> For the complete documentation index, see [llms.txt](https://docs.bitsafe.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bitsafe.finance/decentralization-manager/operations-and-reference/audit-and-design-acknowledgements.md).

# Audit and design acknowledgements

[Security architecture](/decentralization-manager/operations-and-reference/security-architecture.md)

## What this audit covers

Quantstamp reviewed the Daml governance packages that implement threshold voting and selected governed actions for Decentralization Manager. The report does not certify the complete application or a production deployment.

<table data-search="false"><thead><tr><th>Record</th><th>Repository evidence</th></tr></thead><tbody><tr><td>Auditor</td><td>Quantstamp</td></tr><tr><td>Review period</td><td>20 May 2026 to 22 May 2026</td></tr><tr><td>Initial report and fix-review date</td><td>22 May 2026</td></tr><tr><td>Final report date</td><td>5 June 2026</td></tr><tr><td>Language</td><td>Daml</td></tr><tr><td>Methods</td><td>Architecture review, unit testing, functional testing, computer-aided verification, and manual review</td></tr><tr><td>Source revision on the report front page</td><td><code>c3f578b67848441c1782ce0198e46ae1fef121bb</code></td></tr><tr><td>Revision shown in the report scope section</td><td><code>80b502d01b214f8c22a7d6f52b967274043aba2e</code></td></tr><tr><td>Audit Report</td><td><a href="https://certificate.quantstamp.com/full/bitsafe-dec-manager/9d0b465f-46c1-41bc-8d56-cfb3d3c44a76/index.html">Report</a></td></tr></tbody></table>

{% hint style="info" %}
The report front page names `c3f578b` as the source revision. The scope section labels the included and excluded files with `80b502d`. Check both revisions when you assess the audited scope and the fix-review coverage.
{% endhint %}

## Included and excluded components

The report lists these included paths:

* `daml/governance-core/`
* `daml/governance-action-v0/`
* `daml/governance-token-custody/`
* `daml/governance-utility-onboarding/`

The report explicitly excludes `daml/dars/*`.

The report does not list the Rust backend or the web interface as audited components. It also does not list the identity-provider configuration, database, deployment manifests, container images, infrastructure, peer protocol or production operations. The appendix includes Rust and Daml test output. This test output does not expand the stated audit scope.

{% hint style="info" %}
An audit applies only to its stated files and revisions. It does not cover later changes, local configuration, dependencies, deployment controls, host security, or operator procedures unless the report explicitly includes them.
{% endhint %}

### Package names since the audit

The repository renamed the audited packages after the audit. The audit fixes are not upgrade-compatible with the `-v0` packages. The packages therefore moved to new package names. The rename went through an intermediate `-v1-rc1` name.

| Path in the report                    | Package name at `c3f578b`          | Path on `main`                        | Package name on `main`             |
| ------------------------------------- | ---------------------------------- | ------------------------------------- | ---------------------------------- |
| `daml/governance-action-v0/`          | `governance-action-v0`             | `daml/governance-action-v1/`          | `governance-action-v1`             |
| `daml/governance-core/`               | `governance-core-v0`               | `daml/governance-core/`               | `governance-core-v1`               |
| `daml/governance-token-custody/`      | `governance-token-custody-v0`      | `daml/governance-token-custody/`      | `governance-token-custody-v1`      |
| `daml/governance-utility-onboarding/` | `governance-utility-onboarding-v0` | `daml/governance-utility-onboarding/` | `governance-utility-onboarding-v1` |

The audited packages also changed after the audit. For example, `governance-utility-onboarding-v1` has version 0.5.0 on `main`. The audited revision has version 0.1.0. Use the file signatures in the report to find the audited code.

### Packages outside the audit scope

The report's included paths do not list these packages under `daml/`:

* `daml/governance-rewards-automation/` (`governance-rewards-automation-v1`). This package holds the CIP-104 reward actions and the coupon reassignment delegation. The repository added it after the audit. [Reward automation](/decentralization-manager/operations-and-reference/reward-automation.md) describes it.
* `daml/governance-utility-credential/` (`governance-utility-credential-v1`). The package exists at `c3f578b`. The report does not list it.
* `daml/orphan-marker/`. Only the integration tests use this package.
* The test packages, for example `daml/governance-rewards-test/` and `daml/governance-rewards-assign-test/`.

## Results

The executive summary records five findings:

* No high-severity findings.
* No medium-severity findings.
* Three low-severity findings, all recorded as fixed.
* Two informational findings, one recorded as fixed and one as acknowledged.

The report also records five auditor suggestions. It records S1, S2 and S5 as fixed, and S3 and S4 as acknowledged.

The fix-review update states that the team addressed the reported issues. It also states that the fixes match the recommendations. It names DLC-5, S3 and S4 as deliberate design acknowledgements, not code changes.

## Finding index

| ID    | Summary                                                            | Severity      | Report status                                                 | Referenced change                      |
| ----- | ------------------------------------------------------------------ | ------------- | ------------------------------------------------------------- | -------------------------------------- |
| DLC-1 | Permissionless creation of unarchivable confirmations              | Low           | Fixed                                                         | `0edb57f`                              |
| DLC-2 | Suboptimal `InstrumentID` setup                                    | Low           | Fixed                                                         | `8733d06`                              |
| DLC-3 | Governance execution audit trail lacks sufficient proposal context | Low           | Summary table: Fixed. Finding detail: client-marked Mitigated | `d2309cf`                              |
| DLC-4 | Expired confirmations can still be consumed directly               | Informational | Fixed                                                         | `59864eb`                              |
| DLC-5 | `GovernanceRules` permits 1-of-1 configurations                    | Informational | Acknowledged                                                  | Operational control, not a code change |

{% hint style="info" %}
The report summary marks DLC-3 as fixed. Its detailed update says that the client marked it mitigated. Read the summary and the detailed finding together when you evaluate its status.
{% endhint %}

## Auditor suggestions

| ID | Summary                                                    | Status       | Referenced change or treatment                       |
| -- | ---------------------------------------------------------- | ------------ | ---------------------------------------------------- |
| S1 | Improve on-ledger validation                               | Fixed        | `f3aa5af`                                            |
| S2 | Clarify the self-confirmation expiry choice name           | Fixed        | `688c43f`                                            |
| S3 | Governable actions cannot return typed execution artifacts | Acknowledged | Handled through design and documentation             |
| S4 | Missing generic archive actions                            | Acknowledged | Use narrowly scoped actions when cleanup is required |
| S5 | Minor code improvements                                    | Fixed        | `9b5dba3`                                            |

## Design acknowledgements

### 1-of-1 governance configurations

`GovernanceRules` permits one member with a threshold of one. The repository acknowledgement says that this supports bootstrap and development environments. A production deployment must move to at least two members and a threshold of at least two before it goes live. Teams that need an enforced minimum must apply that rule through their deployment or admission process.

### Execution artifacts

The Daml `GovernableAction_Execute` and `executeImpl` interfaces return `Update ()`. They do not return typed artifacts that the governed action creates. Downstream systems may need to inspect ledger events or rebuild the resulting state. The acknowledgement assigns the result shape to a planned HTTP delegation layer outside the on-ledger interface.

Treat the delegation layer as planned work unless the supported release documentation states that it is available.

### Archive actions

The implementation does not provide one generic governance action that can archive any contract that the governance party signed. The acknowledgement rejects that broad authority because one approved vote can archive unrelated contracts. The documented alternative is a dedicated, narrowly scoped `GovernableAction` for each specific cleanup capability.

## Operational considerations from the report

The report identifies properties that operators and integrators must account for:

* A `GovernanceExecutionResult` records a governance outcome. A historical reconstruction may need the transaction graph.
* A change to `actionConfirmationTimeout` applies to new confirmations, not existing confirmations.
* Some governed actions require confirmers to perform off-ledger validation.
* Action inputs can become invalid between proposal and execution.
* Membership and threshold changes apply to actions already in progress. They can block an action that was executable. They can also make an action executable that was not executable before.
* Governed token actions in the reviewed implementation pass empty requirements and credentials. The report says that these actions support permissionless tokens only.
* The proposer supplies the free-text descriptions and metadata. Confirmers must inspect the structured fields and not rely only on the description.
* The reviewed contracts do not provide an on-ledger emergency pause, partial-quorum revocation, or time-bounded delegation.

## How to use the report

1. Identify the exact release, tag, image and Daml packages that you plan to run.
2. Compare them with the audited revisions and file signatures. Map renamed packages with [Package names since the audit](#package-names-since-the-audit).
3. Read the scope, exclusions, findings, suggestions, and operational considerations.
4. Confirm that your release includes the remediation commits.
5. Apply the deployment, authentication, peer, backup, monitoring and hardening guidance to the parts outside this audit. These parts include the packages in [Packages outside the audit scope](#packages-outside-the-audit-scope).
6. Review the design acknowledgements before you approve a production configuration.

## Report integrity

* PDF SHA-256: `40f6bb26b91a92b5ba264b2e00bc2fbf438ea0b942315d7cbc4ea39a49c1d577`
* Audited source revision from the report front page: [c3f578b67848441c1782ce0198e46ae1fef121bb](https://github.com/DLC-link/decentralization-manager/commit/c3f578b67848441c1782ce0198e46ae1fef121bb)
* Scope-section revision: [80b502d01b214f8c22a7d6f52b967274043aba2e](https://github.com/DLC-link/decentralization-manager/commit/80b502d01b214f8c22a7d6f52b967274043aba2e)

## Technical sources

* [Quantstamp final report (PDF)](https://github.com/DLC-link/decentralization-manager/blob/main/docs/audits/QS-Bitsafe-dec-manager-final-audit-report.pdf)
* [Design acknowledgements](https://github.com/DLC-link/decentralization-manager/blob/main/docs/audit-acknowledgements.md)
* [Security policy](https://github.com/DLC-link/decentralization-manager/blob/main/docs/SECURITY.md)
* [Daml packages](https://github.com/DLC-link/decentralization-manager/blob/main/daml/multi-package.yaml)

## Next step

👉 **Place the report in context:** [Security architecture](/decentralization-manager/operations-and-reference/security-architecture.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.bitsafe.finance/decentralization-manager/operations-and-reference/audit-and-design-acknowledgements.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.