× 
Infrastructure
Infrastructure covers the off-chain surface attackers probe first, from domains and web applications to key storage, backend services, and RPC. A protocol with a flawless program can still lose user funds through a hijacked registrar account.
An attacker who compromises the registrar account can redirect the domain and serve users a hostile frontend from the real URL, without touching the program.
Domain registrar accounts are hardened with hardware 2FA and restricted account recovery.
Domain lock is enabled to prevent unauthorized transfers.
Registrar access is limited to the fewest people who need it, and access is logged.
Expiration monitoring is in place.
Most users meet the protocol through its frontend. A compromised page can rewrite transactions before a wallet ever signs them, so the web surface needs the same rigor as the program.
Frontend and API surfaces undergo regular penetration testing.
The web application sets CSP headers.
The web application uses subresource integrity.
The web application validates input.
These controls govern where keys for privileged operations live and who can use them. Plaintext storage in a file, an environment variable, or a repository turns every reader of that location into a potential signer.
Cryptographic keys for privileged operations are stored in an HSM or a cloud KMS.
Keys are never stored in plaintext.
Keys are never stored in environment variables.
Keys are never stored in source control.
Key generation follows a documented ceremony.
A rotation schedule is in place and enforced.
Access to signing infrastructure requires multi-party authorization.
Backup and recovery procedures are tested regularly.
Cranks, keepers, liquidation bots, relayers, and indexers run on ordinary servers with ordinary failure modes. Each needs patching, credential hygiene, redundancy, and a documented answer for what happens when it goes down.
All off-chain components are enumerated, including cranks, keepers, liquidation bots, relayers, indexers, and APIs. Availability requirements and failure impact are documented for each.
Services run with redundancy and failover.
Secrets management uses dedicated tooling rather than shared credentials.
Server and container access follows least privilege, with audit logging.
Cloud infrastructure is reviewed for misconfigurations such as public storage buckets and overly permissive IAM policies.
Every off-chain component reaches the chain through RPC. When the only provider degrades, liquidations, monitoring, and user exits degrade with it.
The RPC provider strategy is documented as self-hosted, third-party, or hybrid.
Single-provider dependencies are avoided on critical paths.
Fallback RPC endpoints are configured and tested.
Rate limits and provider SLAs are understood relative to the protocol’s throughput requirements.
Validator client diversity considerations are documented where relevant.