Skip to content

Security: Rasslonely/Cortex_OS

Security

docs/SECURITY.md

Security Notice: Architectural Decoupling

Web2 vs Web3 Boundary

The Cortex.OS architecture deliberately decouples the AI compute layer from the blockchain settlement layer. This ensures that a compromise in one environment does not inherently compromise the other.

  1. The Web3 Settlement Layer (Base Sepolia):

    • Managed by an EVM Wallet (MetaMask / Private Key).
    • Used only for deploying CortexAgenticProof.sol and minting the final ERC-8004 artifact.
    • STATUS: User's previous private key was leaked. Action: Never rely on that key for mainnet funds. However, the previously deployed Base Sepolia contract remains immutable and valid for the Hackathon demonstration.
  2. The Web2 Compute Layer (OpenClaw / Z.AI):

    • Managed locally via the Vercel architecture interacting with the Zhipu AI API.
    • Used only to pay/authenticate requests to https://open.bigmodel.cn/api/paas/v4/chat/completions using the ZAI_API_KEY.
    • STATUS: Completely independent of the Web3 wallet.

Conclusion for Hackathon

You do not need to expose your Web3 Wallet private keys to the AI compute layer. The OpenClaw orchestrator runs locally and passes inference traffic directly to the Z.AI API. The Web3 Wallet is strictly used locally by the user to sign the final pinning and minting transactions on Base Sepolia.

There aren’t any published security advisories