Mina

We express our gratitude to the Mina team for the collaborative engagement that enabled the execution of this Blockchain Protocol Security Assessment.

MinaGuard is a multisignature asset-management application built on Mina Protocol. It allows groups of owners to manage MINA through configurable approval thresholds and supports hierarchical SubVaults with independent governance. The product combines an o1js smart contract, a web client, a backend indexer, and an offline signing CLI for air-gapped approval workflows.

The system users should acknowledge all the risks summed up in the risks section of the report

{FindingsVulnSeverityStatusTable}

Documentation quality

• The repository includes detailed security-model, contract-architecture, deployment, and offline-signing documentation.

• The code is very well documented, and the critical parts are clearly explained.

Code quality

• The codebase is generally well structured, strongly typed, and divided into contract, client, backend, and offline-signing components.

• Security-critical logic is implemented correctly across the contract, web client, backend, and offline CLI.

Architecture quality

• The RootVault/SubVault model and propose–approve–execute workflow provide clear separation between governance and execution.

• The architecture relies heavily on a centralized event indexer for reconstructing security-critical state, creating availability and integrity risks for every client.

Test coverage

• bun test --coverage reports 96.27% function coverage and 98.95% line coverage; branch coverage is unavailable.

• Permission-vector validation, foreign-account preconditions, malicious prover inputs, indexer poisoning, client display consistency, concurrent workflows tests are provided..

MinaGuard is a hierarchical multisignature vault system built on Mina Protocol. The system includes an o1js smart contract, a web client, a backend indexer, and an offline signing CLI.

Smart contracts The on-chain system is implemented by contracts/src/MinaGuard.ts. Each RootVault and SubVault is a separate deployment of the same MinaGuard zkApp contract. A RootVault has no parent, while a SubVault is bound to one RootVault; SubVaults cannot create further descendants.

The contract stores the owner commitment, approval threshold, proposal nonce, approval and vote-nullifier Merkle roots, parent relationship, and SubVault lifecycle state. Owners authorize content-bound proposals through signatures. Once enough approvals are recorded, a corresponding proven execute* method applies the operation.

LOCAL proposals govern the vault on which they are recorded. REMOTE proposals are recorded and approved on a RootVault, then executed on the designated SubVault. Supported operations include MINA transfers, owner and threshold changes, delegation, SubVault creation and funding, fund recovery, destruction, and enabling or disabling SubVault-local governance.

Web client and proving worker The web application handles vault creation, proposal review, wallet interaction, witness reconstruction, proof generation, and transaction submission.

Backend indexer The backend processes contract events and reconstructs vault ownership, proposals, approvals, execution status, and RootVault/SubVault relationships for the web client.

Offline signing CLI The CLI imports bundles exported by the web application, displays the operation to an air-gapped signer, reconstructs and proves the transaction, and returns a signed transaction for online submission.

The scope of the project includes the following components from the provided repository:

Components in Scope

zkApp circuit **contracts/src/****

• MinaGuard.ts

• constants.ts

• index.ts

• list-commitments.ts

• memo.ts

• storage.ts

• utils.ts

Air-gapped signer **offline-cli/src/****

• build-tx.ts

• index.ts

• summary.ts

• wasm-shim.ts

Browser signing TCB

• ui/lib/multisigClient.worker.ts

• ui/lib/multisigClient.ts

• ui/lib/offline-signing.ts

Protocol dependency

• ui/deps/o1js submodule (mina-signer)

Assets in Scope