A threat model is the document that turns "secure" from an adjective into a list. EmpoorioChain's is in the repository, dated, and cross-referenced to the mainnet gate. This post summarises it and marks what is in place.
Assumptions
The network is a testnet; mainnet is blocked by audit, decentralization and benchmark gates. Consensus is Aura/GRANDPA/BEEFY unless the consensus status document proves otherwise. Eoonia Wallet is inside the critical perimeter. EmpooScan is public evidence, not a source of truth — the truth is the L1.
Critical assets
DMS balances and any bridged representations; the runtime Wasm and its storage migrations; validator, session and operator keys; the DeFi, bridge, account-abstraction, paymaster, AI, PQC, ZK and identity pallets; public RPC, the indexer, dashboards and CI/CD; the signing UX in Eoonia.
Threats and controls
| Surface | Threats | Required controls | In place |
|---|---|---|---|
| Consensus | finality loss, equivocation, low participation, version skew, single operator/RPC, peer attacks | validator audit script, decentralization dashboard and report, best/finalized lag and peer alerts, upgrade policy with rollback and try-runtime | Script and report: yes. Two validators: the single operator threat is the current state |
| Runtime | overflow in balances/fees/rewards/rent, incomplete migrations, duplicate pallets or broken metadata, wrong weights enabling cheap DoS, partially applied signed extensions | bounded arithmetic, try-runtime, metadata diff per upgrade, benchmarked weights, extension format documented | Bounded state since 215; weights hand-written, not measured; extension format documented since 7 Sep |
| Wallet | seed exposure, blind signing, stale metadata, wrong chain id | encrypted import, decoded calls, metadata refresh per upgrade, RED.json for chain id | Yes, after the September audit |
| Bridge | replay, escrow mismatch, relayer compromise | replay protection, threat model, E2E testnet bridge | Not done; wrapped token on Sepolia has zero escrow and represents nothing |
| PQC/ZK | classical-signature fallback on sealed accounts, invalid proofs accepted | sealed accounts reject classical; Groth16 verified in runtime | Sealing: yes. External PQC/ZK audit: not commissioned |
| Infrastructure | host compromise, leaked credentials, quota exhaustion | incident playbooks, secrets in a manager, monitored databases | Playbooks: yes. Two host compromises and one leaked key in 2026, all handled |
The audits
The mainnet gate requires three external audits — DeFi (DEX, lending, vaults), PQC/ZK, and mobile (Eoonia, the apps) — with frozen scopes in AUDIT_SCOPE.md, zero critical or high findings open, and certificates published. None has been commissioned. A page on the official website that listed completed audits by named firms was removed in September 2026 because it was untrue. This model is the input to those audits, not a substitute for them.
Fuzzing and formal methods
Required: fuzz suites in CI for DEX, lending, bridge, ZK verifier and intents; formal verification of the AMM invariant x·y ≥ k with Kani. Status: partial fuzzing, no formal proof.
The security readiness matrix
SECURITY_READINESS_MATRIX.md tracks each control per pallet group. Read together with the gate, it says what this post says: the model is written, the cheap controls are in place, the expensive ones — external audits, measured weights, a real bridge — are not.
Raising the bar
The bar was raised in 2026 not by adding controls but by removing false claims: audits that never happened, hosts that never existed, validators that were template data. A threat model is only useful over an honest inventory, and the inventory is now honest.
Based on THREAT_MODEL.md (2026-05-29), SECURITY_READINESS_MATRIX.md, AUDIT_SCOPE.md and MAINNET_GATE.md Gate 1.