> For the complete documentation index, see [llms.txt](https://docs.bitsafe.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bitsafe.finance/decentralization-manager/operations-and-reference/audit-and-design-acknowledgements.md).

# Audit and design acknowledgements

[Decentralization Manager security architecture](/decentralization-manager/operations-and-reference/security-architecture.md)

### What this audit covers

Quantstamp reviewed the Daml governance packages that implement threshold voting and selected governed actions for Decentralization Manager. The report does not certify the complete application or a production deployment.

<table data-search="false"><thead><tr><th>Record</th><th>Repository evidence</th></tr></thead><tbody><tr><td>Auditor</td><td>Quantstamp</td></tr><tr><td>Review period</td><td>20 May 2026 to 22 May 2026</td></tr><tr><td>Report and fix-review date</td><td>22 May 2026</td></tr><tr><td>Language</td><td>Daml</td></tr><tr><td>Methods</td><td>Architecture review, unit testing, functional testing, computer-aided verification, and manual review</td></tr><tr><td>Source revision on the report front page</td><td><code>c3f578b67848441c1782ce0198e46ae1fef121bb</code></td></tr><tr><td>Revision shown in the report scope section</td><td><code>80b502d01b214f8c22a7d6f52b967274043aba2e</code></td></tr></tbody></table>

{% hint style="info" %}
The report front page identifies `c3f578b` as the source revision, while the scope section labels included and excluded files with `80b502d`. Review both revision references when assessing the audited scope and fix-review coverage.
{% endhint %}

### Included and excluded components

The report lists these included paths:

* `daml/governance-core/`
* `daml/governance-action-v0/`
* `daml/governance-token-custody/`
* `daml/governance-utility-onboarding/`

The report explicitly excludes `daml/dars/*`.

The report does not list the Rust backend, web interface, identity-provider configuration, database, deployment manifests, container images, infrastructure, peer protocol, or production operations as audited components. The appendix includes Rust and Daml test output, but test output does not expand the stated audit scope.

{% hint style="info" %}
An audit applies only to its stated files and revisions. It does not cover later changes, local configuration, dependencies, deployment controls, host security, or operator procedures unless the report explicitly includes them.
{% endhint %}

### Results

The executive summary records five findings:

* No high-severity findings.
* No medium-severity findings.
* Three low-severity findings, all recorded as fixed.
* Two informational findings, one recorded as fixed and one as acknowledged.

The report also records five auditor suggestions. S1, S2, and S5 are recorded as fixed. S3 and S4 are recorded as acknowledged.

The fix-review update states that the team addressed the reported issues and that the fixes aligned with the recommendations. It also identifies DLC-5, S3, and S4 as deliberate design acknowledgements rather than code changes.

### Finding index

| ID                                      | Summary                                                            | Severity      | Report status        | Referenced change                      |
| --------------------------------------- | ------------------------------------------------------------------ | ------------- | -------------------- | -------------------------------------- |
| DLC-1                                   | Permissionless creation of unarchivable confirmations              | Low           | Fixed                | `0edb57f`                              |
| DLC-2                                   | Suboptimal `InstrumentID` setup                                    | Low           | Fixed                | `8733d06`                              |
| DLC-3                                   | Governance execution audit trail lacks sufficient proposal context | Low           | Summary table: Fixed |                                        |
| Finding detail: client-marked Mitigated | `d2309cf`                                                          |               |                      |                                        |
| DLC-4                                   | Expired confirmations can still be consumed directly               | Informational | Fixed                | `59864eb`                              |
| DLC-5                                   | `GovernanceRules` permits 1-of-1 configurations                    | Informational | Acknowledged         | Operational control, not a code change |

{% hint style="info" %}
The report summary marks DLC-3 as fixed, while its detailed update says the client marked it mitigated. Read the summary and detailed finding together when evaluating its status.
{% endhint %}

### Auditor suggestions

| ID | Summary                                                    | Status       | Referenced change or treatment                       |
| -- | ---------------------------------------------------------- | ------------ | ---------------------------------------------------- |
| S1 | Improve on-ledger validation                               | Fixed        | `f3aa5af`                                            |
| S2 | Clarify the self-confirmation expiry choice name           | Fixed        | `688c43f`                                            |
| S3 | Governable actions cannot return typed execution artifacts | Acknowledged | Handled through design and documentation             |
| S4 | Missing generic archive actions                            | Acknowledged | Use narrowly scoped actions when cleanup is required |
| S5 | Minor code improvements                                    | Fixed        | `9b5dba3`                                            |

### Design acknowledgements

#### 1-of-1 governance configurations

`GovernanceRules` permits one member with a threshold of one. The repository acknowledgement says this supports bootstrap and development environments. A production deployment must transition to at least two members and a threshold of at least two before it goes live. Teams that require an enforced minimum must apply that rule through their deployment or admission process.

#### Execution artifacts

The Daml `GovernableAction_Execute` and `executeImpl` interfaces return `Update ()`. They do not directly return typed artifacts created by the governed action. Downstream systems may need to inspect ledger events or reconstruct resulting state. The acknowledgement says a future HTTP delegation layer is intended to own the result shape outside the on-ledger interface.

Treat the delegation layer as planned work unless the supported release documentation states that it is available.

#### Archive actions

The implementation does not provide one generic governance action that can archive any contract signed by the governance party. The acknowledgement rejects that broad authority because one approved vote could archive unrelated contracts. The documented alternative is to add a dedicated, narrowly scoped `GovernableAction` when a specific cleanup capability is required.

### Operational considerations from the report

The report identifies properties that operators and integrators must account for:

* A `GovernanceExecutionResult` records a governance outcome, but historical reconstruction may require the transaction graph.
* A change to `actionConfirmationTimeout` applies to new confirmations, not existing confirmations.
* Some governed actions require confirmers to perform off-ledger validation.
* Action inputs may become invalid between proposal and execution.
* Membership and threshold changes apply to actions already in progress. They may block an action that was executable or make a previously unsuccessful action executable.
* Governed token actions in the reviewed implementation pass empty requirements and credentials. The report says these actions support permissionless tokens only.
* Free-text descriptions and metadata can be supplied by the proposer. Confirmers must inspect structured fields rather than rely only on the description.
* The reviewed contracts do not provide an on-ledger emergency pause, partial-quorum revocation, or time-bounded delegation.

### How to use the report

1. Identify the exact release, tag, image, and Daml packages you plan to run.
2. Compare them with the audited revisions and file signatures.
3. Read the scope, exclusions, findings, suggestions, and operational considerations.
4. Confirm which remediation commits are included in your release.
5. Apply the deployment, authentication, peer, backup, monitoring, and hardening guidance for the parts of the application outside this audit.
6. Review the design acknowledgements before approving a production configuration.

### Report integrity and source links

* [Quantstamp final report at the reviewed repository snapshot](https://github.com/DLC-link/decentralization-manager/blob/76d7156c85e605abc008e5fadf8aaa97f4706471/docs/audits/QS-Bitsafe-dec-manager-final-audit-report.pdf)
* [Design acknowledgements at the reviewed repository snapshot](https://github.com/DLC-link/decentralization-manager/blob/76d7156c85e605abc008e5fadf8aaa97f4706471/docs/audit-acknowledgements.md)
* PDF SHA-256: `40f6bb26b91a92b5ba264b2e00bc2fbf438ea0b942315d7cbc4ea39a49c1d577`
* Audited source revision from the report front page: [c3f578b67848441c1782ce0198e46ae1fef121bb](https://github.com/DLC-link/decentralization-manager/commit/c3f578b67848441c1782ce0198e46ae1fef121bb)
* Scope-section revision: [80b502d01b214f8c22a7d6f52b967274043aba2e](https://github.com/DLC-link/decentralization-manager/commit/80b502d01b214f8c22a7d6f52b967274043aba2e)

### Next step

👉 **Place the report in context:** [Decentralization Manager security architecture](/decentralization-manager/operations-and-reference/security-architecture.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bitsafe.finance/decentralization-manager/operations-and-reference/audit-and-design-acknowledgements.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.