Wallet Trace — Level 1 Wallet Scan

Independent Security Review — PASS WITH RESIDUAL RISK (2026-08-09)

Wallet Trace L1's payment, authentication, and report-download controls completed a formal independent verification and validation (IV&V) review, assigned to a separate evaluator specifically for independence from the team that built the fixes. The initial review (2026-08-04) identified several real gaps in payment handling, authentication, and report-access controls; all were corrected and independently re-verified, including two additional issues a first round of fixes didn't fully close. Final independent verdict: PASS WITH RESIDUAL RISK — the residual items are non-critical, tracked, and do not affect customer funds or data. No customer payment, wallet, or report was ever exposed by the issues found; all were identified and closed through testing before any real-world impact.

Update from MAKO Web (2026-08-12) — WT-IVV-009

A ninth finding, WT-IVV-009, was discovered and fixed 2026-08-12 — not by an independent evaluator this time, but by the MAKO Posse Team itself while fixing an analogous, independently-confirmed finding in a related product whose payment code was originally ported from this one. The quote a customer's exact payment is checked against was being marked "used" slightly too early — before a few smaller checks that run afterward, and before the paid case was actually finished being created. In the rare case one of those later checks failed, a customer who paid the exact right amount could be left without a usable case, with no way to retry using that same payment. Fixed the same day: the quote is now only marked used once the paid case is confirmed to exist. Whether this ever actually affected a real customer has not been separately investigated. This is a new, separate finding — none of WT-IVV-001 through 008 are reopened. Update, same day: an independent IV&V review confirmed WT-IVV-009 fixed. As part of that review's required check for the same mistake elsewhere, it found one further small item, WT-IVV-NF-001 (Low severity): in a rare failure case, a report-download authorization could be marked used just before the final delivery step instead of after it — no payment or authorization control was weakened, but a customer could have needed to re-authorize a download rather than it succeeding on the first try. Fixed the same day, and independently confirmed resolved 2026-08-17 — this closes out the current review cycle. Overall Wallet Trace L1 status remains PASS WITH RESIDUAL RISK, unchanged from 2026-08-09.

Update from MAKO Web (2026-08-01)

Wallet Trace L1 has been deployed to and confirmed working at https://www.makoinu.com/wallet-trace.html: real payment, on-chain verification, live-provider-backed case execution, real balance inventory, and real PDF delivery have all been directly observed working end-to-end multiple times, confirmed by operator acceptance testing. This proves the integration side of the system works in production — it is not a restatement of wallet-trace's own internal milestone tracking below, which MAKO Web does not have current, authoritative visibility into. Confirm M7 status directly with the wallet-trace project rather than from this page; M6 (below) has been resolved for L1 purposes.

Milestones

Historical note — Level 1 balance-inventory requirement

A clarification (2026-07-23) established that the Level 1 report must enumerate the complete current wallet-wide balance inventory — every detectable non-zero BEP-20 holding plus native BNB — not just BNB/LOOP/LSWAP or tokens seen in the ten-day transaction window. This was originally tracked as a prerequisite blocking M6 (graph reconnection); with M6 now moved to L2 scope, it no longer blocks anything in L1.

MAKO Web note: real production case output observed since go-live does show a complete wallet-wide balance inventory (169 token holdings on one real test wallet, 18 on another) — consistent with this requirement being satisfied.

Relationship to MAKO Web

This roadmap covers the wallet-trace engineering work itself. The MAKO Web-side integration gaps once tracked here are resolved: the handoff window bug (was sending 30 days against this project's 10-day cap) was fixed and confirmed correct (requested_window_days: 10) before go-live, and the production host was confirmed to permit proc_open/subprocess execution. Wallet Trace L1 has been deployed to and is live at https://www.makoinu.com/wallet-trace.html as of 2026-07-31, confirmed by real end-to-end customer payments and operator acceptance testing 2026-08-01. See the update panel above.