XahauCards hooks at commit 95cee8b

What was reviewed

How it was done

1. The state contract and the trigger/callback were read in full.
2. Each hook was read against its rules.
3. An adversarial pass tried to break every "holds": free packs, forged emissions, grant/attestor/admin bypass, state clobber, roll grinding, double-mint, refund abuse, edition collisions, griefing.
4. The protocol facts the findings depend on were checked against xahaud source (Transactor, HookAPI, SetRemarks, Remit, CanonicalTXSet) and against live Xahau testnet state.
5. Every candidate finding was verified against the code before it was written down; the draft was then put through an internal red-team and a protocol/calibration panel. The findings in the report are what survived.

Findings, by count

• 0 critical, 0 high. The adversarial pass could not break the payment gate, the mint, the admin/attestor authority, or the composition of the four hooks.
• 2 questions for the client. Places where the code and the client's own documentation could both be read as intended; which governs is the client's to say, so they ship as questions, not findings.
• 4 low-severity items. Self-inflicted within a trusted role, or a recoverable delivery-quality residual. None lets an outsider steal funds, mint, or forge.

Whether the individual items are named on this page, and whether the client's answers to the two questions appear here once settled, is the client's decision. The client holds the full report and may publish it; the hashes below let anyone check that a published copy is the one delivered.

Update 2026-09-15 — the client published the report and his response

XRPLWin has published the report together with his own written response, in the open: github.com/XRPLWin/xahaucards-hooks/independent-reports (response to this review). His response states, in his words, that a review does not pass or fail and that this one did not "pass" — which is the correct reading of what this record says.

What he reports having done, as his account and not as a KVT finding: the first question is resolved by a code change, the second is closed by configuration rather than by a code change, one low item is partly addressed and one is addressed with new tooling, and two low items are accepted as trust-model design decisions rather than changed. He also states that only one of the four built hooks changed, and that the other three remain byte-identical to the builds named in this record.

What the top line rests on

Two things are stated plainly in the report and were not re-proven by the review:

1. The emission-forgery bar. The conclusion that an outsider cannot spoof the shop as the sender of an emitted transaction is a read of the xahaud transactor source, not a test that was run.
2. The deployment bindings. The hook namespaces and the shop / issuer / claim parameters live in the SetHook install, not in the source, and were not read from the deployed accounts.

Free cross-check: a minted pack re-derived from public data

Outside the code review, one real minted pack was reproduced from public ledger data only, with no repository access and no operator input, to test the fairness claim from the outside.

The script reads the theme shape from live testnet hook state. The three inputs are pinned above so the result stays checkable if testnet state is later reset. The client may publish the script.

Disclosure

Document hashes

SHA-256 of the files delivered to the client on 2026-09-08. A published copy that hashes to these values is the delivered one.

Attestation