Status: Discussion. Not yet submitted on-chain.
Prepared by: Terra Classic Core, a coalition of Bumeo Capital and LunaClassicDAO
Proposers: Puya (Bumeo Capital) and Classic DAO (LunaClassicDAO)
Named partners: Renzo (LunaClassicDAO) and Till, also known as Frag (Bumeo Capital)
Type: Text proposal under the Pay Per Job structure. This vote moves no funds.
Auditor: SolidProof (FutureVisions Deutschland UG)
Agreement: Security Audit Agreement dated 28 October 2026, fixed fee USD 85,200
Amount: No LUNC amount is set in this text vote. Each spend is sized at the LUNC rate when that spend is submitted.
Summary
This text proposal asks the community to approve one job: an independent security audit of the Terra Classic core chain by SolidProof, paid under the Pay Per Job structure.
The engagement covers the live mainnet core at tag v4.0.1-patch.3, plus the pre-deployment work on the ustc_staking branch: Market Module 2.0, the new x/ustcstaking (USTC staking) module, the tax-redirect path, and the v15 upgrade handler. The full fee is fixed at USD 85,200 for 568 engineer-hours, including a full re-audit after remediation. Remediation itself is done by Terra Classic Core developers at no cost to the community pool.
The job is funded in two steps, each with its own community pool spend proposal after this text passes:
- 40% upfront (USD 34,080), paid before SolidProof starts work, under its own spend proposal.
- 60% on delivery of findings (USD 51,120), under its own spend proposal. The re-audit is included in this part and is not charged separately.
Each spend’s LUNC amount is sized at the LUNC rate at the time that spend is submitted. The LUNC is converted off-chain through SimpleSwap, at a cost of about 1%. Any leftover funds are returned to the community pool.
Terra Classic Core commits to fixing all findings from SolidProof’s audit free of charge, through Renzo (LunaClassicDAO) and Till, also known as Frag (Bumeo Capital), working jointly. The community pays only SolidProof’s audit fee and the conversion cost.
The full proposal PDF and the SolidProof Security Audit Agreement are attached to this thread.
Rationale
The core chain carries Terra Classic’s monetary and fee logic, including treasury, tax and tax exemption, oracle, market, dynamic commission and vesting, plus the app wiring and CosmWasm bindings. The SDK53 upgrade moved the chain across Cosmos SDK 0.47 to 0.53, ibc-go v7 to v10, and from the classic-terra wasmd fork to upstream wasmd 0.61. That code is live on mainnet and has not been independently audited.
Separately, Market Module 2.0 and USTC staking are being prepared on the ustc_staking branch for the v15 network upgrade. Those additions move funds and re-activate swap economics, so they should be reviewed before deployment.
An independent audit of this frozen commit gives validators, developers and holders a public, expert review of both the live core and the pre-deployment modules. The partnership keeps the cost to the community pool to the audit fee and the conversion cost. SolidProof finds and reports the issues. Renzo and Till (Frag) fix them at no charge.
This proposal follows the Pay Per Job process: the job is approved by a text vote first, and money moves only through separate spend proposals tied to the work.
Scope of work
Per the SolidProof Security Audit Agreement dated 28 October 2026:
Audit target
- Repository: GitHub - classic-terra/core: GO implementation of the Terra Classic Protocol · GitHub
- Branch:
ustc_staking - Frozen commit:
35d68fe1b3eb811c27e8bf3f398d5cc197897229(2026-10-15) - Base:
f54cdec2ed8aa04a83d904fe21d5d2a63d35ff93(v4.0.1-patch.3, live on mainnet) plus 52 commits - Size at freeze: 30,329 raw lines / 23,203 nSLOC of non-test, non-generated Go (plus 31
.protodefinitions in scope)
In scope (contracted workstreams)
| Workstream | Hours | Fee (USD) |
|---|---|---|
| Core protocol audit (custom modules, fees/tax, SDK overrides, CosmWasm, IBC, node surface) | 288 | 43,200 |
| Framework migration and state integrity review (SDK53, CosmWasm store migration, upgrade handlers) | 88 | 13,200 |
| Adversarial simulation and economic review | 64 | 9,600 |
| Market Module 2.0, x/ustcstaking (USTC staking), tax redirect, and v15 upgrade | 96 | 14,400 |
| Full re-audit after remediation | 32 | 4,800 |
| Total | 568 | 85,200 |
Explicitly included pre-deployment additions
- Market Module 2.0 re-implementation and re-activated swap economics (allowed swap denoms restricted to
uusd) - New
x/ustcstakingmodule (staking and reward logic) - Tax-redirect mechanism and market accumulator in the fee and burn-tax path
- Oracle TWAP and freshness hooks feeding the market
- v15 upgrade handler
Out of scope (per the agreement)
- Upstream Cosmos SDK, CometBFT, ibc-go, wasmd and wasmvm source, except where Terra Classic modifies or configures them
- Deployed CosmWasm contracts (chain-side integration only)
- Generated protobuf bindings
- Off-chain infrastructure (validators, relayers, RPC, explorers, wallets, price feeders)
- Formal verification
- Economic policy choices (mechanism implementation is in scope; parameter advisability is not)
- Development landing after the freeze, other than the remediation diff verified in the re-audit
Deliverables
- Threat Model and Architecture Note (early)
- Hardened continuous integration configuration (pull request early in the engagement)
- Interim Findings Report (Critical and High findings mid-engagement)
- Audit Findings and Draft Audit Report (triggers the 60% payment)
- Public Audit Status Note (twice: at start with the 40% spend, and on delivery of findings with the 60% spend)
- Final Audit Report after re-audit (publishable)
- Recommendation Summary (consensus-breaking vs non-breaking)
- Fix Verification Statement (per finding, as part of the re-audit)
SolidProof reports Critical findings within 24 hours and High findings within three business days. Unfixed Critical and High findings stay under embargo until a patch is adopted or 90 days, whichever is earlier.
Amount and payment
Rate: USD 150 per engineer-hour. Fixed total: USD 85,200 for 568 hours.
| Item | Share | Amount (USD) |
|---|---|---|
| Upfront payment, before SolidProof starts (own spend proposal) | 40% | 34,080 |
| Payment on delivery of findings, including the re-audit (own spend proposal) | 60% | 51,120 |
| Fixing all audit findings (Renzo and Till (Frag)) | 0 | |
| Development | 0 | |
| Total | 100% | 85,200 |
Payment structure (per §14 of the SolidProof agreement):
- Client. The Client is Terra Classic Core (Bumeo Capital and LunaClassicDAO), acting through Puya (Bumeo Capital) and Classic DAO (LunaClassicDAO). Both payments under the 40/60 split are made only if their community-pool spend proposals pass.
- No LUNC amount in this vote. This text proposal approves the job and the payment structure only.
- Two spends, each sized at its own time.
- No buffer. No 20% buffer or any other buffer.
- No prepaid fix budget. Fixes by Renzo and Till (Frag) at no cost.
- Fee fixed in USD, paid in USDC.
- Funds flow. Community pool → Client receiving multisig → off-chain SimpleSwap (~1%) → SolidProof in USDC.
- Leftovers. Any leftover funds after SolidProof is paid are returned to the community pool.
- Receiving multisig. Four signers: Renzo (LunaClassicDAO), Frag (Bumeo Capital), Puya (Bumeo Capital) and Classic DAO (LunaClassicDAO). The multisig address will be posted in this thread when this text proposal is up for voting.
Timeline
SolidProof starts only after this text proposal passes and the 40% upfront payment has been received (three-week lead time from receipt of that payment).
| When | Milestone |
|---|---|
| After this text passes | First spend proposal (40%, USD 34,080) submitted and voted |
| After the first spend passes and payment is received | Three-week lead time, then SolidProof starts |
| End of week 1 from start | Threat Model and Architecture Note; hardened CI pull request |
| End of week 5 from start | Interim Findings Report |
| End of week 8 from start | Audit Findings and Draft Audit Report (triggers the 60% spend) |
| After delivery of findings | Second spend proposal (60%, USD 51,120) submitted and voted |
| Client remediation window | Up to four weeks; Renzo and Till (Frag) fix findings at no cost |
| Within one week of written remediation complete | Re-audit and Fix Verification Statement |
| Within five business days of the re-audit | Final Audit Report |
| Completion | Report and fix status posted on Agora; any leftovers returned to the community pool |
How this differs from Proposal 12228
| Proposal 12228 | This proposal | |
|---|---|---|
| Auditor | SolidProof | SolidProof |
| First step | Spend proposal, with no text vote first | Text vote first, under Pay Per Job |
| Payment timing | Paid upfront in full | 40% upfront, 60% on delivery of findings (two spends) |
| Buffer | 20% buffer on the audit fee | No buffer |
| Fixing findings | OrbitLabs, US$20,000 budget | Renzo and Till (Frag), US$0 |
| LUNC amount | Set in the proposal | Not set in this text vote |
| Leftover funds | Unused buffer returned | Any leftovers returned to the community pool |
| Scope | Pre-SDK53 / earlier SolidProof scoping | Post-SDK53 core + Market Module 2.0 + USTC staking + v15, frozen at 35d68fe |
| Total cost to the community pool | US$90,800 (audit + fixes, with buffer) | US$85,200 audit fee only (plus ~1% SimpleSwap on each spend) |
Team
Prepared by Terra Classic Core (Bumeo Capital and LunaClassicDAO):
- Puya (Bumeo Capital and Juris Protocol)
- Classic DAO (LunaClassicDAO and WESO)
- Frag, also known as Till (Bumeo Capital and LuncGoblins), Layer 1 developer and Dynamic List Management member (Proposal 12205)
- Renzo (LunaClassicDAO), Layer 1 developer and Dynamic List Management member (Proposal 12205)
Authorised representatives under the SolidProof agreement: Puya (Bumeo Capital) and Classic DAO (LunaClassicDAO). Findings fixed at no cost by Renzo and Frag.
Voting options
- YES: approve the SolidProof security audit as a Pay Per Job job at USD 85,200, paid 40%/60% through two separate spends, with findings fixed by Renzo and Till (Frag) at no cost. No funds move with this vote.
- NO: do not approve this job.
- NO WITH VETO: spam or abuse of governance. If the veto threshold is reached, the deposit is burned.
- ABSTAIN: counted toward quorum only.
To be finalized
When this text proposal is up for voting
- The Client receiving multisig address (signers already named; signing threshold: ________).
Before the first spend proposal goes on-chain
- SHA-256 hash of the accepted SolidProof Security Audit Agreement (28 October 2026).
- SolidProof’s USDC payment address from Appendix D of the agreement.
- The LUNC rate reference for each spend, posted with that spend.
Questions for the community
- Is the 40% upfront and 60% on delivery split the right balance between paying the auditor and protecting the community pool?
- Is SimpleSwap acceptable for the off-chain conversion, at about 1%?
- Any other concerns or questions for Terra Classic Core or SolidProof.
References
- SolidProof: https://solidproof.io/
- SolidProof Security Audit Agreement dated 28 October 2026 (attached)
- Proposal 12228 discussion: Proposal: Terra Classic Security Audit by SolidProof & fixes by OrbitLabs - Proposals - Terra Classic
- Pay Per Job: Proposal 11889, Galaxy Station
- Code: GitHub - classic-terra/core: GO implementation of the Terra Classic Protocol · GitHub
- Frozen audit commit: Merge branch 'ustc_staking' of https://github.com/classic-terra/core … · classic-terra/core@35d68fe · GitHub
Discussion draft aligned with the SolidProof Security Audit Agreement dated 28 October 2026. The Client receiving multisig address will be posted when this text proposal is up for voting. Multisig signing threshold, agreement SHA-256 and SolidProof’s USDC payment address will be posted before the first spend proposal goes on-chain.
