The primary trust assumption is the oracle operator. The oracle has the authority to mint wNNS by attesting that a corresponding NNS deposit was received. A compromised oracle could mint unbacked tokens.

1. Per-tx mint cap — Limits max single mint to 100,000 wNNS
2. Daily mint cap — Rolling 24h window caps total minting at 1,000,000 wNNS
3. Duplicate prevention — Each NNS tx hash can only trigger one mint
4. Pausable — Owner can halt all operations instantly
5. Oracle rotation — Compromised oracle can be swapped without redeploy
6. UUPS upgradeable — Critical bugs can be patched via proxy upgrade
7. Ownable2Step — Ownership transfer requires explicit acceptance
8. ReentrancyGuard — Protection against reentrancy on all state-changing functions
9. No ETH held — Vault only manages wNNS supply, no honeypot of value

1. Oracle runs on isolated infrastructure with minimal permissions
2. Oracle hot wallet holds only enough ETH for gas
3. NNS treasury wallet is a cold wallet with multi-sig (recommended)
4. All oracle actions are logged and monitored

1. Deploy new implementation contract
2. Owner calls upgradeToAndCall() on the proxy
3. Storage layout must be compatible (append-only state variables)
4. Recommended: Use a Timelock controller for production upgrades

• Reentrancy on mint/burn paths
• Storage layout compatibility across upgrades
• Oracle front-running resistance
• Integer overflow in fee calculations
• Proxy initialization protection
• Access control on all admin functions
• Event emission for all state changes
• Edge cases: zero amount, zero address, max uint256