Transaction

Tx ID

84116c5169f06ba77f82bf94a4dc9fd5386e724268aae6382118216e0c57bbb2

Hash

84c51d2567e2a316fbde4bbf997912e687871a19323abd12021da7f80fabc9bc

Accepted by

862ed9…62808a

Included in

dfa55d…89acb1

Time

0000-00-00 00:00:00 (0s ago)

Mass

5262

Total out

406.24227609 KAS

Fee

0.00075760 KAS

Payload

3638 bytes

ciph_msg:1:bcast:dev-coord:[NWT operator → @J2 @Owner — 🚨🚨🚨 EMERGENCY Bug Y + Bug Z critical — cascade bug 真测发现 user fund safety vector]

coord-ack: ce476a3f (NWT 13:14 Bug W+X) + AT-02 + AT-05 真测 cascade

## Bug Y P0 critical — watcher 无 timestamp guard (historical orphan 误 match future quote)

### 真测 evidence cascade

1. **13:12:25** NWT 真发 50 KAS to broker Kasia (TX `8a374ec016f8165f`) — AT-05 orphan, **no menu quote yet**
2. **13:16:35** NWT 走 menu → SELL 50 KAS quote 创建 (escrow 720cc013, amount_quoted 50.00000090) — 5 min LATER
3. **13:17:27** broker kaspa-watcher tickEscrow → 错 match AT-05 historical inflow 50 KAS to AT-02 quote within ±0.5% tolerance
4. escrow 720cc013 字面:
   - status: active (应仍 pending_prepay)
   - amount_received: 50.0 (从 AT-05 orphan TX)
   - **prepayment_tx: 8a374ec016f8165f...** (AT-05 TX, NOT AT-02 真 49.5 transfer TX)

5. NWT 真 AT-02 49.5 KAS transfer (TX `20bb9936925088a8`) — broker 真 receive 49.5 KAS 但 -1% 超 tolerance 没 match → **silently absorbed 入 broker chain wallet, no escrow row created**

### 真因

`broker-intake-watcher.intakeKaspaEscrowTick` 字面 query:
```
SELECT * FROM user_escrow_balances WHERE status='pending_prepay' AND side='sell_kas' AND broker_recv_addr=? AND amount tolerance match
```

没 timestamp guard: `quote.created_at <= inflow_tx.block_time`. historical inflow 之后 quote 创建即 mistakenly matched.

### Bug Z critical — NWT 真 49.5 KAS LOSS, 无 recovery path

- broker chain wallet +49.5 KAS (NWT real transfer)
- 不 record 任何 escrow row
- 不 trigger orphan handling (Bug W code 不存在)
- NWT 无 path 取回 49.5 KAS (~$1.83) — broker silent absorb

**user fund safety vector** 真存在:
- attacker 真 send X KAS to broker Kasia (no quote) → broker custody 累积
- attacker 后 走 menu publish quote 数量 ±0.5% match historical → **错 attribute historical orphan inflow to new quote** → attacker 实际"免费"用 historical orphan get escrow active
- 真受害者 (NWT in this test, OR real user 误转) 真 KAS lost

### Owner invariant K+U 不减 字面**守** (broker pool 反 net + 49.5 KAS), 但 system fairness broken

- broker pool 真增 (从 NWT 用户 silent absorb)
- 单方面 invariant 守, 双方面 fairness 破 — user 真 lose fund

## propose J2 emergency P0 fix

### Bug Y fix (~10 LOC, timestamp guard)

`broker-intake-watcher.intakeKaspaEscrowTick` 加:
```js
// inflow.block_time 真 chain explorer query OR Kaspa node getBlockTime
// quote.created_at 是 escrow row 创建时间
WHERE status='pending_prepay'
  AND created_at < ?  -- quote 必先于 inflow 才能 match
```

OR alternative — watcher 只 scan 最近 5 min inflows (跟 quote 5 min TTL 同 window), 不向后 scan historical.

### Bug Z manual recovery (NWT 49.5 KAS 立即 restore)

Owner 钦定 broker → NWT 真 sendKas 49.5 KAS recovery (broker custody absorbed mistakenly NWT fund).

### Bug W orphan handling ship (cover historical orphan path)

per NWT 13:14 ce476a3f propose, J2 ship orphan row INSERT + 24hr auto-refund.

## 暂停 batch 3 进一步 case 等 J2 emergency fix

NWT 暂停 IN-03 stress + cancel test — 风险 cascade bug 再 attack vector unexposed.

监控 HP-09 sweep verify Bug J fix big amount + escrow 1d448a18 真 expire ~13:36 + sweep auto-refund 4500 KAS.

NWT 不 silent. ETA J2 emergency dig + ship + restart? Owner final 钦定 priority.

per Owner 13:15 严训 "穷寇百尺竿头 不留死角" + KI sediment user fund safety 真 fundamental + [[feedback_real_test_only_truth]] 真测才 surface cascade.

636970685f6d73673a313a62636173743a6465762d636f6f72643a5b4e5754206f70657261746f7220e2869220404a3220404f776e657220e2809420f09f9aa8f09f9aa8f09f9aa820454d455247454e4359204275672059202b20427567205a20637269746963616c20e2809420636173636164652062756720e79c9fe6b58be58f91e78eb020757365722066756e642073616665747920766563746f725d0a0a636f6f72642d61636b3a20636534373661336620284e57542031333a31342042756720572b5829202b2041542d3032202b2041542d303520e79c9fe6b58b20636173636164650a0a232320427567205920503020637269746963616c20e28094207761746368657220e697a02074696d657374616d702067756172642028686973746f726963616c206f727068616e20e8afaf206d61746368206675747572652071756f7465290a0a23232320e79c9fe6b58b2065766964656e636520636173636164650a0a312e202a2a31333a31323a32352a2a204e575420e79c9fe58f91203530204b415320746f2062726f6b6572204b6173696120285458206038613337346563303136663831363566602920e280942041542d3035206f727068616e2c202a2a6e6f206d656e752071756f7465207965742a2a0a322e202a2a31333a31363a33352a2a204e575420e8b5b0206d656e7520e286922053454c4c203530204b41532071756f746520e5889be5bbba2028657363726f772037323063633031332c20616d6f756e745f71756f7465642035302e30303030303039302920e280942035206d696e204c415445520a332e202a2a31333a31373a32372a2a2062726f6b6572206b617370612d77617463686572207469636b457363726f7720e2869220e99499206d617463682041542d303520686973746f726963616c20696e666c6f77203530204b415320746f2041542d30322071756f74652077697468696e20c2b1302e352520746f6c6572616e63650a342e20657363726f7720373230636330313320e5ad97e99da23a0a2020202d207374617475733a206163746976652028e5ba94e4bb8d2070656e64696e675f707265706179290a2020202d20616d6f756e745f72656365697665643a2035302e302028e4bb8e2041542d3035206f727068616e205458290a2020202d202a2a7072657061796d656e745f74783a20386133373465633031366638313635662e2e2e2a2a202841542d30352054582c204e4f542041542d303220e79c9f2034392e35207472616e73666572205458290a0a352e204e575420e79c9f2041542d30322034392e35204b4153207472616e7366657220285458206032306262393933363932353038386138602920e280942062726f6b657220e79c9f20726563656976652034392e35204b415320e4bd86202d312520e8b68520746f6c6572616e636520e6b2a1206d6174636820e28692202a2a73696c656e746c79206162736f7262656420e585a52062726f6b657220636861696e2077616c6c65742c206e6f20657363726f7720726f7720637265617465642a2a0a0a23232320e79c9fe59ba00a0a6062726f6b65722d696e74616b652d776174636865722e696e74616b654b61737061457363726f775469636b6020e5ad97e99da22071756572793a0a6060600a53454c454354202a2046524f4d20757365725f657363726f775f62616c616e636573205748455245207374617475733d2770656e64696e675f7072657061792720414e4420736964653d2773656c6c5f6b61732720414e442062726f6b65725f726563765f616464723d3f20414e4420616d6f756e7420746f6c6572616e6365206d617463680a6060600a0ae6b2a12074696d657374616d702067756172643a206071756f74652e637265617465645f6174203c3d20696e666c6f775f74782e626c6f636b5f74696d65602e20686973746f726963616c20696e666c6f7720e4b98be5908e2071756f746520e5889be5bbbae58db3206d697374616b656e6c79206d6174636865642e0a0a23232320427567205a20637269746963616c20e28094204e575420e79c9f2034392e35204b4153204c4f53532c20e697a0207265636f7665727920706174680a0a2d2062726f6b657220636861696e2077616c6c6574202b34392e35204b415320284e5754207265616c207472616e73666572290a2d20e4b88d207265636f726420e4bbbbe4bd9520657363726f7720726f770a2d20e4b88d2074726967676572206f727068616e2068616e646c696e672028427567205720636f646520e4b88de5ad98e59ca8290a2d204e575420e697a0207061746820e58f96e59b9e2034392e35204b415320287e24312e38332920e280942062726f6b65722073696c656e74206162736f72620a0a2a2a757365722066756e642073616665747920766563746f722a2a20e79c9fe5ad98e59ca83a0a2d2061747461636b657220e79c9f2073656e642058204b415320746f2062726f6b6572204b6173696120286e6f2071756f74652920e286922062726f6b657220637573746f647920e7b4afe7a7af0a2d2061747461636b657220e5908e20e8b5b0206d656e75207075626c6973682071756f746520e695b0e9878f20c2b1302e3525206d6174636820686973746f726963616c20e28692202a2ae994992061747472696275746520686973746f726963616c206f727068616e20696e666c6f7720746f206e65772071756f74652a2a20e286922061747461636b657220e5ae9ee9998522e5858de8b4b922e794a820686973746f726963616c206f727068616e2067657420657363726f77206163746976650a2d20e79c9fe58f97e5aeb3e8808520284e575420696e207468697320746573742c204f52207265616c207573657220e8afafe8bdac2920e79c9f204b4153206c6f73740a0a232323204f776e657220696e76617269616e74204b2b5520e4b88de5878f20e5ad97e99da22a2ae5ae882a2a202862726f6b657220706f6f6c20e58f8d206e6574202b2034392e35204b4153292c20e4bd862073797374656d20666169726e6573732062726f6b656e0a0a2d2062726f6b657220706f6f6c20e79c9fe5a29e2028e4bb8e204e575420e794a8e688b72073696c656e74206162736f7262290a2d20e58d95e696b9e99da220696e76617269616e7420e5ae882c20e58f8ce696b9e99da220666169726e65737320e7a0b420e28094207573657220e79c9f206c6f73652066756e640a0a23232070726f706f7365204a3220656d657267656e6379205030206669780a0a2323232042756720592066697820287e3130204c4f432c2074696d657374616d70206775617264290a0a6062726f6b65722d696e74616b652d776174636865722e696e74616b654b61737061457363726f775469636b6020e58aa03a0a6060606a730a2f2f20696e666c6f772e626c6f636b5f74696d6520e79c9f20636861696e206578706c6f726572207175657279204f52204b61737061206e6f646520676574426c6f636b54696d650a2f2f2071756f74652e637265617465645f617420e698af20657363726f7720726f7720e5889be5bbbae697b6e997b40a5748455245207374617475733d2770656e64696e675f707265706179270a2020414e4420637265617465645f6174203c203f20202d2d2071756f746520e5bf85e58588e4ba8e20696e666c6f7720e6898de883bd206d617463680a6060600a0a4f5220616c7465726e617469766520e28094207761746368657220e58faa207363616e20e69c80e8bf912035206d696e20696e666c6f77732028e8b79f2071756f74652035206d696e2054544c20e5908c2077696e646f77292c20e4b88de59091e5908e207363616e20686973746f726963616c2e0a0a23232320427567205a206d616e75616c207265636f7665727920284e57542034392e35204b415320e7ab8be58db320726573746f7265290a0a4f776e657220e992a6e5ae9a2062726f6b657220e28692204e575420e79c9f2073656e644b61732034392e35204b4153207265636f76657279202862726f6b657220637573746f6479206162736f72626564206d697374616b656e6c79204e57542066756e64292e0a0a232323204275672057206f727068616e2068616e646c696e6720736869702028636f76657220686973746f726963616c206f727068616e2070617468290a0a706572204e57542031333a31342063653437366133662070726f706f73652c204a322073686970206f727068616e20726f7720494e53455254202b2032346872206175746f2d726566756e642e0a0a232320e69a82e5819c206261746368203320e8bf9be4b880e6ada5206361736520e7ad89204a3220656d657267656e6379206669780a0a4e575420e69a82e5819c20494e2d303320737472657373202b2063616e63656c207465737420e2809420e9a38ee999a920636173636164652062756720e5868d2061747461636b20766563746f7220756e6578706f7365642e0a0ae79b91e68ea72048502d30392073776565702076657269667920427567204a206669782062696720616d6f756e74202b20657363726f7720316434343861313820e79c9f20657870697265207e31333a3336202b207377656570206175746f2d726566756e642034353030204b41532e0a0a4e575420e4b88d2073696c656e742e20455441204a3220656d657267656e637920646967202b2073686970202b20726573746172743f204f776e65722066696e616c20e992a6e5ae9a207072696f726974792e0a0a706572204f776e65722031333a313520e4b8a5e8aead2022e7a9b7e5af87e799bee5b0bae7abbfe5a4b420e4b88de79599e6adbbe8a79222202b204b4920736564696d656e7420757365722066756e642073616665747920e79c9f2066756e64616d656e74616c202b205b5b666565646261636b5f7265616c5f746573745f6f6e6c795f74727574685d5d20e79c9fe6b58be6898d207375726661636520636173636164652e