[Dimank92]

Summary

Resolves #198 by implementing a comprehensive THREAT_MODEL-driven negative test suite for authorization, privileged role enforcement, and admin-bypass paths across the Zenith protocol contracts (test_fixtures/tests/threat_model_negative.rs).

Every test validates live contract instances and asserts concrete, typed contract error codes (Err(Ok(Error::...))) without relying on generic panics or untyped execution errors.

---

Threat Model Coverage Mapping

THREAT_MODEL Section	Target Contract	Threat Vector Tested	Expected Typed Rejection / Behavior	Status
Section 1 (Trust Boundaries)	vault	Non-admin attempting direct transfer_admin	Rejection of unauthenticated/unauthorized caller	Verified Live
Section 1 (Trust Boundaries)	vault	Unapproved multisig action calling admin entrypoints (transfer_admin_via_multisig, pause_via_multisig, unpause_via_multisig, sweep_untagged_via_multisig)	Err(Ok(vault::Error::Unauthorized)) (Error #6)	Verified Live
Section 1 (Trust Boundaries)	price_oracle	Unapproved multisig action mutating config (add_feeder_via_multisig, set_min_reports_via_multisig, set_max_staleness_via_multisig, transfer_admin_via_multisig)	Err(Ok(price_oracle::Error::Unauthorized)) (Error #9)	Verified Live
Section 1 (Trust Boundaries)	timelock	Non-proposer scheduling, non-executor executing, non-canceller cancelling	Err(Ok(timelock::Error::Unauthorized)) (Error #2)	Verified Live
Section 2.1 (Outflow Limits)	vault / options_market	Per-window cumulative outflow limits and automated circuit breakers	Gated follow-up test tracked under issue #19	Tracked Follow-up (#[ignore])
Section 2.2 (Protocol Guardian)	Protocol-wide	Guardian auto-expiring pause mechanism	Gated follow-up test tracked under issue #18	Tracked Follow-up (#[ignore])
Section 2.3 (Granular Roles)	Protocol-wide	Fine-grained roles (GUARDIAN, ORACLE_ADMIN, FEE_MANAGER, EMERGENCY_SETTLER)	Gated follow-up test tracked under issue #17	Tracked Follow-up (#[ignore])
Section 2.4 (Oracle Consensus)	price_oracle	Single feeder attempting to determine aggregate alone with min_reports >= 2	Fails closed: returns None (no price produced without quorum)	Verified Live
Section 2.4 (Oracle Consensus)	price_oracle	Unauthorized non-feeder reporting price observations	Err(Ok(price_oracle::Error::NotAFeeder)) (Error #4)	Verified Live
Section 2.4 (Oracle Consensus)	price_oracle	Minority outlier feeder attempting extreme price manipulation (100x skew)	Bounded by median consensus of honest feeder reports	Verified Live
Section 2.5 (Solvency & Tags)	vault	Cross-tag withdrawal attempting to drain another series tag's collateral	Err(Ok(vault::Error::InsufficientEscrowBalance)) (Error #3)	Verified Live
Section 2.5 (Solvency & Tags)	vault	Unregistered rogue address attempting to create and deposit into tags	Err(Ok(vault::Error::UnregisteredIntegrator)) (Error #8)	Verified Live
Section 2.5 (Solvency & Tags)	vault	Fee-on-transfer token deposit attempting undercollateralization	Measured delta check (safe_inbound_transfer) credits only arrived tokens	Verified Live
Section 2.6 (Multisig Quorum)	multisig	Non-signer attempting to cast approvals or propose signer changes	Err(Ok(multisig::Error::NotASigner)) (Error #4)	Verified Live
Section 2.6 (Multisig Quorum)	multisig	Executing an action below threshold weight	Err(Ok(multisig::Error::NotYetApproved)) (Error #6)	Verified Live
Section 2.6 (Multisig Quorum)	multisig	Duplicate approval replay from same signer	Err(Ok(multisig::Error::AlreadyApproved)) (Error #5)	Verified Live
Section 2.6 (Timelock Tiers)	multisig	ActionClass execution delays enforced on multisig directly	Gated follow-up test tracked under issue #150	Tracked Follow-up (#[ignore])
Core Requirement 5	timelock	Executing an operation before delay has elapsed	Err(Ok(timelock::Error::NotReady)) (Error #5)	Verified Live
Core Requirement 5	timelock	Scheduling operation with delay below min_delay	Err(Ok(timelock::Error::InsufficientDelay)) (Error #3)	Verified Live
Core Requirement 5	timelock	Executing dependent operation before predecessor operation is done	Err(Ok(timelock::Error::PredecessorNotDone)) (Error #6)	Verified Live

---

Test Verification

running 20 tests
test threat_2_single_feeder_cannot_determine_aggregate_alone ... ok
test threat_2_minority_outlier_feeder_cannot_skew_median_beyond_honest_bounds ... ok
test threat_3_vault_delta_check_protects_against_fee_on_transfer_undercollateralization ... ok
test threat_4_signer_approving_outside_allowed_set_is_rejected ... ok
test threat_2_unauthorized_feeder_cannot_report_price ... ok
test threat_unverified_section_2_1_rate_limited_outflow_circuit_breaker ... ignored, issue #19: rate-limited outflows and withdrawal circuit breakers not yet implemented
test threat_unverified_section_2_2_protocol_guardian_auto_expiring_pauses ... ignored, issue #18: auto-expiring pauses and protocol guardian role not yet implemented
test threat_unverified_section_2_3_granular_access_control_roles ... ignored, issue #17: granular access control roles not yet implemented
test threat_unverified_section_2_6_multisig_timelock_tiers_is_executable ... ignored, issue #150: multisig is_executable per-ActionClass delay enforcement not yet implemented
test threat_4_multisig_duplicate_approval_rejected ... ok
test threat_5_timelock_delay_below_minimum_fails_insufficient_delay ... ok
test threat_4_multisig_action_execution_below_threshold_fails ... ok
test threat_1_vault_unauthorized_non_admin_cannot_transfer_admin ... ok
test threat_3_unregistered_integrator_cannot_create_tags ... ok
test threat_5_timelock_action_executed_before_delay_fails_not_ready ... ok
test threat_1_price_oracle_unauthorized_non_admin_cannot_mutate_config ... ok
test threat_1_timelock_unauthorized_roles_cannot_schedule_execute_or_cancel ... ok
test threat_3_cross_tag_withdrawal_cannot_drain_another_tags_deposit ... ok
test threat_1_vault_unapproved_multisig_admin_actions_rejected ... ok
test threat_5_timelock_dependent_cannot_execute_before_predecessor ... ok

test result: ok. 16 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 0.52s

All other workspace test suites pass with 0 failures:

• zenith-multisig: 88 passed, 0 failed
• zenith-timelock: 23 passed, 0 failed
• zenith-vault: 69 passed, 0 failed
• zenith-price-oracle: 146 passed, 0 failed
• zenith-test-fixtures: 13 passed, 0 failed

---

Payout Wallet (Base / Polygon / EVM): 0xC345C07229307d4f1c7935aD2cAe48e390215808