls back to clearnet and says so. | Medium |
| P-05 | The node you submit to is probably the origin of the transaction. | Medium |
| D-01 | Binaries are unsigned. Checksums are published. Verify them. | Medium |
| D-02 | One seed answers P2P, phones, and the web proxy. | Medium |
| L-04 | Light API is plain HTTP on :17888 and :80. Allowlist, not TLS. | Medium |
| W-05 | Wallet CSP needs 'wasm-unsafe-eval' to instantiate the module. | Low |
| S-01 | Terminal minted supply is 89,999,999.25, not 90 million. 0.75 NIGHT never exists. | Info |
| S-02 | Second public genesis in a month. Both failures are published. | Info |
What a stranger still cannot do
Assuming they do not have your seed and do not out-mine the network:
they cannot mint NIGHT, spend your output, put a negative amount on
chain, freeze an address, or read an amount or an nf1
off the ledger. They can lie to a phone, lie to a browser,
watch a web-wallet submit, and — with enough hashes — rewrite recent
blocks.
What still holds
Every full node checks
Σ UTXO − Σ kernel excess = (minted − burned) · G.
A kernel is a Schnorr signature over generator H.
Every output has a Bulletproof. Addresses never appear on chain.
View keys cannot spend. Fees burn while a subsidy exists, then pay
the miner. Zero premine, no admin key.
Recommendations
- Pay someone who did not write
nightfall-cryptoto read it (I-01). - Run a second seed, not by the same operator (D-02).
- Put TLS in front of the light API if you point a phone at your own node (L-04).
- Treat the 24 words as the wallet.
localStorageis a cache (L-02). - Do not mine most of the blocks if you invented the chain (H-01, A-01).
- Leave
exploit_regression.rsalone.
Reproduce:
cargo test -p nightfall-ledger --test exploit_regression.
Private reports: SECURITY.md on GitHub.
Not a certificate. Not 100% anonymous.