task_060726_4 — Foundry contracts security review + Filecoin provider recommendation (Similoluwa)

[umeradl]

cc @Abidoyesimze

Trial task assigned for Jul 7–13, 2026 (deadline Monday, July 13). Full spec: Developer/tasks/task_060726_4.md

Summary

Two independent parts:

Part 1 — Security review of all 7 contracts in foundry/src/ (Days 1–3), pinned to commit d136ff3. Severity-tagged findings report covering the usual classes (access control, reentrancy, unchecked calls, gas-DoS) plus proxy-specific checks for the 4 upgradeable platform contracts (initializer protection, storage layout, upgrade-path access control). Findings-only — no API/storage/behavior changes; Foundry PoC tests encouraged.

Part 2 — Filecoin provider recommendation, Discussion #18 (Days 4–5). Hands-on third-party retrieval verification per candidate provider, an FVM-native assessment, a written recommendation posted on #18, and best-effort provider credits/grant leads. Context: PR #16's Lighthouse adapter finding (upload works, retrieval payment-gated).

Reference material for the security audit

Documentation/technical/upgradable-contracts/ has been updated in commit 805ce9d. These docs refer to the code in PR #13 for the hardhat contracts and tests — and those hardhat contracts are identical to the foundry/src/ contracts on develop that you're reviewing. All of this documentation (proxy pattern rationale, deployment architecture, design decisions) should be a helpful companion for the security audit.

Questions, pushback, or anything ambiguous in the task spec — raise it here.

[umermjd11]

Closing — both parts delivered.

Part 1 — security review: Documentation/technical/audits/foundry-src-security-review.md merged in two parts — PR #22 (204268b, original report + PoC tests) and PR #30 (8b75518, severity escalation + real gas measurements). All 7 contracts covered, proxy-specific checks included for the 4 upgradeable platform contracts, the seeded DINTaskAuditor leads (slashing loop, pool iteration, shuffle predictability) confirmed with reasoning. 10 PoC tests in foundry/test/SecurityFindings.t.sol, confirmed present and passing on current develop. No API/storage/behavior changes made, per the task's hard boundary.

Part 2 — Filecoin provider recommendation: posted as a comment on Discussion #18 — hands-on retrieval verification for Storacha and Lighthouse, a clear recommendation (Storacha Forge), and an FVM-native assessment (Filecoin Onchain Cloud's PDP proofs + Filecoin Pay cover what custom escrow/SLA logic would have built from scratch).

The Storacha integration work that followed on Discussion #18 is new scope from that follow-up ask, not part of this task's original checklist — tracked there, not a reason to keep this one open.