Peer review.
Push on the boundaries.
This page separates deployed facts, observed mainnet behavior, pending tests and future integration. It is intentionally more precise than marketing copy.
V2.0.2 remains untouched.
The existing Solidity ABI runtime is not the hardened Meta test line. No V2.1 migration has been performed.
cosmos1f4ng0u0ym80vppf29fy8q8055mfje3u20xldrv6p94y7juq7z7zqe4jg970x218dab07aeb18fca8cc326e4183d38d1d1866fd957BA28DFBD2F67CB7795F830FC30CE5783D0430B741F91F3B92A63C40301ACCFCosmosHub Solidity ABI Runtime bindingEnd-to-end mainnet proof.
The important claim is authorization, not outer-transaction signing. MetaMask signed the intent; Keplr relayed the Cosmos SDK transaction.
0x1314a9aaf2dcb4c2fd65a22aee30a43ac33d6e19cosmos14ek3zjc6can42w3ustaujp93nyhg5pvcf5dddec2j5rtga5rq37sdvs7q6cosmos1qhcf6sr7xtr9zaw6wk7s44209yctdv4ykzf2hy7vuk8vkwjn3z3ssdfyfk624F71722C6743F2A80B6E521C7140C774B61130DFC21FA903EA7C110175C8E404D5F17D8A7CF6D6FA8C30B9E01CFC6435061D15822EB97BB630B841A466E447Deployment and attack matrix.
Only observed results are marked passed. Implemented-but-untested controls remain explicitly pending.
719 · 25ef415b73e8ade703408f646af839bf63ff880a6bca5a4ea84fdc35240592fd720 · 7705067666618c633ee6a52b4cd4e99f75cca33206c6bb769ad01f1a9c8afdc7cosmos1xw0rqrjgekrerjrz55n09ezuajcdw2pqp204w2kdsya7szmx55ssug3f89cosmos14u8hrq7tez3e3pdlhyg4jtgp6jk3jdyzfq9vl3srzclzxl6680qq9np32501BEDCCF56630A4870A77A11F30B715CCCA491E8A42AD170F0F71482C04EF174394E70D38825F300231999DC4B15D222A488DD2BF084CA9A1606144FDF943BE5Contract-produced canonical creation message signed and relayed; Code-719 account created.
Valid signed execution landed and exec_nonce advanced 0 → 1.
Changed amount against the signed payload rejected before the valid transaction.
Same signed intent rejected after nonce advancement.
Per-tx and rolling-window boundary cases remain to be completed.
Grant, execute, overspend, replay, revoke and regrant/epoch cases remain.
Old-controller authorization + new-controller acceptance still to be observed.
Requires a guardian-configured account; schedule, delay and execute cases remain.
Pause/epoch and template-timelock negative cases remain.
Deliberately blocked until the hardened architecture passes the acceptance gate.
Where to attack first.
These are the boundaries most likely to matter if TWIX Meta eventually graduates into a V2.1 design.
- Canonical serialization: verify every signable byte string comes from contract query output and cannot diverge across frontends.
- secp256k1 / EIP-191 recovery: review low-S enforcement, recovery-id normalization and H160 derivation.
- Replay boundaries: attack namespace, chain, account, generation, nonce, expiry and controller transitions.
- Relayer economics: attempt fee substitution, cap bypass and exact-relayer redirection.
- Session lifecycle: attempt stale-signature resurrection after revoke/regrant and generation changes.
- Recovery and rotation: test dual authorization, delay enforcement, cancellation and old-generation invalidation.
- Wasm boundary: confirm session keys cannot smuggle value movement through generic contract calls.
- Factory/index separation: ensure registry failures cannot seize or block controller authority.
Download what we are reviewing.
Source packages are provided for technical inspection. v0.2 remains experimental and should not be treated as audited custody software.
Runtime V2.0.2 source
Source for the canonical Code-681 runtime line.
Download →TWIX Meta v0.1 contract review source
Contract/shared types for the proven mainnet line.
Download →TWIX Meta Hardened v0.2 source
Current hardening source line.
549fc17c66f8017c95a9f66b386fe3749f279a942d0d7a6e007a3f9fe235614fDownload →Hardened browser test console
Standalone peer-review console corresponding to the integrated Meta Account Center.
Download →