RAIN RNG · PRE-SUBMISSION PACKAGE v1.2 · DOCUMENT
PROCESS/SECURITY-PROGRAM — PEN-TEST / AUDIT CADENCE (NOT CONTRACTED)
Source
sdk-v2/lab/process/SECURITY-PROGRAM.md · commit 96368332 · GLI CSR §2.2: GLI-19 App. B security program · ← package index · raw on GitHub ↗SECURITY PROGRAM — RAIN RNG (GLI-19 App. B; GLI CSR §2.11 "Information Security"; UKGC RTS security requirements — ISO/IEC 27001:2022 A.8.8, A.8.29; MGA Directive 3 Art. 41; NJ 13:69O-1.5)
What is contracted, what is done, what is pending — stated honestly so the lab does not have to guess. This document closes review finding 4 ("annual pentest, contract audit") to the extent it can be closed on paper: the cadence and scope are fixed here; the first execution of each external item is a procurement decision of the owner and is marked PENDING until a vendor is under contract. Related: docs/GOVERNANCE.md (repository controls), CHANGE-CONTROL.md, SDLC.md, INCIDENT-RESPONSE.md, KEY-MANAGEMENT.md, HOSTING-HA-DR.md.
1. Assets in scope
| asset | where | why it matters |
|---|---|---|
| Certified RNG path | @rain/rng-core (rng.ts, drbg.ts, hash-chain), @rain/rng-session |
fairness; any change is RNG-affecting (CHANGE-CONTROL.md §2) |
| House node | @rain/rng-node (HTTP/WS server, WAL/Postgres store, operator key, self-tests, anchoring) |
the only network-exposed component; holds the house secrets for live sessions |
| On-chain verifiers (Arbitrum One) | ChannelManagerAA, GameMuxVerifier9, RngAnchor.sol (packages/rng-session/contracts) |
dispute resolution; immutable once deployed |
| Python mirror | packages/rng-py |
independent re-implementation used by verifiers/labs |
| Build & release chain | GitHub repository, CI (.github/workflows/ci.yml), npm publication (PUBLISHING.md), lab/FINGERPRINTS.json |
supply-chain integrity of what operators actually run |
2. Program — cadence, scope, status
| # | activity | scope | cadence | trigger for an extra run | status (2026-09-14) |
|---|---|---|---|---|---|
| 1 | External penetration test of the house node (black-box + authenticated: HTTP/WS API, /verify, /healthz, /metrics, WAL/PG store isolation, LB failover, operator-key handling, DoS/abort behaviour, replay/duplicate-commit handling), performed against a staging deployment built from a tagged commit with the production Dockerfile and a real (test) operator key |
@rain/rng-node + reference deployment (docker-compose.ha.yml) |
annual, plus after any change classified S1-relevant in CHANGE-CONTROL.md §2 (transport, store, key handling) |
major version, new transport, new store backend, incident class S1/S4 | PENDING — not yet contracted. No pen-test has been performed. Candidate vendors are lab-approved security testers accepted by the target jurisdictions (UKGC-recognised, MGA-approved); scope document = this row + docs/HOUSE-NODE.md. Report will be filed at lab/results/pentest/<year>/ |
| 2 | Independent cryptographic review of the RNG design (commit-reveal ceremony, hash chains, r_k derivation, DRBG instantiation, intBelow/shuffle, rotation, Appendix A claims) |
RNG-DESCRIPTION.md, SCALING-PROOF.md, STATE-MODIFICATION-3.3.2c.md, rng-core, rng-session |
once per major version of the certified path (currently v2.1); re-review on any RNG-affecting change (also covered by the lab's own source review under GLI-19 §3.2.1) | any change in CHANGE-CONTROL.md §2 |
PENDING — not yet contracted. The GLI submission itself includes source-code review; a separate cryptographer's review is desired but not required by GLI-19 |
| 3 | Smart-contract audit of the deployed verifiers / channel manager / RngAnchor.sol |
packages/rng-session/contracts, deployed addresses in deployments.ts |
once per contract deployment (contracts are immutable; a new deployment = a new audit or delta audit) | any redeploy | PENDING — not yet contracted. Contracts are deployed on Arbitrum One and verified on Sourcify/Arbiscan (source is public), but no third-party audit exists. The site and docs state this ("pre-audit") — docs/LAB-READINESS.md |
| 4 | Dependency & supply-chain scanning | all workspaces (package-lock.json; runtime deps: ws, optional pg, ethers) |
every PR (dependency-review-action, npm audit --omit=dev) + weekly scheduled npm audit |
advisory publication | IN PLACE in repo (ci.yml); runs once the repo is on GitHub with Actions enabled (docs/GOVERNANCE.md §5) |
| 5 | Static analysis / secure-coding review | TypeScript strict, tsc --noEmit on every PR; code-owner review by two maintainers |
every PR | — | typecheck in CI in place; two-maintainer review documented, not yet enforced (GOVERNANCE.md §5) |
| 6 | Runtime integrity monitoring | node self-tests: 11 KATs at boot and on interval, artifact fingerprint self-verification (RAIN_FINGERPRINTS), output inhibition on failure (SP 800-90A §11.3), /metrics duplicate-commit counters |
continuous | — | implemented and tested (packages/rng-node/src/selftest.ts, test/selftest.test.mjs) |
| 7 | Statistical re-testing | Dieharder / NIST STS / TestU01 / scaled outcomes (lab/tools/*) |
on every RNG-affecting change; full battery with each lab submission | change to rng-core/rng-session |
self-run evidence exists (lab/REPORT-STATISTICAL.md); lab-run pending |
| 8 | Key management review | operator ed25519 key (env/file/KMS), rotation procedure, anchoring key | annual, with the pen-test | key exposure (S4) | procedure documented (KEY-MANAGEMENT.md); no HSM/KMS in the reference deployment yet |
| 9 | Incident response exercise | table-top of an S1 (KAT failure / double reveal) and an S2 (store loss) scenario | annual | after any real incident | PENDING (procedure written in INCIDENT-RESPONSE.md; never exercised) |
3. Vulnerability disclosure policy
- Contact: security@rainriskmarkets.com (to be created together with the GitHub repository; until then the maintainer contact in
README.md). ASECURITY.mdat the repository root and asecurity.txton rainriskmarkets.com will point here. - Scope: everything in §1. Out of scope: the marketing site, third-party operators' game front-ends, denial-of-service by volume against a demo deployment.
- Commitments: acknowledgement within 2 business days; triage and severity (CVSS 3.1) within 5 business days; fix or mitigation for critical/high within 30 days, others within 90 days; coordinated public disclosure after the fix ships or at 90 days, whichever is first; credit to the reporter if wanted. No legal action against good-faith research that respects the scope and does not access other people's sessions or funds.
- RNG-affecting fixes follow
CHANGE-CONTROL.md§5 (emergency change): fix → incident record → lab + regulator notified within 24 h with diff and newFINGERPRINTS.json→ full procedure afterwards. - Bug bounty: none at present; to be decided by the owner after the first pen-test.
4. Records
| record | location |
|---|---|
| pen-test reports, retest letters | lab/results/pentest/<year>/ (to be created with the first report) |
| audit reports (crypto review, contract audit) | lab/results/audits/ |
| CI runs / dependency alerts | GitHub Actions / Security tab of the repository |
| incidents & post-mortems | INCIDENT-RESPONSE.md §5 + lab/results/incidents/ |
| this program's yearly review | append a dated entry below |
5. Review log
| date | change |
|---|---|
| 2026-09-14 | Program written (review round 1, item 4). External items 1, 2, 3, 9: pending procurement — no vendor under contract, nothing performed. Items 4–7 in place in the repository. |
← Back to the package index · Rendered 2026-09-14 09:34 UTC from the repository copy; the markdown in the zip / repo is the document of record.