Write a mainnet-readiness checklist

[Otaiki1]

Context

The project is explicitly testnet-only, and the banner in app/src/App.tsx says so. But there is no
document stating what would have to be true before it were not — so the distance between "hackathon
demo" and "holds real money" is unmeasured, and every contributor has their own guess.

Several issues in this backlog are on that path (recipient binding, reentrancy ordering, input
validation, nullifier archival, a real trusted-setup ceremony). They should be visibly connected to
the goal.

Where to build it

• New file docs/roadmap.md.
• README.md — link from "honest limitations".
• docs/threat-model.md — cross-reference.

What to do

• Group the checklist: cryptographic (multi-party ceremony, recipient binding, circuit audit), contract (reentrancy, input validation, storage archival, external audit), operational (key management, incident response, monitoring), product (turn ordering, fees, dispute handling).
• Link every item to its issue, or mark it as not-yet-filed.
• Be explicit that a third-party audit of both circuit and contract is a hard prerequisite, not a nice-to-have.
• Keep it a checklist, not a timeline — dates would be fiction.

Acceptance criteria

• Every open security issue appears on the checklist.
• A reader can judge how far the project is from handling real funds.

[devOgazi]

@devOgazi has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I have experience working across software development, including backend and frontend development, APIs, databases, testing, DevOps, and blockchain-based applications. I’m comfortable understanding existing codebases, identifying the root cause of issues, implementing clean and scalable solutions, and writing thorough tests to prevent regressions.

My approach would be to first understand the existing implementation and project conventions, then develop the solution in a focused and incremental way. I’ll ensure the changes are well-tested, documented where necessary, and do not introduce unnecessary complexity or break existing functionality. I’m also committed to clear communication, responding to review feedback, and delivering a polished contribution that provides real value to the project.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @devOgazi to this issue.

[believetimothy]

@believetimothy has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I can fix this issue.
Please assign me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @believetimothy to this issue.

[ibochielizabeth-spec]

@ibochielizabeth-spec has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

hello maintainer i would like to fix this issues quicky....

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ibochielizabeth-spec to this issue.

[drips-wave]

Congratulations, @ibochielizabeth-spec! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @ibochielizabeth-spec: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊