Skip to content
CCPEDIAby Unity Nodes
Approved#871 Pull requestDigital Asset

Amend Open Source Reference Wallet proposal: Milestone 4 security audit timing

Opened 01-10-2026 by davidrichards-da, last activity 6d ago

  1. Incoming12 days01-10-2026
  2. Approvedsince 13-10-2026
Funding request
8,500,000
Organization
Digital Asset
Discussion
2 messages
1 person

Digital Asset is proposing a strategic adjustment to the milestone schedule for the Reference Wallet Grant (PR #90). Specifically, it's propose moving the third-party security audit—currently scheduled as a Milestone 3 deliverable for 21st December—to align with the completion of the last milestone of M4, and adjusting the Milestone 4 deadline accordingly to be four weeks after the completion of the security review to start on the 21st January.

Context for the Original M3 Placement For context on why the audit was originally placed in M3: this schedule was designed to align with a security review we already had planned in July when the proposal was initially submitted. However, because the grant proposal's approval took several months, our development dates were pushed back. As a result, the development timeline is no longer in sync with that original audit schedule, making an end-of-project audit the most secure and logical path forward.

Strategic Rationale for a Unified Security Audit Our primary objective in requesting this adjustment is to maximize the benefit, comprehensiveness, and impact of the third-party security review. Conducting an audit at the M3 stage limits the review to a partial scope of the wallet's functionality. By shifting the audit to the end of the development cycle, we ensure a more robust evaluation through:

  • Comprehensive Feature Coverage: The external audit will evaluate the complete, integrated feature set developed including features of M4, rather than just a subset of M3 deliverables.
  • Holistic Remediation: Reviewing the finalized architecture allows the auditors to assess how all components interact, ensuring any vulnerabilities are identified and resolved across the fully assembled application at once.
  • Leveraging Existing Validation: Approximately 70% of the core modules utilized by the Browser Wallet extension have already undergone a rigorous external security review during the Wallet Gateway audit in July. Because the foundational codebase is already highly validated, it is significantly more beneficial to apply the next external audit to the finalized, fully featured application.

Proposed Timeline Adjustments If approved, we will secure a booking for this expanded security audit to commence on January 21st - the deadline for M4. To ensure the team has the necessary time to properly remediate any critical or high findings across the entire application scope, we propose the following adjustments to the grant structure:

  • Remove the "Third-Party Security Audit Report" deliverable from Milestone 3.
  • Include the comprehensive external security audit as part of Milestone 4.
  • Set the final deadline for Milestone 4 to four weeks after the completion of the third-party security audit giving the team enough time to address any high or critical issues found.

We believe this adjustment strongly aligns with our shared goal of delivering the most secure, high-quality reference wallet possible for the ecosystem. We appreciate the Foundation’s review and consideration of this proposal.

Milestones 4

  1. Splice Portfolio dApp UI4 months after grant proposal approval (May 21st, 2026): by September, 21st 2026
  2. Splice Portfolio replaces the Splice Amulet WalletThe same time as M1: by September, 21st 2026
  3. Splice Wallet Browser Extension3 months after delivery of M1 & M2: by December 21st, 2026
  4. Future known improvements & external security auditFour weeks after the completion of the third-party security audit due to commenc