The security engine
tuned for your codebase.

Tune V12 to your codebase. Investigate security findings with the source, a reproducible proof, and a concrete fix.

PTP rollback lets a stale cancel release live risk

Properties

Status: Open
Severity: High
Owner: Tam Lund

Origin

Repository: northstar/execution
Tune: Clock domains & epochs
Run: Run #8
Commit: b6a770a84ef9c2d1a2d8e98042fe78f431f77e84

Slots at risk.rslines 59 to 66 leave a monotonic-time quarantine, but their generations come from quantized NIC PTP time. With the configured backward-step policy, B can reuse cancelled A’s slot and generation. A replayed FIX cancel for A then passes risk.rslines 76 to 83 and releases B’s reservation.

Risk admits C while B remains live: two 1m orders against a 1m cap. The bounded deterministic reproduction explores rollback, slot reuse and cancel replay in this crate—not a hardware or production trace. Calls are serialized; memory ordering cannot fix identity reuse.

northstar/execution/src/risk.rs

ShowHide 48 lines
  }
50
  pub fn reserve(&mut self, units: u64, clocks: ClockReading) -> Result<Ticket, RiskError> {
      if units == 0 {
          return Err(RiskError::ZeroUnits);
      }
      let next_total = self.reserved.checked_add(units).ok_or(RiskError::Capacity)?;
      if next_total > self.cap {
          return Err(RiskError::Capacity);
      }
      let slot_index = self.slots.iter().position(|slot| {
          slot.units == 0 && clocks.monotonic_ns >= slot.reusable_at
      }).ok_or(RiskError::NoSlot)?;
      let slot = &mut self.slots[slot_index];
      // PHC buckets are reused if the configured servo steps backward.
      let generation = clocks.nic_ptp_ns / crate::clock::PTP_BUCKET_NS;
      slot.generation = generation;
      slot.units = units;
V12Run #8Reuse waits on monotonic time, but identity comes from a quantized NIC PTP clock. After quarantine expires, a configured backward servo step can give B the exact slot and generation previously assigned to A.
      self.reserved = next_total;
      Ok(Ticket { slot: slot_index, generation })
  }
70
  /// A confirmed venue cancel, including a later FIX replay of that report.
  pub fn cancel_ack(&mut self, ticket: Ticket, clocks: ClockReading) -> Result<bool, RiskError> {
      let Some(slot) = self.slots.get_mut(ticket.slot) else {
          return Ok(false);
      };
      if slot.units == 0 || slot.generation != ticket.generation {
          return Ok(false);
      }
      let reusable_at = clocks.monotonic_ns.checked_add(QUARANTINE_NS)
          .ok_or(RiskError::ClockOverflow)?;
      self.reserved -= slot.units;
      slot.units = 0;
      slot.reusable_at = reusable_at;
V12Run #8A replayed cancel for A now matches live B. It releases B’s reservation without cancelling B at the venue. C can consume the freed budget: two 1m live orders against a 1m cap. Exclusive access does not prevent identity reuse.
      Ok(true)
  }
86}

northstar/execution/tests/temporal_aba.rs

PoC

northstar/execution/src/risk.rs

Fix+3−2

V12Run #8

Advance the retained slot generation, never a clock reading. checked_add refuses reuse on exhaustion before changing the reservation. Within this slab lifetime, an old ticket cannot name a later occupant; a restart must establish a fresh FIX epoch.

ShowHide 61 unchanged lines

62 let slot = &mut self.slots[slot_index];

63− // PHC buckets are reused if the configured servo steps backward.

64− let generation = clocks.nic_ptp_ns / crate::clock::PTP_BUCKET_NS;

+ // Slot identity advances independently of both clocks.

+ let generation = slot.generation.checked_add(1)

+ .ok_or(RiskError::GenerationExhausted)?;

65 slot.generation = generation;

66 slot.units = units;

ShowHide 20 unchanged lines

Securing the code behind systems that cannot afford to fail.

The proof is
in the findings.

Security research from V12, with the technical details behind the findings.

All research

Read the inbox
at any commit.

Each repository has its own inbox. Open main, a pull request, or a commit from its history. Findings stay tied to the code V12 reviewed, so you can compare their evidence across revisions.

Explore the inbox

Repositories northstar/execution

Read at

main

Findings History

All 6 7dd2205

High severity, Open F-142 Seqlock retry admits a mixed-generation risk snapshot Lock-free risk snapshots Unassigned 2d
High severity, Open F-143 PTP rollback lets a stale cancel release live risk Clock domains & epochs Assigned to Tam Lund 3w
Medium severity, Investigating F-154 Sequence wrap hides a market-data recovery gap Lock-free risk snapshots Assigned to Mara Ilić Today
Medium severity, Open F-145 Cancel/replace releases exposure before venue acknowledgement Order lifecycle linearizability Unassigned 2d
Low severity, Open F-155 Cross-core clock calibration extends an expired quote Clock domains & epochs Assigned to Jonas Reko Today
Medium severity, Fixed F-144 Failover replays orders across a kill-switch fence Kill-switch fencing Assigned to Jonas Reko 5w

Tune the engine
to your code.

A Tune tells V12 what the code does, the rules it must enforce, who is allowed to do what, past issues, and what each review should look for.

Explore a Tune

Tam Lund

Document Findings Runs

Clock domains & epochs

Overview
Rules
Access
Past issues
Tune intent

A slot's generation must advance on every reuse, independently of clocks. Monotonic time bounds quarantine; it does not establish order identity. The NIC PTP clock may step backward under the configured resynchronization policy. Quote deadlines must retain their clock and calibration domain. Accept a risk snapshot only from one stable, even publication sequence. Detect feed gaps across sequence wrap. Keep exposure reserved until a venue acknowledges the terminal order state. Every send, including failover replay, must respect the current kill-switch fence.

Repositories 1

northstar/execution

src/risk.rs
src/clock.rs

The engine meets you
where you already work.

Your agent connects to V12 over MCP, starts a review, follows the run to the end, and reads back each finding with its source, proof, and fix.

Explore the MCP server

Connect your agent

Claude Desktop OAuth
Cursor OAuth
Codex OAuth
VS Code OAuth
Windsurf OAuth
Your own agent Token

1 Paste the server URL into your agent
2 Sign in with OAuth or a token
3 Ask for a review in plain words

Server URL

Read the MCP docs

Your agent

v12 connected

Audit northstar/execution with V12 and walk me through the high-severity findings.

v12_audit_github
v12_watch
v12_findings

Run #8 · 1 finding · 1 high

High severity, F-143 PTP rollback lets a stale cancel release live risk

Every source
feeds the engine.

Run reviews manually, on pushes, or on pull requests. Bring alerts from Sentry, Datadog, Google Cloud, and Snyk into the same inbox, where V12 investigates the code.

Explore review runs

V12 review

Full review

northstar/execution main Clock domains & epochs Tam Lund

V12 triages and investigates

Findings F-143

PTP rollback lets a stale cancel release live risk

Open High Tam Lund northstar/execution Clock domains & epochs Run #8 b6a770a84e

Slack notifications when connected

One check run per pull request

Get your codebase
in tune.

Start the engine Open app

The security engine
tuned for your codebase.

PTP rollback lets a stale cancel release live risk

Properties

Origin

The proof is
in the findings.

Compromising Signal's Contact Discovery Enclave

The XSS inside your favorite iOS app

Ambire Wallet: Five vulnerabilities V12 found across provider and approval boundaries

Read the inbox
at any commit.

Tune the engine
to your code.

Clock domains & epochs

The engine meets you
where you already work.

Connect your agent

Your agent

Every source
feeds the engine.

PTP rollback lets a stale cancel release live risk

Seqlock retry admits a mixed-generation risk snapshot

RiskInvariant: live exposure exceeds reserved notional

FIX replay backlog exceeds the recovery window

Replay archive exposed by public bucket ACL

Marvin timing attack in rsa

Get your codebase
in tune.

The security engine tuned for your codebase.

PTP rollback lets a stale cancel release live risk

Properties

Origin

The proof isin the findings.

Compromising Signal's Contact Discovery Enclave

The XSS inside your favorite iOS app

Ambire Wallet: Five vulnerabilities V12 found across provider and approval boundaries

Read the inboxat any commit.

Tune the engineto your code.

📒 Clock domains & epochs

Rules

The engine meets youwhere you already work.

Connect your agent

Every sourcefeeds the engine.

PTP rollback lets a stale cancel release live risk

Get your codebasein tune.

The security engine
tuned for your codebase.

The proof is
in the findings.

Read the inbox
at any commit.

Tune the engine
to your code.

Clock domains & epochs

The engine meets you
where you already work.

Every source
feeds the engine.

Get your codebase
in tune.