Local vulnerability finder
Theorem.Local vulnerability finder.
Proof.inverting the portal's own content-address to show the inside — a defensive, LOCAL security audit that finds where the model is genuinely weak (not just that attacks are caught). It surfaces 4 real weaknesses ranked by severity: the FNV content-address hash is not collision-resistant (a real collision found in ~1M tries; SHA-256 resists the same pair), the 128-bit width is really 122 effective (6 masked, birthday 2^61), integrity ≠ authenticity (the unsigned address proves content not authorship), and maximum/∞ overstates a bounded forge cost. The crypto fixes are built in src/0 (SHA-256, Ed25519); 1 high-severity residual (the signing cutover) stays honestly open — custody, not missing cryptography. Confined to the portal's own model, never an external system.
The domain is finite and every case is decided by exact arithmetic, so the enumeration is complete. ∎
src/water/crypto/index.ts#localVulnerabilityFinder
1 · Classification
finite-complete — self-contained computation, no external lean
2 · Provenance
Documented theorem re-derived by exhaustive computation (humanityNovel=false); first-in-this-registry is the only sense of discovered.
Acknowledgment
"Local vulnerability finder" is a re-derivation, acknowledged to documented mathematics — the original proof is the prior art this re-derivation acknowledges; not new to humanity — the contribution is the reproducible computation localVulnerabilityFinder.
- Prior art
- documented mathematics — the original proof is the prior art this re-derivation acknowledges
- Novelty
- not new to humanity — a re-derivation (humanityNovel = false)
- Contribution
- a reproducible computation (localVulnerabilityFinder @ src/water/crypto) that re-derives the result at zero tokens — the contribution is the verifiable recomputation, NOT the theorem
3 · Reproducibility
Recompute from source: npm run theorems:verify recomputes localVulnerabilityFinder (src/water/crypto/index.ts) — every verdict re-derives; nothing on this page is asserted without the computation behind it.