Torq Documentation

Threat model, trust assumptions, security fields, failure modes, emergency procedures, recovery, and monitoring for Torq.

Torq protects governed credit operations by making authority, valuation, execution, and final state visible.

Security in Torq is not only contract code. It also includes permissions, oracle freshness, NAV lineage, indexer correctness, wallet execution, timelocks, incident recovery, data sensitivity, and operator monitoring.

Risk model in context

Aave-style lending risk is commonly explained through collateral, liquidation, pool liquidity, utilization, governance, and oracle risk. Morpho-style vault risk also includes curator, allocator, adapter, cap, gate, and role-separation risk. Torq includes credit, oracle, liquidation, and role risk, but it adds a stronger operating emphasis: the product must prove that every role is acting on the same indexed state after writes complete.

Product safety model

Controlled credit workflows need visible permissions and completion

PermissionsWho can perform the action?

role + wallet + entity

FreshnessIs the state current enough?

NAV + Live-Feed + oracle status

ExecutionWhat must the user sign?

wallet plan + action review

VisibilityWhen is the result visible?

indexed state + workspace refresh

Threat model

Threat	Plain meaning	Torq control
Wrong person acts	A wallet tries an action it should not control.	Role, wallet, entity, function, permission, and timelock checks.
Wrong entity changes	A valid role tries to change the wrong vault, market, asset, or workspace.	Entity-scoped permissions and page surface ownership.
Stale valuation	Price, NAV, or feed data is too old or unsafe.	NAV cadence, signed reports, oracle freshness, supply-aware freeze states, fail-closed action gating.
Frontend invented truth	A screen guesses protocol state from local logic.	Canonical read model and live-RPC exception governance.
Wallet success misread as product completion	User sees transaction success before the app state updates.	Post-write indexing, projection, tracked mutation progress, and reread.
Permission escalation	A role gains broader authority than intended.	Permission templates, scoped authority, timelock roles, governance checks.
Liquidation misuse	Recovery action runs when position is not eligible.	Close factor, oracle version, risk epoch, health, freeze, and partition checks.
Sensitive data leak	Logs or docs expose secrets or private operational data.	Data-sensitivity governance and secret scanners.
Incident under-response	A degraded or unsafe state is not reviewed by the right operator.	Incident routes, operations SRE review, stakeholder incident reports, and governed-action review surfaces.
False release confidence	Advisory evidence is treated as release proof.	Release readiness review, evidence review, generated coverage, boundary governance, and explicit claim boundaries.

Trust assumptions

Torq assumes:

Active V2 contracts are the root for value-moving protocol state.
Projectors deterministically turn observed state into Postgres current-state rows.
GraphQL and operator APIs serve Postgres-backed application truth.
Frontend workspaces consume persisted state and use live RPC only for approved wallet or preflight scopes.
Operators protect private keys, auth tokens, privileged RPC credentials, and deployment secrets.
External price and NAV sources can fail stale and must be checked before risk-increasing actions.

What this means

Torq does not ask the reader to trust a screen because it looks current. It asks the system to show where the state came from, whether it is fresh, who can act on it, and whether the final projected record updated.

Security fields

Control	What it does	Example
Active V2 inventory	Keeps active contracts separate from legacy archaeology.	`torq-v2-active-contract-inventory.json`.
Permission manager and scoped authority	Enforces who can act and on what entity.	Protocol permission manager, scoped entity authority.
Timelock	Delays sensitive changes before execution.	TorqTimelock and workspace timelock executor.
Canonical read model	Prevents multiple application truth paths.	Chain -> Indexer -> Projector -> Postgres -> API -> Frontend.
Live RPC registry	Restricts browser RPC usage.	Balances, allowances, gas, simulation, pending transaction status, bounded preflight.
Oracle/NAV freshness	Blocks unsafe state when data is stale.	Signed NAV, SingleFeed, PairMultiHop, SupplyAware, ConservativeMin adapters.
Post-write verification	Confirms writes through indexed state.	Tracked mutations and refresh paths.
Boundary governance	Connects high-risk changes to checks and evidence.	`npm run check:boundary-governance`.
Operations and release review	Keeps incidents, governed actions, release readiness, and evidence status visible.	Operations SRE and release-manager surfaces where configured.

Failure modes

Failure	User-visible result	Response
Wallet rejected	Action stays unsubmitted.	User can review inputs and retry.
Transaction failed	Error state and no verified completion.	Review revert reason and current state.
Indexing lag	Action appears pending after wallet success.	Trigger or wait for projection refresh.
Oracle stale	Borrow, withdraw, liquidation, or risk-increasing action can be blocked.	Refresh feed/NAV path or use recovery procedure.
Permission missing	Action unavailable or blocked.	Assign correct scoped role or use governance route.
Timelock waiting	Scheduled action is not executable yet.	Wait until configured delay expires.
Projector failure	Workspace may show stale or degraded state.	Restore indexer/projector and reconcile.
Incident review gap	A stakeholder reports a degraded state but no owner reviews it.	Route to operations SRE or Incident Protection and keep affected state visible until resolved.
Release evidence stale	A report exists but no longer matches current source.	Treat it as advisory until release readiness and evidence review rerun against current source.

Emergency procedures

Situation	Procedure
Critical role lost	Use supported critical-role recovery action path through Incident Protection or Protocol Manager where configured.
Market unsafe	Use market emergency fields, freezes, or risk settings where authority allows.
Oracle or NAV unsafe	Move to safer adapter, freeze risk-increasing actions, or restore fresh source data.
Indexer degraded	Treat product state as stale until projector and Postgres catch up.
Sensitive secret exposed	Rotate secret, invalidate sessions or keys, and avoid logging raw proof material.

Recovery procedures

Identify the affected vault, market, role, or data path.
Confirm current persisted state.
Confirm whether the issue is contract state, API state, projection state, wallet execution, or operator permission.
Use the narrowest supported recovery action.
Trigger indexing or projection refresh.
Confirm final state through API and workspace reread.
Record residual risk and follow-up.

Monitoring requirements

Monitor:

indexer lag and projection failures
oracle and NAV freshness
tracked mutation progress
scheduled timelock actions
failed wallet execution and revert patterns
permission changes and critical-role membership
liquidation candidates and unhealthy borrower partitions
stale workspace states
stakeholder incident reports and operations SRE review queues
release readiness and evidence review state
governed-action review state
background jobs such as workspace message expiry, market feed relay, contract verification, and AI allocator

For reviewers

Risk and security evidence is in config/boundary-governance-contract.json, apps/web/config/live-rpc-exception-registry.mjs, services/indexer/config/live-rpc-exception-registry.mjs, apps/web/config/functionRegistry.json, ops/security/**, active V2 contracts, and accounting assurance artifacts.

Risk & Security