{
  "recordTitle": "BitcoinOS BitSNARK/Grail trust-model audit and finite-model checks",
  "researchCutoff": "2026-08-21",
  "scope": {
    "productionSystemClaimed": false,
    "purpose": "Test historical public technical statements and sale-period substantiation against published protocol artifacts, Bitcoin consensus semantics, exhaustive finite Boolean and threshold enumeration, and constructive counterexamples.",
    "excluded": "This historical audit covers public artifacts and valueless models. Production deployment, fund-movement, and legal-intent findings require separate operational and evidentiary records."
  },
  "definitions": {
    "guyLiteralNoCoalitionClaim": "There is no counterparty and no person or group together can steal a user's bridge funds.",
    "auditAssumptionFreeIdeal": "For every permitted execution, no person or group can cause BTC to be released to a claimant as acceptance of an invalid bridge claim without relying on a trusted setup, effective challenger, signer, hardware vendor, data source, or operator. This formal audit definition is distinct from the separately preserved speaker quotations.",
    "effectiveChallengeEvent": "E_i(e) means verifier i's complete required conflict and dispute sequence becomes canonical before every competing timeout in execution e.",
    "conditionalOneOfNSafety": "An invalid claimant release is blocked when E_1(e) OR ... OR E_n(e) is true. Honesty, availability, correct data and computation, funding, and timely inclusion are separate premises required to make E_i(e) possible.",
    "safety": "An invalid bridge claim cannot release the locked BTC to its claimant as acceptance of that claim. A safe refund or recovery to another authorized party is not classified as a safety failure.",
    "liveness": "A valid user can complete redemption within the promised conditions and time.",
    "laterGrailProAuthorityCompromise": "An effective signing-authority compromise means an adversary can cause one later Grail Pro operator's TEE-held key to contribute a valid signature to an arbitrary spend. Human, institution, or host ownership alone sits outside this definition while the TEE and its approved policy remain intact.",
    "laterGrailProPersonCountBoundary": "Threshold arithmetic counts effective signing authorities rather than people. Human and beneficial control, administration, and common-compromise topology remain unresolved.",
    "stateCountWarning": "The exhaustive Boolean state counts below are logical case counts; probability and risk estimates require separate empirical inputs."
  },
  "pinnedArtifacts": [
    {
      "id": "v01-public-mainline",
      "repository": "https://github.com/bitsnark/bitsnark-lib",
      "commit": "c7326cdb3f019d0b8d7373c56408a5c650abbae7",
      "authoredAt": "2024-10-06T17:37:05+03:00",
      "file": "README.md",
      "fileSha256": "b64e26fb578d1c05f096b5283c17da49759045d15f37778a95b2f59f1466ce31",
      "execution": "npm test -- --runInBand: 7 suites, 56 tests passed",
      "finding": "The public v0.1 README says transaction binaries and agents still depended on a private repository, while networked multi-verifier operation and a two-way peg remained future plans. Its passing tests cover cryptographic, encoding, and Taproot primitives rather than a public end-to-end bridge.",
      "sourceIds": ["bos-bitsnark-v01", "bitsnark-v01-readme"]
    },
    {
      "id": "presale-date-code-snapshot",
      "repository": "https://github.com/bitsnark/bitsnark-lib",
      "commit": "dd403e017f43e9b1ee46d6ec46ea4c60fbb42bd0",
      "authoredAt": "2025-02-26T11:49:32+02:00",
      "committedAt": "2025-02-26T14:43:54+02:00",
      "file": "README.md",
      "fileSha256": "fb818d68f0a81c9e4ddb921a5266c31cccf6125470a14467f440e8774d0b7a5b",
      "execution": "npm test -- --runInBand: 19 suites, 154 tests passed and 2 skipped",
      "finding": "This Git snapshot predates the 27 February sale page and its README describes a local two-party regtest demo while leaving multi-verifier networking and a two-way peg as future work. Git metadata dates the object; public availability on 26 February requires hosting or release evidence.",
      "sourceIds": ["bitsnark-presale-snapshot"]
    },
    {
      "id": "v02-published-code",
      "repository": "https://github.com/bitsnark/bitsnark-lib",
      "commit": "752b35b4777b222c45e9f9acf8d37920f5700e14",
      "authoredAt": "2025-02-28T19:08:19+02:00",
      "execution": "npm test -- --runInBand: 19 suites, 154 tests passed and 2 skipped; npm run compile passed",
      "finding": "The README calls this a local two-party prover/verifier demo and leaves multi-verifier operation and a two-way peg as future work. The default Jest run excludes integration directories and a Jest end-to-end file is skipped; the repository also documents a separate Docker-dependent local-regtest e2e script that this audit did not reproduce. Neither the passing unit suite nor that documented local two-party demo establishes a networked multiparty two-way bridge.",
      "sourceIds": ["bitsnark-readme", "bos-bitsnark-v02"]
    },
    {
      "id": "decoder-demonstration",
      "repository": "https://github.com/bitsnark/bitsnark-demo-decoder",
      "commit": "34df5e63e1aa50e14bd85561c7d2f01eee8535b0",
      "execution": "npm test: 1 suite and 1 Groth16 verification test passed",
      "finding": "The test reconstructs and verifies the supplied witness. It supports a real proof-verification milestone, not a complete bidirectional custody, minting, redemption, operator, or liquidity system.",
      "sourceIds": ["bitsnark-demo", "mainnet-tx"]
    },
    {
      "id": "official-tla-model",
      "repository": "https://github.com/bitsnark/bitsnark-lib",
      "commit": "752b35b4777b222c45e9f9acf8d37920f5700e14",
      "file": "specs/BitSnark.tla",
      "fileSha256": "a2d89c4208339369206f5533a5895c2b3a001ce36db6ba4eebeccaab92dd7381",
      "finding": "ProofUncontested consumes Locked Funds without consulting IsProofValid. The published HonestVerification expression defines verifier victory as Locked Funds being present, which is already true in the initial invalid-proof state and therefore does not express preservation after an invalid proof attempt.",
      "sourceIds": ["bitsnark-tla-model"]
    },
    {
      "id": "published-locked-funds-script",
      "repository": "https://github.com/bitsnark/bitsnark-lib",
      "commit": "752b35b4777b222c45e9f9acf8d37920f5700e14",
      "files": [
        {"path": "src/agent/setup/create-external-addresses.ts", "sha256": "228e8dafcabade4c65ca34eb348155a5e088a765c7f7844d97c41dfb28f14d8e"},
        {"path": "src/agent/setup/generate-scripts.ts", "sha256": "97d3ca8ac2e5dd35152ebb55eca04c59f60db29d8164ebac744a273400e42256"},
        {"path": "src/agent/common/templates.ts", "sha256": "855cfd66a6595a9c9959d6ebde1a9e31d86cc8733c7d47f3783e749b8dbd28d2"},
        {"path": "src/generator/btc_vm/bitcoin.ts", "sha256": "deaf644f356262292f79d3aff7939f296aa90d09ff656d6046fda60bf9af42d6"},
        {"path": "src/agent/agent.conf.ts", "sha256": "2053d480f8d0bbddae72901e2ba303c87c986e7aa9623769350964e094a86c56"},
        {"path": "src/agent/common/taptree.ts", "sha256": "59f48e25b1db24412c660b34245a6bb692d6db83b47055effd88502d414c30af"},
        {"path": "python/bitsnark/core/signing.py", "sha256": "525c6116fa2f99e449cb6e7e6e598ac9e51e4469b2f0241990644cd1be58e570"},
        {"path": "python/bitsnark/core/sign_transactions.py", "sha256": "85af2ab45dbdc60216edabaf410bce0edf438e386c9b3a74aa2608aaea724b9e"}
      ],
      "finding": "The intended locked-funds Tapscript leaf checks a prover Schnorr signature and a verifier Schnorr signature using output-binding SIGHASH_DEFAULT and contains no proof predicate or opcode-level output covenant. If both private signing capabilities survive, they can freshly sign a different recipient through this leaf. The surrounding P2TR output also has a key path derived from configurable INTERNAL_PUBKEY, so calling the entire output two-of-two additionally assumes that internal-key discrete logarithm is unavailable.",
      "sourceIds": ["bitsnark-locked-funds-code", "bitsnark-two-key-setup-code", "bitcoin-taproot", "bitcoin-tapscript"]
    },
    {
      "id": "isolated-bitcoin-core-regtest",
      "software": "Bitcoin Core v31.1.0",
      "archiveSha256": "b80d9c3e04da78fb6f0569685673418cf686fadba9042d926d13fb87ff503f9e",
      "network": "isolated regtest with zero peers and valueless generated coins",
      "finding": "In a lab record, a generic P2WSH/ECDSA two-of-two SIGHASH_ALL prescribed spend was accepted and mined. Copying its signatures to a recipient-mutated transaction was rejected; retaining both ephemeral keys and freshly signing the alternate recipient was accepted; one signature was rejected. This demonstrates the analogous threshold-signature and output-binding principle, not the exact BitSNARK P2TR/Tapscript/Schnorr execution. The public packet records txids and hashes but does not contain the complete deterministic node fixture, so this experiment is not independently reproduced by the packet verifier.",
      "vectors": {
        "authorizedMinedTxid": "39dd453730df3dfd565f34add6836ddb6f294282c0cec8061181b2abc2ecbea3",
        "authorizedMinedBlock": "006c3a0058316dcfba8ba8f1783e72a41069e88d6a6775bea55e4d554c6e36be",
        "mutatedWithCopiedSignaturesWtxid": "840c102ec12aee6d0602825d1a037afba9ea196eedfb0c51b166be0706a81191",
        "alternateFreshlySignedWtxid": "b666ed4233714616b46a227ead326a738e7a13e3fe946f74b52582238268366b",
        "oneOfTwoRejectedWtxid": "5816997b981b12e611a698e1c880186cc3b2cb42923c19fbaf4b4f5cd805bc3b"
      },
      "sourceIds": ["bitcoin-core-v31", "bitcoin-bip143", "bitcoin-bip141", "bitcoin-covenants-paper"]
    }
  ],
  "modelInputs": {
    "optimisticRelease": {
      "invalidProof": true,
      "releasesWithoutEffectiveChallenge": true,
      "implementedVerifierCount": 1,
      "verifierCounts": [1, 2, 4, 16],
      "generalizationWarning": "The public v0.2 implementation is two-party with one verifier. Counts above one are hypothetical one-of-N generalizations of the assumed release rule, not exploration of an implemented multiparty BitSNARK state machine.",
      "effectiveChallengeEvent": "A set bit means verifier i's complete required conflict and dispute sequence becomes canonical before every competing timeout.",
      "effectiveChallengeEnablingPremises": [
        "honest",
        "online throughout the relevant windows",
        "observes the proof and all required source data",
        "evaluates the intended circuit, verification key, public inputs, and destination state correctly",
        "can construct and fund every required challenge transaction",
        "obtains Bitcoin inclusion before every applicable timeout"
      ],
      "fixedReleasePremises": [
        "the relevant CSV or other timelock condition has matured",
        "every input required by ProofUncontested remains unspent",
        "a valid pre-signed ProofUncontested transaction remains available",
        "ProofUncontested confirms through the claimant path"
      ],
      "formalRule": "InvalidClaimantRelease(e) = InvalidProof(e) AND MaturedTimelock(e) AND InputsUnspent(e) AND ValidPresignatureAvailable(e) AND ConfirmedToClaimant(e) AND NOT (E_1(e) OR ... OR E_n(e)), taking the published no-effective-challenge release rule and the four fixed release premises as inputs.",
      "sourceIds": ["bos-bitsnark-v01", "bitsnark-readme", "bitsnark-tla-model", "bitsnark-whitepaper"]
    },
    "publishedLockedFunds": {
      "participantCount": 2,
      "threshold": 2,
      "destinationConstrainedByScript": false,
      "proofRequiredByScript": false,
      "participants": ["prover signing key", "verifier signing key"],
      "formalPredicate": "Accept(T) = Verify(pkP, sigP, T) AND Verify(pkV, sigV, T).",
      "counterexamplePremise": "Both signing capabilities survive or both sign an alternate transaction before erasure.",
      "scopeWarning": "This predicate describes the intended Tapscript leaf, not the entire P2TR output. It assumes the spend uses that leaf and that any separate internal-key path is unavailable.",
      "taprootKeyPathBoundary": "The code derives the P2TR output from configurable INTERNAL_PUBKEY. Safe script-path-only interpretation requires no spendable private key for that internal key.",
      "sourceIds": ["bitsnark-locked-funds-code", "bitcoin-taproot", "bitcoin-tapscript", "bitcoin-covenants-paper"]
    },
    "laterGrailProThreshold": {
      "comparisonScope": "later-documented-example-only",
      "participantCount": 16,
      "threshold": 12,
      "coalitionUnit": "effective operator signing authority after TEE/policy compromise",
      "humanCountInferencePermitted": false,
      "salePeriodArchitectureInferencePermitted": false,
      "destinationConstrainedByScript": false,
      "proofRequiredByScript": false,
      "scopeWarning": "This is threshold arithmetic for BitcoinOS's later documented institutional example, not a finding about the original sale-period architecture or a count of human persons. An authority is counted as compromised only when an adversary can cause its TEE-held signing key to authorize an arbitrary spend. The actual design adds code, attestation, hardware, policy, roster, destination-state, and availability premises.",
      "custodianVetoVariants": {
        "distinctMandatoryAuthority": {
          "description": "The custodian is a seventeenth, distinct authority whose approval is mandatory in addition to any 12 of the 16 operators for that custodian's deposit.",
          "totalAuthorities": 17,
          "custodianAuthorityIndex": 16,
          "custodianCountsTowardOperatorThreshold": false
        },
        "mandatoryAuthorityWithinOperatorSet": {
          "description": "The custodian is operator 0 among the 16, must be included in every authorizing coalition for that custodian's deposit, and counts toward the 12-operator threshold.",
          "totalAuthorities": 16,
          "custodianAuthorityIndex": 0,
          "custodianCountsTowardOperatorThreshold": true
        }
      },
      "sourceIds": ["grail-pro-overview", "grail-pro-architecture", "grail-pro-article"]
    }
  },
  "expectedResults": {
    "optimisticRelease": [
      {"verifierCount": 1, "totalEffectiveChallengeStates": 2, "invalidReleaseStates": 1, "invalidReleaseBlockedStates": 1, "unconditionalInvalidProofSafety": false, "counterexampleEffectiveChallengeMask": 0},
      {"verifierCount": 2, "totalEffectiveChallengeStates": 4, "invalidReleaseStates": 1, "invalidReleaseBlockedStates": 3, "unconditionalInvalidProofSafety": false, "counterexampleEffectiveChallengeMask": 0},
      {"verifierCount": 4, "totalEffectiveChallengeStates": 16, "invalidReleaseStates": 1, "invalidReleaseBlockedStates": 15, "unconditionalInvalidProofSafety": false, "counterexampleEffectiveChallengeMask": 0},
      {"verifierCount": 16, "totalEffectiveChallengeStates": 65536, "invalidReleaseStates": 1, "invalidReleaseBlockedStates": 65535, "unconditionalInvalidProofSafety": false, "counterexampleEffectiveChallengeMask": 0}
    ],
    "publishedLockedFunds": {
      "participantCount": 2,
      "threshold": 2,
      "totalCoalitions": 4,
      "authorizingCoalitions": 1,
      "minimumAuthorizingCoalition": 2,
      "arbitraryDestinationCoalitions": 1,
      "universalNoCoalitionCanRedirect": false,
      "minimumSetupSignersWithholdingToPreventPresigning": 1,
      "combinatorialCrossCheck": 1
    },
    "laterGrailProThreshold": {
      "comparisonScope": "later-documented-example-only",
      "coalitionUnit": "effective-signing-authority",
      "participantCount": 16,
      "threshold": 12,
      "totalAuthorityCoalitions": 65536,
      "authorizingAuthorityCoalitions": 2517,
      "minimumAuthorizingAuthorityCoalition": 12,
      "minimalAuthorizingAuthorityCoalitions": 1820,
      "minimalAuthorizingAuthorityCoalitionsBySize": [
        {"coalitionSize": 12, "count": 1820}
      ],
      "authorizingAuthorityCoalitionsBySize": [
        {"coalitionSize": 12, "count": 1820},
        {"coalitionSize": 13, "count": 560},
        {"coalitionSize": 14, "count": 120},
        {"coalitionSize": 15, "count": 16},
        {"coalitionSize": 16, "count": 1}
      ],
      "freezingRefusalCoalitions": 63019,
      "minimumRefusalCoalition": 5,
      "minimalRefusalCoalitions": 4368,
      "minimalRefusalCoalitionsBySize": [
        {"coalitionSize": 5, "count": 4368}
      ],
      "freezingRefusalCoalitionsBySize": [
        {"coalitionSize": 5, "count": 4368},
        {"coalitionSize": 6, "count": 8008},
        {"coalitionSize": 7, "count": 11440},
        {"coalitionSize": 8, "count": 12870},
        {"coalitionSize": 9, "count": 11440},
        {"coalitionSize": 10, "count": 8008},
        {"coalitionSize": 11, "count": 4368},
        {"coalitionSize": 12, "count": 1820},
        {"coalitionSize": 13, "count": 560},
        {"coalitionSize": 14, "count": 120},
        {"coalitionSize": 15, "count": 16},
        {"coalitionSize": 16, "count": 1}
      ],
      "safetyToleranceCompromisedAuthorities": 11,
      "livenessToleranceUnavailableAuthorities": 4,
      "simultaneousSafetyAndLivenessTolerance": 4,
      "minimumQuorumIntersection": 8,
      "combinatorialCrossChecks": {
        "authorizingAuthorityCoalitions": 2517,
        "minimalAuthorizingAuthorityCoalitions": 1820,
        "freezingRefusalCoalitions": 63019,
        "minimalRefusalCoalitions": 4368
      },
      "custodianVetoVariants": {
        "distinctMandatoryAuthority": {
          "scope": "The custodian is a seventeenth, distinct authority whose approval is mandatory in addition to any 12 of the 16 operators for that custodian's deposit.",
          "totalAuthorities": 17,
          "totalCoalitions": 131072,
          "authorizingCoalitions": 2517,
          "minimumAuthorizingCoalition": 13,
          "minimalAuthorizingCoalitions": 1820,
          "minimalAuthorizingCoalitionsBySize": [
            {"coalitionSize": 13, "count": 1820}
          ],
          "freezingRefusalCoalitions": 128555,
          "minimumRefusalCoalition": 1,
          "minimalRefusalCoalitions": 4369,
          "minimalRefusalCoalitionsBySize": [
            {"coalitionSize": 1, "count": 1},
            {"coalitionSize": 5, "count": 4368}
          ],
          "safetyToleranceCompromisedAuthorities": 12,
          "livenessToleranceUnavailableAuthorities": 0,
          "minimumAuthorizingQuorumIntersection": 9
        },
        "mandatoryAuthorityWithinOperatorSet": {
          "scope": "The custodian is operator 0 among the 16, must be included in every authorizing coalition for that custodian's deposit, and counts toward the 12-operator threshold.",
          "totalAuthorities": 16,
          "totalCoalitions": 65536,
          "authorizingCoalitions": 1941,
          "minimumAuthorizingCoalition": 12,
          "minimalAuthorizingCoalitions": 1365,
          "minimalAuthorizingCoalitionsBySize": [
            {"coalitionSize": 12, "count": 1365}
          ],
          "freezingRefusalCoalitions": 63595,
          "minimumRefusalCoalition": 1,
          "minimalRefusalCoalitions": 3004,
          "minimalRefusalCoalitionsBySize": [
            {"coalitionSize": 1, "count": 1},
            {"coalitionSize": 5, "count": 3003}
          ],
          "safetyToleranceCompromisedAuthorities": 11,
          "livenessToleranceUnavailableAuthorities": 0,
          "minimumAuthorizingQuorumIntersection": 8
        }
      }
    }
  },
  "formalCounterexample": {
    "premises": [
      "The claimed bridge event or proof is invalid.",
      "The prover publishes the proof transaction.",
      "No verifier's complete required conflict and dispute sequence becomes canonical before every competing timeout.",
      "The relevant relative timelock has matured, the required inputs remain unspent, and the valid pre-signed ProofUncontested transaction remains available.",
      "ProofUncontested is confirmed through the claimant path."
    ],
    "trace": [
      "Init: Locked Funds is unspent.",
      "Proof: the prover publishes the asserted result and challenge signal.",
      "ProofUncontested: after the timeout, the transaction consumes Locked Funds and the proof outputs, then creates a prover-only output."
    ],
    "result": "Under those explicit premises, Locked Funds is consumed into the claimant path despite an invalid proof. This falsifies unconditional invalid-claimant-release safety. The supported narrower theorem remains conditional on one effective challenge sequence blocking the path.",
    "tlaModelCheck": "The repository's IsProofValid is a fixed CHOOSE expression rather than a state variable exploring both values. An audit patch specializes it to FALSE and adds a label-preservation surrogate, InvalidProofSafety. TLC 2.19 then returns symbolic reachability Init -> Proof -> ProofUncontested.",
    "tlaBoundary": "The audit-patched model has no time or CSV semantics, signatures, Bitcoin consensus, transaction value, ownership, or recipient. TLC establishes removal of the Locked Funds label in this symbolic transition system; exact Bitcoin confirmation timing requires the separate code and consensus premises."
  },
  "propositions": [
    {
      "id": "P1-unconditional-invalid-proof-safety",
      "claim": "An invalid bridge proof can never release locked BTC to its claimant as acceptance of that proof, without relying on an effective challenge sequence.",
      "result": "disproved-for-published-protocol",
      "reason": "Under the explicit matured-timelock, unspent-input, available-presignature, no-effective-challenge, and confirmation premises, ProofUncontested consumes the locked funds into the claimant path."
    },
    {
      "id": "P2-no-person-or-group-can-redirect",
      "claim": "No person or group together can authorize a different recipient through the published locked-funds Tapscript leaf.",
      "result": "disproved-for-published-script",
      "reason": "The Tapscript leaf is a two-signature predicate using output-binding signatures. A coalition retaining both signing capabilities can freshly sign a different transaction through that leaf. The surrounding P2TR internal-key path is a separate deployment premise, and the Core lab record is only a generic P2WSH/ECDSA analogue."
    },
    {
      "id": "P3-one-of-n-conditional-safety",
      "claim": "One verifier can prevent an invalid release.",
      "result": "supported-only-under-explicit-premises",
      "reason": "The verifier must be honest, online, informed, correct, funded, and included before every deadline. ZK soundness does not provide those operational facts."
    },
    {
      "id": "P4-sale-period-two-way-bridge-delivered",
      "claim": "The public artifacts substantiated a delivered, networked, multi-verifier, bidirectional mainnet bridge when BOS was solicited.",
      "result": "not-substantiated-by-public-artifacts",
      "reason": "The issuer described a one-way valueless testnet; public v0.1 depended on private code for transaction generation and agents; v0.2 remained two-party/regtest and placed multiparty and two-way work in the future. Any private prototype requires dated source, build, audit, and deployment records."
    },
    {
      "id": "P5-records-required-for-legal-finding",
      "claim": "A legal fraud determination requires technical falsity or misleading omission plus person- and transaction-specific evidence.",
      "result": "additional-records-required",
      "reason": "The technical work establishes whether a defined proposition is false or depends on important omitted technical assumptions. Intent or recklessness, purchaser exposure and reliance, causation, loss, attribution, jurisdiction, and defenses require internal, purchaser-level, accounting, and legal evidence."
    }
  ],
  "technicalConclusion": "The reviewed protocol does not support unconditional invalid-claim safety: under explicit timeout and transaction premises, an invalid claim can reach a claimant-controlled path if no effective challenge completes; and the intended locked-funds Tapscript leaf permits an alternative spend if both signing capabilities remain available. This identifies setup, internal-key, key-erasure, active-challenger, data, inclusion, destination-chain, and operator/liquidity assumptions. Production-key custody, incident history, and bridge-fund movement require production records.",
  "saleRecordConclusion": "Direct BOS solicitations used categorical trustless language while first-party public records described a one-way testnet and unfinished two-way, networked, and multiparty components. This identifies a substantiation gap and supports further investigation into whether sale-linked statements were materially misleading or incomplete. Speaker knowledge and intent, governing-law materiality, purchaser reliance, causation, and damages require internal, purchaser-level, accounting, and legal evidence.",
  "telegramBoundary": "The 24 July 2024 exchange records Weikeng Chen challenging the covenant claim, asking to inspect the challenge code, and warning Yago to scrutinize his technical team's account. Deleted-key presigning can emulate limited finite covenant behavior without OP_CAT, which narrows Chen's literal wording; the independent audit confirms his technical concern because the reviewed design depends on setup, erasure, hidden-path, and active-challenger conditions omitted from the later categorical trustless-bridge sale claims. Code, consensus rules, executable tests, and the bounded formal analysis supply the mathematical and technical conclusions independently."
}