qorechain/qorechain-rdk

Review signals: 1 connection review, 2 hardcoded secret, 129 known vulnerability. 4 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 2 distinct locations. 14 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 2 findings.

OSV reports a known vulnerability in this dependency version. 35 distinct locations. 104 findings.

1 encoded blob matches retained as context; full list in the evidence.

3 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The RDK defaults to testnet, so live module parameters are read from testnet: Real input produced the expected result: "maxRollups": 200

  Source: - Testnet chain id: `qorechain-diana` (live). The RDK defaults to testnet.

  Input: params --json

  Expected: live testnet module parameters are printed, including maxRollups 200

  Command: node <guest-path> params --json

  Observed: "maxRollups": 200, "minStakeForRollup": "10000000000", "rollupCreationBurnRate": "0.01", "defaultChallengeWindow": 3600, "maxDaBlobSize": 2097152, "blobRetentionBlocks": 432000, "maxBatchesPerBlock": 10 }

• Rollup creation shows the stake and burn cost before submitting: Real input produced the expected result: "stakeUqor": "10000000000"

  Source: Rollup creation requires a stake (default 10,000 QOR) and burns a small

  Input: create --rollup-id my-roll --profile defi --dry-run

  Expected: dry run reports a 10,000 QOR stake (10000000000 uqor)

  Command: node <guest-path> create --rollup-id my-roll --profile defi --network testnet --dry-run --json

  Observed: "stakeUqor": "10000000000", "burnUqor": "100000000", "netStakeUqor": "9900000000", "totalRequiredUqor": "10000000000", "burnRate": "0.01" } }

• keygen generates an operator key: Real input produced the expected result: "address": "qor1

  Source: npx @qorechain/rdk-cli keygen # generate an operator key

  Input: keygen --json

  Expected: a new qor1 operator address is printed

  Command: node <guest-path> keygen --json

  Observed: "address": "qor146cyc2n3v7kum24vkql2vyn5gpf20h0kdr4jlz", "mnemonic": "squirrel potato merry hundred mirror know abuse spatial jaguar teach animal claw" }

Examples

• Repository test suites pass (documented root test script: pnpm -r test): command completed successfully

  Source: package.json scripts.test

  Input: pnpm -r test

  Expected: all workspace test suites pass

  Command: pnpm -r test

  Observed: s, environment 0ms, prepare 393ms) cli test: Done packages/rdk-cli test: ✓ test/commands.test.ts (20 tests) 164ms packages/rdk-cli test: ✓ test/withdraw.test.ts (3 tests) 21ms packages/rdk-cli test: ✓ test/entry.test.ts (3 tests) 10ms packages/rdk-cli test: ✓ test/args.test.ts (4 tests) 2ms packages/rdk-cli test: Test Files 4 passed (4) packages/rdk-cli test: Tests 30 passed (30) packages/rdk-cli test: Start at 01:08:22 packages/rdk-cli test: Duration 11.75s (transform 390ms, setup 0ms, collect 9.43s, tests 198ms, environment 0ms, prepare 815ms) packages/rdk-cli test: Done

Cycles

• watchtower polls a rollup's batches on a timer: missing prerequisite: a live rollup on qorechain-diana; creating one needs a funded signer (stake 10,000 QOR)

  Source: packages/ts/src/watchtower/index.ts

  Input: none

  Expected: n/a

  Observed: missing prerequisite: a live rollup on qorechain-diana; creating one needs a funded signer (stake 10,000 QOR)

Local or hosted: local

Build the qorechain-rdk monorepo and run the qorollup operator CLI (keygen, params, create --dry-run) against the live QoreChain testnet, plus the repository test suites

cd <guest-path> && pwd && ls -la && id -u && (git status 2>&1 | head -3); cat /etc/os-release | head -2; python3 --version
cd <guest-path> && cat README.md | head -c 7000
cd <guest-path> && tail -c +7000 README.md | head -c 7000
cd <guest-path> && cat package.json; ls cli packages examples; node --version; npm --version; pnpm --version 2>&1; ls .coldpass; curl -s -m 10 -o /dev/null -w "%{http_code}\n" $CDP_URL/json/version; echo "CDP=$CDP_URL"
cd <guest-path> && curl -s -m 10 -w "\nHTTP %{http_code}\n" $CDP_URL/json/version; cat cli/README.md | head -c 4000; echo; curl -s -m 10 -o /dev/null -w "rest %{http_code}\n" https://api-testnet.qore.host/cosmos/base/tendermint/v1beta1/node_info; npm config get registry
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 pnpm install --frozen-lockfile 2>&1 | tail -25; echo "EXIT ${PIPESTATUS[0]}"
cd <guest-path> && timeout 900 pnpm build 2>&1 | tail -30; echo "EXIT ${PIPESTATUS[0]}"
cd <guest-path> && cat package.json | head -40; ls; ls dist; node dist/index.js --help 2>&1 | head -60
cd /tmp && node <guest-path> keygen --json 2>&1 | sed -E 's/("(mnemonic|privateKey|key)"[^,]*)/"<redacted>"/g' | head -30; echo "EXIT ${PIPESTATUS[0]}"; timeout 120 node <guest-path> params --json 2>&1 | head -c 1500; echo "EXIT ${PIPESTATUS[0]}"
cd /tmp && Q=<guest-path>; timeout 120 node $Q create --rollup-id my-roll --profile defi --dry-run --json 2>&1 | head -c 2000; echo "EXIT ${PIPESTATUS[0]}"; timeout 120 node $Q doctor --json 2>&1 | head -c 1500; echo "EXIT ${PIPESTATUS[0]}"
cd <guest-path> && timeout 900 pnpm -r test 2>&1 | grep -E "Test Files|Tests |FAIL|failed|Error" | head -30; echo "EXIT ${PIPESTATUS[0]}"
cd <guest-path> && grep -rn "setInterval\|setTimeout\|while (true)\|--once\|--now" --include=*.ts packages/*/src cli/src packages/rdk-cli/src 2>/dev/null | head -20; grep -n "watch\|interval" packages/rdk-cli/src/index.ts | head -30
cd <guest-path> && sed -n 60,90p packages/rdk-cli/src/index.ts; sed -n 105,200p packages/ts/src/watchtower/index.ts | head -110
cd <guest-path> && grep -n "Rollup creation requires a stake\|Testnet chain id\|npx @qorechain/rdk-cli keygen\|npx @qorechain/rdk-cli doctor\|generate an operator key\|Mainnet chain id" README.md | cat -A | cut -c1-200
mkdir -p <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["node","<guest-path>","create","--rollup-id","my-roll","--profile","defi","--network","testnet","--dry-run","--json"],"cwd":"<guest-path>","env":{},"expected_text":"\"stakeUqor\": \"10000000000\""}
EOF
cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"The RDK defaults to the testnet preset for the qorollup CLI","source":"- Testnet chain id: `qorechain-diana` (live). The RDK defaults to testnet.","input":"doctor --json","expected":"doctor reports the client is on testnet (qorechain-diana)","probe_kind":"cli","argv":["node","<guest-path>","doctor","--json"],"stdin":"","expected_text":"client is testnet (qorechain-diana)","cwd":"<guest-path>","env":{}},
{"kind":"claim","claim":"Rollup creation shows the stake and burn cost before submitting","source":"Rollup creation requires a stake (default 10,000 QOR) and burns a small","input":"create --rollup-id my-roll --profile defi --dry-run","expected":"dry run reports a 10,000 QOR stake (10000000000 uqor)","probe_kind":"cli","argv":["node","<guest-path>","create","--rollup-id","my-roll","--profile","defi","--network","testnet","--dry-run","--json"],"stdin":"","expected_text":"\"stakeUqor\": \"10000000000\"","cwd":"<guest-path>","env":{}},
{"kind":"claim","claim":"keygen generates an operator key","source":"npx @qorechain/rdk-cli keygen            # generate an operator key","input":"keygen --json","expected":"a new qor1 operator address is printed","probe_kind":"cli","argv":["node","<guest-path>","keygen","--json"],"stdin":"","expected_text":"\"address\": \"qor1","cwd":"<guest-path>","env":{}}
]
EOF
python3 -I -c 'import json;json.load(open("probe.json"));json.load(open("claims.json"));print("ok")'
cd <guest-path> && cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Repository test suites pass (documented root test script: pnpm -r test)","source":"package.json scripts.test","input":"pnpm -r test","expected":"all workspace test suites pass","argv":["pnpm","-r","test"],"cwd":"<guest-path>","env":{},"stdin":"","expected_text":"259 passed (259)"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"watchtower polls a rollup's batches on a timer","source":"packages/ts/src/watchtower/index.ts","quote":"if (!stopped) timer = setTimeout(() => void tick(), intervalMs);","schedule":"setTimeout loop every intervalMs","method":"not run: a single tick needs a live on-chain rollup id and a reachable challenge state; no rollup exists on testnet for this guest and no funded signer is configured","input":"none","expected":"n/a","reason":"missing prerequisite: a live rollup on qorechain-diana; creating one needs a funded signer (stake 10,000 QOR)"}]}
EOF
python3 -I -c 'import json;json.load(open("examples.json"));json.load(open("cycles.json"));print("ok")'
ls -la <guest-path> /inputs/ 2>&1 | head; cd /tmp && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000; echo "EXIT ${PIPESTATUS[0]}"
cd <guest-path> && python3 -I - <<'EOF'
import json
p='<guest-path>'
c=json.load(open(p))
c[0]={"kind":"claim","claim":"The RDK defaults to testnet, so live module parameters are read from testnet","source":"- Testnet chain id: `qorechain-diana` (live). The RDK defaults to testnet.","input":"params --json","expected":"live testnet module parameters are printed, including maxRollups 200","probe_kind":"cli","argv":["node","<guest-path>","params","--json"],"stdin":"","expected_text":"\"maxRollups\": 200","cwd":"<guest-path>","env":{}}
json.dump(c,open(p,'w'),indent=1)
print("ok")
EOF
cd /tmp && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "EXIT $?"; head -c 1500 <guest-path>; echo; grep -o '"valid": [a-z]*' <guest-path> | head; grep -o '"verdict": "[a-z]*"' <guest-path>
cd <guest-path> && python3 -I - <<'EOF'
import json
r={
"outcome":"working",
"fault_owner":None,
"operation":"Build the qorechain-rdk monorepo and run the qorollup operator CLI (keygen, params, create --dry-run) against the live QoreChain testnet, plus the repository test suites",
"operation_scope":"Linux Ubuntu 24.04 guest, Node v22.23.4, pnpm 9.12.0 (pinned by packageManager), public testnet endpoints (api-testnet.qore.host). Not covered: creating or operating a live rollup, signing/broadcasting transactions, watchtower polling (needs a live rollup and funded signer), mainnet.",
"steps":[
"pnpm install --frozen-lockfile",
"pnpm build",
"node packages/rdk-cli/dist/index.js keygen --json",
"node packages/rdk-cli/dist/index.js params --json",
"node packages/rdk-cli/dist/index.js create --rollup-id my-roll --profile defi --network testnet --dry-run --json",
"pnpm -r test (259 packages/ts + 9 cli + 30 rdk-cli tests passed)"
],
"deviations":[
"README quickstart uses `npx @qorechain/rdk-cli ...`; the guest ran the locally built bin `node packages/rdk-cli/dist/index.js` (same entry point, built from the pinned commit) so the pinned source was exercised rather than the npm release.",
"README says v0.4.4 but the pinned source's rdk-cli package is 0.7.0; the README version table is stale relative to the source.",
"Checker path /inputs/coldpass-preflight.py does not exist in the guest; used <guest-path> instead.",
"doctor was run as setup only; the doctor-based testnet claim was replaced by the live `params` operation because the checker classes doctor as setup-only.",
"Watchtower cycle not run: packages/ts/src/watchtower/index.ts polls on a setTimeout loop, but a single tick needs a live rollup on qorechain-diana and a funded signer (10,000 QOR stake), which this guest does not have. Recorded as a missing prerequisite in cycles.json.",
"No browser was needed; CDP endpoint http://<internal-ip>:9226/json/version returned HTTP 200 (HeadlessChrome/155.0.0.0) but the product does not use it."
],
"stuck_step":None,
"main_blocker":None,
"plain_failure":None,
"suggested_fix":"None required for the working path. To exercise the watchtower cycle, provide a funded testnet operator key and an existing rollup id, then run `qorollup watchtower <id>` for one poll."
}
json.dump(r,open('<guest-path>','w'),indent=1)
print("ok")
EOF
cd /tmp && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | grep -o '"valid": [a-z]*\|"status": "[A-Z]*"' | head -4; ls <guest-path>