---
title: "2025-05 Vac monthly"
tags:
  - "vac-monthly"
date: 2025-05-31
draft: false
---

## Vac Monthly Report 2025/05

### P2P
#### highlights
  - Completed performance evaluations for GossipSub v1.4, v1.4+stagger, PPPt, 2.0
  - Daily CI jobs are back online
  - Submitted GossipSub v1.4 article on arxiv
  - Release v1.10.0 and v1.10.1 with QUIC transport support
  - PoC implementations for push-pull phase transition and GossipSub v2.0
#### report
- `ift:2025q1-gossipsub-perf-improvements`
    - Overview:
        - Worked on nimbus integration in EthShadow for simulation purposes
        - Completed performance evaluations for GossipSub v1.4, v1.4+stagger, Push-Pull phase transition, 2.0
        - Submitted gossipsub v1.4 article to arxiv
    - Delivered Deliverables:
        - [PREAMBLE and IMRECEIVING for Improved Large Message Handling in libp2p GossipSub](https://arxiv.org/abs/2505.17337)
- `vac:p2p:ift:2025q2-nimlibp2p-autotls`
    - Overview:
        - Created [AutoTLS client spec](https://github.com/vacp2p/specs/pull/1) (PR to `libp2p/specs` pending some additional local reviews)
        - Following tasks are finalized, pending PR review:
            - `vac:p2p:ift:2025q2-nimlibp2p-autotls:acme-registration`
            - `vac:p2p:ift:2025q2-nimlibp2p-autotls:certificate-request-challenge`
            - `vac:p2p:ift:2025q2-nimlibp2p-autotls:notify-autotls-broker`
            - `vac:p2p:ift:2025q2-nimlibp2p-autotls:notify-challenge-completion`
            - `vac:p2p:ift:2025q2-nimlibp2p-autotls:finalize-cert`
            - `vac:p2p:ift:2025q2-nimlibp2p-autotls:certificate-request-auth`
            - `vac:p2p:ift:2025q2-nimlibp2p-autotls:dns-challenge`
            - Tasks are implemented in [nim-libp2p#1358](https://github.com/vacp2p/nim-libp2p/pull/1358)
        - `vac:p2p:ift:2025q2-nimlibp2p-autotls:certificate-installation` in progress
- `vac:p2p:ift:2025q2-nimlibp2p-kad-dht`
    - Overview:
        - The following tasks are in progress:
            - `vac:p2p:ift:2025q2-nimlibp2p-kad-dht:routing-and-rpc`
            - `vac:p2p:ift:2025q2-nimlibp2p-kad-dht:bootstraping-and-lookup`
        - Implemented FIND_NODE, still missing some tests to demonstrate it works correctly
        - Bootstrapping process implemented to populate routing table on start
        - Added bucket management to routing table
        - Progress can be tracked in [nim-libp2p#1324](https://github.com/vacp2p/nim-libp2p/pull/1324)
- `vac:p2p:ift:2025q2-nimlibp2p-webtransport:http3-client`
    - Overview:
        - Implemented client barebones, realized that this commitment will require using its own implementation of quic. nim-quic does not extend easily to something like webtransport.
- `vac:p2p:ift:2025q2-nimlibp2p-maintenance:maintenance`
    - Overview
        - Released versions v1.10.0 and v1.10.1 with QUIC transport support
        - Fixed interop issues with QUIC and Zig
        - Fixed issues observed on CI when Quic transport is used
        - Improved project README
    - Delivered deliverables
        - [nim-libp2p#1400](https://github.com/vacp2p/nim-libp2p/pull/1400) fix(daily): remove --solver flag 
        - [nim-libp2p#1404](https://github.com/vacp2p/nim-libp2p/pull/1404) ci(daily): improvements 
        - [nim-libp2p#1418](https://github.com/vacp2p/nim-libp2p/pull/1418) ci(daily): add pinned dependencies variant 
        - [nim-libp2p#1421](https://github.com/vacp2p/nim-libp2p/pull/1421) ci(dependencies): fix access to tokens
        - [nim-libp2p#1413](https://github.com/vacp2p/nim-libp2p/pull/1413) chore(interop): move interop code to separate folder 
        - [nim-libp2p#1398](https://github.com/vacp2p/nim-libp2p/pull/1398) feat: withWsTransport 
        - [nim-lang/packages#3044](https://github.com/nim-lang/packages/pull/3044) Published quic in nim package repo 
        - [nim-quic#80](https://github.com/vacp2p/nim-quic/pull/80) refactor: make certificates part of the connection 
        - [nim-quic#82](https://github.com/vacp2p/nim-quic/pull/80) fix: if stream is not available in open state, raise exception
        - [nim-quic#81](https://github.com/vacp2p/nim-quic/pull/81) fix: limit chronicles version to < 0.11.0
        - [nim-libp2p](https://github.com/vacp2p/nim-libp2p/pull/1423) fix: limit chronicles version to < 0.11.0
        - [nim-quic#73](https://github.com/vacp2p/nim-quic/pull/73) fix: timeout on read
        - [nim-quic#76](https://github.com/vacp2p/nim-quic/pull/76) fix: handle connection timeouts and simplify closed state
        - [nim-libp2p#1389](https://github.com/vacp2p/nim-libp2p/pull/1389) chore: make quic optional
        - [nim-libp2p#1392](https://github.com/vacp2p/nim-libp2p/pull/1392) chore: move `-d:libp2p_quic_support` flag to `.nimble` 
        - [nim-libp2p#1390](https://github.com/vacp2p/nim-libp2p/pull/1390) chore(version): update libp2p.nimble to 1.10.1
        - [nim-libp2p#1376](https://github.com/vacp2p/nim-libp2p/pull/1376) ci(test): reduce timeout 
        - [nim-quic#74](https://github.com/vacp2p/nim-quic/pull/74) refactor(framesorter): remove ranges usage 
        - [nim-quic#78](https://github.com/vacp2p/nim-quic/pull/78) feat(framesorter): add fastpath for emitting data
        - [nim-quic#77](https://github.com/vacp2p/nim-quic/pull/77) ci: reduce test timeout 
        - [nim-quic#71](https://github.com/vacp2p/nim-quic/pull/71) fix: close should clean stream userdata 
        - [nim-libp2p#1364](https://github.com/vacp2p/nim-libp2p/pull/1364) chore(interop): use the same redis dependency 
        - [nim-libp2p#1378](https://github.com/vacp2p/nim-libp2p/pull/1378) chore(hp): add timeout on dial 
        - [nim-libp2p#1376](https://github.com/vacp2p/nim-libp2p/pull/1376)
        - [nim-libp2p#1373](https://github.com/vacp2p/nim-libp2p/pull/1373) `README.md` improvements
        - [nim-quic#70](https://github.com/vacp2p/nim-quic/pull/70) feat: accept and close connections gracefully
        - Bumped dependencies
- `vac:p2p:acz:2025q2-acz-consulting:libp2p-mix-consulting`
    - Overview:
        - Troubleshoot compilation issues
        - Assist in debugging reasons behind incorrect number of streams metric
- `vac:p2p:vac:2025q2-test-coverage:qa-consulting`
    - Overview:
        - Provided assistance to QA team in the form of code reviews for test suite improvements
- `misc/admin`
    - Overview
        - Forked nim-jwt and bearssl_pkey_decoder due to them being abandoned by their author
        - Worked with Waku to determine differences in Multiselect/Yamux across libp2p implementations
    - Delivered deliverables
        - https://github.com/vacp2p/nim-jwt 
        - https://github.com/vacp2p/bearssl_pkey_decoder

### Tokenomics (public version)
#### highlights

- Designed Ghost Tokenomics and assisted the team with their strategic decisions.
- Led cross-functional collaboration for Codex Incentivized Testnet.
- Defined a token emission schedule based on key performance indicators (KPIs).
- Contributed to Codex strategy with data analysis on their competitors growth.
- Coordinated with SN and ACZ teams to clarify open questions about Karma minting and RLN registration.
- Evaluated how the optimal control framing could be applied to real token emission models (e.g., Nomos and Codex).
- Reviewed and contributed to an integrated fundraising spreadsheet model for the TGE group.
- Gathered insights on expected gas usage on KARMA
- Attended ETHPrague and ETHGlobal Prague conferences

#### report

- `vac:tke:ift:ghost:ad-hoc`
  - Overview:
    - Authored a document outlining Ghost tokenomics.
    - Held discussions with Ghost team to refine the framework and direction
  - Completed tasks:
    - `vac:tke:ift:ghost:ad-hoc:potential-tokenomics`
- `vac:tke:codex:cdx-launch`
  - Overview:
    - Cross-functional collaboration: Held meetings with Codex, Finance, and IR teams to discuss the incentivized testnet.
    - Contributed to data analysis on competitor growth, likely to inform Codex strategy and benchmarking.
  - Completed tasks:
    - `vac:tke:codex:cdx-launch:review-testnet`
    - `vac:tke:codex:cdx-launch:competitor-analysis`
- `vac:tke:status:karma-incentives`
  - Overview:
    - Analyzed Linea data to derive meaningful parameters for Karma rewards.
    - Wrote a report outlining the methodology and findings.
  - Completed tasks:
    - `vac:tke:status:karma-incentives:linea-txs`
    - `vac:tke:status:karma-incentives:linea-usage`
- `vac:tke:nomos:macroeconomy`
  - Overview:
    - Continued modeling Nomos block rewards and explored integration with optimal minting control work.
    - Created introductory documents explaining the pros and cons of different reward mechanisms.
    - Prepared and submitted the stake estimation document for revision.
    - Reviewed the Blend Protocol v1 documentation.
    - Evaluated lottery specs and transaction inclusion reward mechanisms.
  - Completed tasks:
    - `vac:tke:nomos:macroeconomy:preliminary-block-rewards`
    - `vac:tke:nomos:macroeconomy:block-rewards`
    - `vac:tke:nomos:macroeconomy:tfms-primer`
    - `vac:tke:nomos:macroeconomy:revision-economic-model`
- `vac:tke:ift:tokenomics-research-forum`
  - Overview:
    - Continued analysis of token valuation metrics throughout PLS Regression.
    - Conducted research on optimal control and minting strategies.
    - Designed grant mechanisms under the “Grantico” concept.
  - Completed tasks:
    - `vac:tke:ift:tokenomics-research-forum:token-sales-opt`
    - `vac:tke:ift:tokenomics-research-forum:minting-control`
    - `vac:tke:ift:tokenomics-research-forum:grantico`
- `vac:tke:ift:support-to-ift-units`
  - Overview:
    - Review of past discussions and proposal on Logos as a basket of tokens.
    - Explored and documented: potential token baskets, joint value accrual mechanisms, various token distribution models and mechanics.
    - Proposed and iterated on a TGE checklist
    - Reviewed and contributed to an integrated fundraising spreadsheet model for the TGE group.
  - Completed tasks:
    - `vac:tke:ift:support-to-ift-units:tge`
    - `vac:tke:ift:support-to-ift-units::logos-basket-review`

### QA 
#### highlights
- Considerable progress was made to cover Gossipsub in nim-libp2p repo
- Go-waku removed from waku-interop-test workflows
- Several issues found for waku-go-bindings

#### report
- `vac:qa:nomos:2025q2-da-testing`
	- Overview:
	     - Started new repository with augmenterd Nomos code to enable security and advanced reliability tests
	- Delivered Deliverables:
        - [PR: test: Da networking encryption - PoC](https://github.com/logos-co/nomos-security-tests/pull/1)
- `vac:qa:nomos:2025q2-e2e-testing`	
    - Overview:
	   - Testnet debugging image in sync with latest Rust updates
	- Delivered Deliverables:
	    - [PR: fix: Update Rust version to 1.87 for Dockerfile debug](https://github.com/logos-co/nomos/pull/1278)
- `vac:qa:waku:2025q2-interop-testing`
    - Overview:
        - Go-waku removed from daily regression test runs
    - Delivered Deliverables:
        - [Issue: test: Many tests fail on CI related to topics supscribtion](https://github.com/waku-org/nwaku/issues/3414) 
        - [PR: chore: Remove go-waku from workflows](https://github.com/waku-org/waku-interop-tests/pull/117)
- `vac:qa:waku:2025q2-waku-go-bindings-testing`
    - Overview:
        - Numerous issues were found for Waku-Go bindings
    - Delivered Deliverables:
        - [PR: Add modifications for failed tests](https://github.com/waku-org/waku-go-bindings/pull/62)
        - [PR: Fix store format](https://github.com/waku-org/waku-go-bindings/pull/68)
        - [Issue: Store-query JSON keys don’t match nwaku schema](https://github.com/waku-org/waku-go-bindings/issues/67)
        - [Issue: Bug: Failing tests on CI](https://github.com/waku-org/waku-go-bindings/issues/69) 
        - [Issue: Bug: MsgChan still full after reading messages](https://github.com/waku-org/waku-go-bindings/issues/70)
        - [Issue: Bug: Test failed with error ConnectionChangeChan is full ](https://github.com/waku-org/waku-go-bindings/issues/71)
        - [Issue: Warning message about exception in pubsub handling](https://github.com/waku-org/waku-go-bindings/issues/72)
- `vac:2025q2-nim-libp2p-testing`
    - Overview:
        - Next phase of extensive testing for Gossipsub was finished 
    - Delivered Deliverables:
      - [PR: test(gossipsub): control message](https://github.com/vacp2p/nim-libp2p/pull/1191) 
      - [PR: test(gossipsub): Topic Membership Tests](https://github.com/vacp2p/nim-libp2p/pull/1201) 
      - [PR: test(gossipsub): Topic Membership Tests - updated](https://github.com/vacp2p/nim-libp2p/pull/1363)
      - [PR: test(gossipsub): refactor testgossipinternal](https://github.com/vacp2p/nim-libp2p/pull/1366)  
      - [Issue: Improve testgossipinternal file](https://github.com/vacp2p/nim-libp2p/issues/1207)
      - [PR: test(gossipsub): block5 protobuf test cases](https://github.com/vacp2p/nim-libp2p/pull/1204) 
      - [Issue: Protobuf encoding & decoding not compatible with different references](https://github.com/vacp2p/nim-libp2p/issues/1208)
       - [PR: test(gossipsub): move and refactor control messages tests](https://github.com/vacp2p/nim-libp2p/pull/1380)
      - [PR: test(gossipsub): heartbeat tests](https://github.com/vacp2p/nim-libp2p/pull/1391) 
      - [Issue: GossipSub: iDontWants messages saved only in last element of history](https://github.com/vacp2p/nim-libp2p/issues/1394)  
      - [PR: test(gossipsub): include missing test files and handle flaky tests](https://github.com/vacp2p/nim-libp2p/pull/1416) 
      - [PR: fix(gossipsub): save iDontWants messages in the first element of history](https://github.com/vacp2p/nim-libp2p/pull/1393) 
      - [PR: test(gossipsub): message cache](https://github.com/vacp2p/nim-libp2p/pull/1431)       
    - Completed tasks:	
       - vac:qa:vac:2025q2-nim-libp2p-testing:gossipsub-extended
- `admin/misc` 
	- Parental leave 23 CC days 
	- Day off 5 CC days
	- Public holiday 1 CC day

### DST
#### highlights
- Found a list of issues for quic implementation in nimlibp2p
- Multiple analysis and measurements on mix protocol, found two possible issues, devs are investigating
- Greatly improved DST tooling for experiments and analysis
#### report
- `admin/misc`
    - 1 CC Onboarding
    - 1 CC Out of Office Friday 16
    - 1 CC Out of Office Monday 19
- `vac:dst:ift:2025q2-dst-tooling`
    - Overview
        - Created python utilities to better deploy DST experiments
        - Refactored the analysis part of the workflow, to allow better integration of different types of analysis and other projects.
    - Delivered deliverables
        - [Github: Draft PR (analysis refactor)](https://github.com/vacp2p/10ksim/pull/66)
        - [Github: PR (python deployment scaffold)](https://github.com/vacp2p/10ksim/pull/68)
        - [notes.status: Design Notes (python deployment scaffold)](https://notes.status.im/rdzaX1TVQ0KnUXfCAWBegQ?view)
    - Completed tasks
        - `vac:dst:ift:2025q2-dst-tooling:python-deployment-scaffold`
- `vac:dst:vac:2025q2-libp2p-evaluation`
    - Overview
        - Regression report for nimlibpep 1.10.0
        - Analyzed mix message propagation times
        - Analyzed distribution of messages inside/outside mix
        - Performed comparison between mix and non-mix scenarios
        - Found possible issue regarding mix-gossipsub instance in the same node
        - Found weird times for mix propagation
    - Delivered deliverables
        - [Notion: Nimlibp2p 1.10.0 regression report](https://www.notion.so/Nim-libp2p-v1-10-0-regression-testing-May-2025-1f28f96fb65c80d58334f0c1a98ba23b)
        - [Notion: List of quic issues](https://www.notion.so/List-of-Issues-found-so-far-1ca8f96fb65c801b9c9ad4cceb16fa72)
        - [Notion: Mix report](https://www.notion.so/Nim-libp2p-Mix-May-2025-1f38f96fb65c800a8466f68472e799db)
    - Completed tasks
        - `vac:dst:vac:2025q2-libp2p-evaluation:mix-analysis`
- `vac:dst:ift:2025q2-dst-research-destination`
    - Overview:
        - Started planning for EF project grant

### SC
#### highlights
- Yield bridge design completed, implementation started
- Status communities contracts now deployed on Polgon POS Mainnet and Amoy
- Status Network Karma slashing capabilities done
- KarmaRLN implementation almost done (enables gasless transactions on SN)
- Presented Provably Rootless EIP-7702 Proxies in learnup session
#### report
- `status:2025q2-sn-native-bridge-yield-bearing-module`
    - Colleborated and agreed on architecture together with Status Network and Linea teams
    - **Completed tasks**
        - `status:2025q2-sn-native-bridge-yield-bearing-module:research-design`
    - **Deliverables**
      - [Design document](https://www.notion.so/Native-yield-bearing-bridge-on-Linea-shared-1d98f96fb65c80edbfbde3d83746c187)
- `status:2025q2-maintaining-status-contracts`
    - Deployed Status communities contracts on Polygon main and testnet
    - **Completed tasks**
        - This is part of a "maintenance" task
    - **Deliverables**
        - Contract addresses: https://github.com/status-im/communities-contracts/pull/67
- `status:2025q2-karma-rln`
    - Implemented slashing capabilities in Karma contract
    - Implemented `KarmaRLN` contract which enables gasless transactions on Status Network
    - **Completed tasks**
        - `status:2025q2-karma-rln:slash-karma`
    - **Deliverables**
        - Related PRs
            - https://github.com/vacp2p/staking-reward-streamer/pull/215
            - https://github.com/vacp2p/staking-reward-streamer/pull/221
            - https://github.com/vacp2p/staking-reward-streamer/pull/223
- `ift:2025q2-sc-learnup-sessions`
    - Held and recorded learn up session about Provably Rootless EIP7702 proxies
    - **Completed tasks**
        - `ift:2025q2-sc-learnup-sessions:2025-05`
    - **Deliverables**
      - [Video Recording of LearnUp Session](https://www.notion.so/Provably-Rootless-EIP-7702-Proxies-1fc8f96fb65c8013bc25ff5097666ffa)

### ACZ
#### highlights
- Having improved Zerokit with tree optimizations, wasm parallizations also semaphore comparison. 
#### report
- `ift:2025q2-de-mls-tesnet`
   - Overview:
       - [Consensus RFC](https://github.com/vacp2p/rfc-index/pull/142) is in review and will be merge soon as the part of a main de-MLS RFC. 
       - [de-MLS blogpost](https://github.com/vacp2p/vac.dev/pull/159) is in final review 
- `ift:2025q2-zerokit`
   - Overview:
       - Enchange the tree optimiztion by parallel execution
       - Completed RLN bottleneck investigation
       - Completed wasm paralelization
       - Completed latest [Semaphore](https://github.com/semaphore-protocol/semaphore-rs/tree/main) examination inlcuding comparison with Zerokit
       - On-hold for witness calculator task due to blocker from iden3 due to these issues [1](https://github.com/iden3/circom-witnesscalc/issues/25) and [2](https://github.com/iden3/circom-witnesscalc/issues/8). 
   - Delivered deliverables:
       - [Paralel Execution PR](https://github.com/vacp2p/zerokit/pull/306)
       - [RLN bottleneck investigation PR](https://github.com/vacp2p/zerokit/pull/295)
       - [wasm paralelization PR](https://github.com/vacp2p/zerokit/pull/296)
       - [Semaphore examination report](https://github.com/vacp2p/zerokit/issues/17#issuecomment-2884697352)
   - Completed tasks:
       - `ift:2025q2-zerokit:parallel-computation-study`
       - `ift:2025q2-zerokit:rln-execution-bottleneck`
       - `ift:2025q2-zerokit:semaphore-parts-bench`
- `ift:2025q2-rln-status-l2`
   - Overview:
       - Creating RLN deployment specs will be delivered soon
       - Releasing prover and RPC node implementations
   - Delivered deliverables:
       - [RLN Deployment spec](https://www.notion.so/RLN-Deployment-Spec-WIP-1f98f96fb65c806c8737d94851b4d14d)
- `ift:2025q2-ift-zk-calls`
    - Overview:
        - Conducted the May IFT ZK Call 
    - Delivered deliverables:
        - [Presentation record](https://www.youtube.com/watch?v=Kaf60fLcF_Q) 
        - [Forum post](https://forum.vac.dev/t/fhe-and-snark/490)
- `ift:2025q2-libp2p-mix-testnet`
   - Overview:
       - Working progress on delivered dockerized poc
       - Refactored the [mix](https://github.com/vacp2p/mix) codebase
       - Updating [mix RFC](https://github.com/vacp2p/rfc-index/pull/158) with latest changes 
   - Delivered deliverables:
       - [Benchmark test PR](https://github.com/vacp2p/mix/pull/20)
       - [Refactoring PR](https://github.com/vacp2p/mix/pull/19)
   - Completed tasks:
- `nes:2025q2-nescience-consulting`
    - Overview:
        - Finished creating unified Q1 research Docs.
    - Delivered deliverables:
        - [A notion page of unified doc](https://www.notion.so/1-Single-Unified-Doc-of-2025Q1-Research-1eb8f96fb65c808aa51bd4a9f5e11cc3)
    - Completed tasks:
        - `nes:2025q2-nescience-consulting:unifying-q1-docs`

### RFC
#### highlights
#### report

### Nim
#### highlights
- Tooling release Nimlangserver v1.12.0 and vscode extension v1.8.x
- Started initial work for nimble 1.0.0

### Security
#### highlights
- Updated permissions and scope into the required DeFi strategies
- Triaged of Status-321 and Status-322 new vulnerabilities
- Investigated reports concerning Discord AI bots and confirmed bans
- Defined a new signatory db schema and revalidated the current authorised signers
- Evaluated and selected new hardware wallets models (that support clear signing) for treasury/custody activities
- Finalized Codex modular contract threat scenarios based on discussions during the Offsite
- Master Wallet Index 2025q2 update
- Updated the software catalogue by capturing data from Expensify 
- Improved GitHub Actions access controls and secret management
- Tracked and resolved issues identified in projects via Dependabot and CodeQL

#### report

- `ift:2025q2-iam-operations`
	- Mediate access to DeFi protocols and smart contracts to the Investment roles and smart accounts
	- Remove unnecessary users (leavers, external users, bots and service accounts) and roles/groups in critical services and apps
	- Output:
		- Removed users no longer needed in Github and BambooHR. [[Reference](https://github.com/enterprises/ift/settings/audit-log?q=action%3Ateam.remove_member)]
		- Removed malicious bots from Discord. [[Reference](https://discord.com/channels/973324189794697286/1078729684168233090/1375191136154419361)]
		- Modified scope and approvals into the pendle investment strategy. [[Reference](https://etherscan.io/tx/0x5940189e64aca086ee9b0306c4792eabb0532943d6a65b96a8457cf652848632#eventlog)]
		- Modified scope and approvals into the cowswap investment strategy. [[Reference](https://etherscan.io/tx/0x15703de16cd03b3d461e6a312aa5adb211bb202aaf4fa384060103793a162dee#eventlog)]
		- Modified scope and approvals into the pendle-merkle investment strategy. [[Reference](https://etherscan.io/tx/0xd5d905be02a49bda0e4d57b6a93973d3ea01ecdeb28096634f790c8d49e72eb7#eventlog)]
	- Tasks:
		- `ift:2025q2-iam-operations:inv-pendle-update`
		- `ift:2025q2-iam-operations:inv-cowswap-update`
		- `ift:2025q2-iam-operations:inv-pendle-merkle-update`
		- `ift:2025q2-iam-operations:remove-unnecessary-users`

- `ift:2025q2-security-operations`
	- Identify, assess, prioritize, and mitigate security vulnerabilities across the org infrastructure and programs.
	- Identify, respond to, and resolve security incidents, with clear communication, ensuring minimal disruption to business operations.
	-  Output:
		- Triaged of Status-321 and Status-322 new vulnerabilities
		- Validated on Status-318 incident resolution
		- Investigated reports concerning Discord AI bots and confirm bans. [[Reference](https://discord.com/channels/973324189794697286/1078729684168233090/1375191136154419361)]
		- Investigated and tracked remediation of CI/CD vulnerabilities related to dangerous runners.
	- Tasks:
		- `ift:2025q2-security-operations:incident-response`
		- `ift:2025q2-security-operations:vulnerability-management`

- `ift:2025q2-custody-improvement-plan:signatory-registry-implementation`
	- Implement and maintain a registry of signers and wallet owners within the organization
	- Output:
		- Revalidated the current list of authorized signatories. [[Reference](https://www.notion.so/1d08f96fb65c80f9bae6e237bea398dc?v=1d08f96fb65c81929f9b000cdad6ed00)]
		- Defined a new signatory schema (attributes to be recorded, excluding names or any other value that could expose the real identity of a signer).[[Reference](https://www.notion.so/1df8f96fb65c806cbb08d2abfeebf87b?v=1df8f96fb65c81fbbeb6000cf2596606)]
		- Collected and verify signatory information based on new schema
	- Tasks:
		- `ift:2025q2-signatory-registry:signer-scheme-definition`
		- `ift:2025q2-signatory-registry:signer-inventory-revalidation`
		- `ift:2025q2-custody-improvement-plan:mpc-solution-review`

- `ift:2025q2-custody-improvement-plan:signing-devices-upgrade`
	- Upgrade to most secure signing devices to perform org wallet ops
	- Output:
		- Consolidate the current inventory of devices used to sign transactions in org wallets. [[Reference](https://www.notion.so/ift-2025q2-signing-devices-upgrade-inventory-update-1c28f96fb65c80f586a7dbca7088f63b)]
		- Evaluate and select new hardware wallets models (that support clear signing) for treasury/custody activities. [[Reference](https://www.notion.so/1dc8f96fb65c80168db1ff203aedf7af?v=1dc8f96fb65c8187af08000c7e00f72b)]
	- Tasks:
		- `ift:2025q2-signing-devices-upgrade:device-inventory-update`
		- `ift:2025q2-signing-devices-upgrade:device-selection-and-testing`

- `ift:2025q2-audit-plan-refinement`
	- Refined the smart contract testing plan, including Codex modular contract threat scenarios
	- Output:
		- Wrote test cases with foundry to test Codex smart contracts
		- Performed a security gap analysis based on the latest repository updates
		- Expanded test coverage to include edge cases and non-happy paths for Codex contracts
		- Performed fuzzing and invariant testing with Foundry.
		- Penetration testing and code reviewing activities in the Codex repos
	- Tasks:
		- `codex:2025q2-audit-plan-refinement:smart-contract-threat-mapping`
		- `codex:2025q2-audit-plan-refinement:smart-contract-internal-testing`

- `ift:2025q2-security-workflow-automation`
	- Design, deploy and maintain automated workflows to support critical Security Ops and procedures
	- Output:
		- Updated the software catalogue by capturing data from Expensify and implementing a notification system for expiration dates. [[Reference](https://www.notion.so/Use-Cases-1f18f96fb65c803f9727dd21d024e39a)]
		- Developed a function to update the master wallet index when on-chain data changes are detected (signatories, threshold, etc). [[Reference](https://github.com/logos-co/master-wallet-index/commit/79cc0984e28871c0fefbd1971b66bac6258e4459)]
		- 2025q2 Master Wallet Index update. [[Reference](https://github.com/logos-co/master-wallet-index/blob/master/master_wallet_index.md)]
	- Tasks:
		- `ift:2025q2-security-automation:app-catalogue-update-from-expensify`
		- `ift:2025q2-security-automation:automatic-wallet-index-updates`
		- `ift:2025q2-automate-wallet-index-update:add-update-function-to-handler`

- `ift:2025q2-cicd-security-review`
	- Improve GitHub Actions access controls and secret management.
	- Output:
		- Audited reusable workflows for security gaps.
		- Reviewed existing PATs and hardened them to prevent token exposure and misuse.
		- Tracked and resolved issues identified in projects via Dependabot and CodeQL.
		- Reviewed and enhance branch protection configurations for key repositories.
		- Automated the processing of secret scanning notifications and alerts.
	- Tasks:
		- `ift:2025q2-cicd-security-review:gha-hardening`
		- `ift:2025q2-cicd-security-review:cicd-security-hardening`

- `ift:2025q2-sec-infra-maintenance`
	- Ensure the ongoing maintenance and optimization of our security infrastructure
	- Output:
		- Created a POC workflow structure, main and subprocess
		- Finalized tests and activated the n8n on premise backup workflow. [[Reference](https://www.notion.so/ift-2025q2-sec-infra-maintenance-n8n-onprem-workflow-backup-1988f96fb65c804c8a16e6b2c33fb58b?source=copy_link)]
	- Tasks:
		- `ift:2025q2-sec-infra-maintenance:n8n-onprem-workflow-backup`

- `admin\misc`
	- Discussions and catchup with Status,VAC,Keycard,Logos and Codex teams

### Nescience  
#### Highlights  
- Revised all Q1 research tasks output and drafted some conclusion to take decisions regarding several aspects of the architecture, mainly: shielded executions, deshielded executions, privacy flags, UTXOs, and nullifiers.
- Improved the UTXO model (research) and updated its implementation (engineering).
- Started exploring account-based model and started sketching their integration into NSSA.
- Started formalizing NSSA components.
- Engineering wise, implemented private smart contract state model, private state provability, and methods for sc. 
- Also implemented persistent state storage in datebase, stable seriallization for sparse Merkle trees and snapshooting mechanisms.
- Result-wise, we have improved our architecture components by focusing on the UTXO model, the SE and DE models, and acoount-based model for NSSA. Our code was also improved by adding a lot of functionalities and features matching the conducted research.


#### Report  
- `vac:nes:state-separation-architecture-poc`  
    - Overview:  
        - Improved our UTXO model by removing the use of true privacy flags and adding a consistent representation of value.
        - Improved SE and DE models by opting to use single-stage models instead of two-stage models.
        - Improved circuit computation by removing non-membership proofs from circuit in a way that the circuit does not have to re-run big proofs when needed.
        - Investigated Ethereum, Aztec, and Solana token accounts and started sketching integration of Ethereum and Solana's accounts into NSSA.
        - Started investigating linkability issues.
        - Implemented private smart contract state model, private state provability, methods for sc. 
        - Also implemented persistent state storage in datebase, stable seriallization for sparse Merkle trees, migration from Sparse Merkle Tree into HashSet for nullifiers, snapshooting mechanism at node, periodic snapshooting mechanism and start from snapshot block.

    - List of deliverables (ordered as in [task management](https://www.notion.so/State-separation-architecture-PoC-1bf8f96fb65c8034b09bdf2948d15b31)):
        - [Q1 research revision](https://www.notion.so/State-separation-architecture-PoC-1bf8f96fb65c8034b09bdf2948d15b31?p=1f88f96fb65c800c80e9e4ec5f0e3cae)
        - [UTXO model improvement](https://www.notion.so/3-UTXO-Specifications-1498f96fb65c8013a6add7c18496c02c)
        - [NSSA's components formalization](https://notes.status.im/oA-hDDEdQCuiZNHNPA3e8w?view#Nescience-system-components-WIP)
        - [Linkability issues](https://www.notion.so/State-separation-architecture-PoC-1bf8f96fb65c8034b09bdf2948d15b31?p=2038f96fb65c807e8c13d24e65042a05)
        - [SE/DE optimization output](https://www.notion.so/State-separation-architecture-PoC-1bf8f96fb65c8034b09bdf2948d15b31?p=1fc8f96fb65c801f97aecf5e522ddf9e)
        - [Token accounts comparative research](https://www.notion.so/Comparative-analysis-of-Token-models-in-different-projects-1fa8f96fb65c8021a801c4a54bfc4958)
        - [Analysis of Solana's account model](https://www.notion.so/Solana-s-Account-Model-Detailed-Overview-1fc8f96fb65c80cb94e3d985a5151498)
        - [Private state](https://github.com/vacp2p/nescience-testnet/pull/64)
        - [Private state testing](https://github.com/vacp2p/nescience-testnet/pull/65)
        - [Private state provability proposal “Frozen for the moment”](https://github.com/vacp2p/nescience-testnet/pull/68)
        - [Fix AES key derivation for encryption / decryption](https://github.com/vacp2p/nescience-testnet/pull/67)
        - [1/3 Update utxo crate: Remove UTXO Tree](https://github.com/vacp2p/nescience-testnet/pull/75)
        - [2/3 Update utxo crate: Remove nullifier attribute from UTXO](https://github.com/vacp2p/nescience-testnet/pull/76)
        - [3/3 Update utxo crate: Add randomness to UTXO](https://github.com/vacp2p/nescience-testnet/pull/77)
        - [Add clippy to CI](https://github.com/vacp2p/nescience-testnet/pull/78)
        - [Sparse Merkle Tree -> HashSet Migration](https://github.com/vacp2p/nescience-testnet/pull/73)
        - [Hash Storage merkle tree serialization](https://github.com/vacp2p/nescience-testnet/pull/74)
        - [DB Snapshot preparation](https://github.com/vacp2p/nescience-testnet/pull/80)
        - [Periodic snapshots](https://github.com/vacp2p/nescience-testnet/pull/81)
        - [Start from snapshot block](https://github.com/vacp2p/nescience-testnet/pull/82)
       


    - Completed tasks (big tasks):
        - `vac:nes:2025q2:state-separation-architecture-poc:hybrid`
        - `vac:nes:2025q2:state-separation-architecture-poc:priv-impl`
        - `vac:nes:2025q2:state-separation-architecture-poc:node-stability`
