Internal technical self-review
Internal code review covering build verification, security checks, test coverage, and code quality across the KYA Daml codebase. All 33 tests pass. Zero compiler warnings.
Not a third-party audit
This is an internal self-review performed by the KYA development team, not an independent third-party security audit. While we have verified that the code compiles, all tests pass, and no obvious security issues exist, a self-review cannot substitute for independent verification. A formal third-party audit is planned before production deployment. The source code is open for independent inspection on GitHub.
33
of 33 passing
Daml Script tests
0
compiler warnings
Clean build
13
of 13 templates created
Template coverage
9
of 21 choices exercised
Choice coverage
01 — Build verification
Pass
Compiles to kya-0.1.0.dar with zero errors and zero warnings. All imports verified, no dead code.
Pass
33 Daml Script tests execute against the in-memory ledger. All pass. No flaky or skipped tests.
Verified
daml-prim, daml-stdlib, daml-script. No external packages. FeaturedAppStub used in place of splice DAR.
02 — Security review
Every Daml template, choice, and verification function was reviewed for authorization gaps, missing validations, and data integrity problems.
| ID | Finding | Module | Status |
|---|---|---|---|
| SEC-001 |
rewardSplit had no validation — values >1.0 or negative would produce invalid reward weights
Fixed: added |
Application.daml | Fixed |
| SEC-002 |
agentParty on verification request was not validated against agentCredential.holder
Fixed: added assertMsg checking holder == agentParty in KyaVerificationRequest_Verify |
Application.daml | Fixed |
| SEC-003 |
Settlement hook controller changed from integratingApp to kyaProvider for visibility correctness
Fixed: kyaProvider must exercise settlement to have visibility on FeaturedAppRight. Authority flows correctly via bilateral signatory set. |
Application.daml | Fixed |
| SEC-004 |
principalParty on proof is derived from agentCredential.issuer rather than principalCredential.holder
Noted: correct for the two-hop delegation model where the principal issues the agent credential. Monitor if delegation model changes. |
Application.daml | Noted |
| ID | Check | Module | Status |
|---|---|---|---|
| SEC-010 | Credential signatory requires both issuer and holder | CredentialStub.daml | Pass |
| SEC-011 | KyaVerificationRequest signatory is requester only; kyaProvider is observer | Application.daml | Pass |
| SEC-012 | KyaVerificationRequest_Verify controlled by kyaProvider | Application.daml | Pass |
| SEC-013 | KyaVerificationProof signatory is kyaProvider; verifier is observer | Application.daml | Pass |
| SEC-014 | KyaVerificationProof_Consume checks expiry before archiving | Application.daml | Pass |
| SEC-015 | Credential validFrom/validUntil checked during verification | Verifier.daml | Pass |
| SEC-016 | Schema version validated (“1”) before any other checks | Verifier.daml | Pass |
| SEC-017 | Transaction value checked against maxTransactionValue | Verifier.daml | Pass |
| SEC-018 | Instrument ID checked against allowedInstruments list | Verifier.daml | Pass |
| SEC-019 | Delegation chain validates issuer is in trusted issuers list | Verifier.daml | Pass |
| SEC-020 | Settlement hook requires bilateral signatures (kyaProvider + integratingApp) | Application.daml | Pass |
| SEC-021 | KyaSettlementHook_Execute is nonconsuming (reusable across transactions) | Application.daml | Pass |
| SEC-022 | Revocation registry checks credential ID before issuing proof | Application.daml | Pass |
| SEC-023 | Daily volume tracker checked and updated atomically in verify choice | Application.daml | Pass |
| SEC-024 | KyaDailyVolumeTracker ensures usedVolume >= 0.0 | Application.daml | Pass |
| SEC-025 | Validation hook results fetched and all must pass before proof creation | Application.daml | Pass |
| ID | Warning | Status |
|---|---|---|
| SEC-030 | proofValiditySeconds has no upper bound — KYA provider is trusted, and excessively long proofs are an operational concern not a security one | Warn |
| SEC-031 | Claim values are all Text with no type enforcement at the Daml level — validation happens in verifier functions which return typed results | Warn |
| SEC-032 | FeaturedAppRight is a stub — real Canton splice-api-featured-app DAR may have a different interface | Warn |
03 — Test coverage
Verifier & Schema
15
Pure verification tests
Application layer
12
On-ledger flow tests
Hooks & profiles
6
Validation & discovery
Verifier
Valid credential, expired, missing version, bad agent class, capability check, instrument filtering, tx limits, decimal parsing (3 tests), code hash extraction
Verifier
Valid two-hop chain, broken chain (untrusted issuer), principal credential matching
Application
Full request-to-proof flow, verification failure, expired proof rejection, hook results wired into proof
Application
Settlement hook exercise, activity marker creation with reward split, proof consumption on settlement
Application
Revoked credential blocked, clean registry passes, daily volume within limit, daily volume exceeds limit
Hooks & profiles
Sanctions hook (pass/fail), exposure limit hook (pass/fail), profile publish & disclose, attestation creation
04 — Code quality
9
Source modules
714
Source LOC
1
Test module
1,026
Test LOC
05 — Known limitations
06 — Next steps
Source code