Terra Classic Security Audit Debate Shifts as SolidProof Agreement Reveals 50% Upfront Payment

A new debate is emerging in the Terra Classic community over the proposed SolidProof security audit, but the payment structure is different from what some initial discussions suggested.

The $70,800 SolidProof audit fee is not entirely paid upfront. According to the payment schedule in the SolidProof agreement, 50% of the fee, or $35,400, is payable when the agreement is signed and the audit commit is frozen. Another 20%, or $14,160, is payable after delivery of the Interim Findings Report, while the final 30%, or $21,240, is payable after delivery of the Final Audit Report.

The payment structure has become an important part of the discussion because the proposed Terra Classic security audit represents a significant community expenditure, while the agreement places half of the audit fee behind specific deliverables.

What Is the Terra Classic Security Audit Proposal?

The proposal seeks funding for a comprehensive security audit of the Terra Classic blockchain by SolidProof, followed by remediation work from OrbitLabs.

SolidProof is proposed to conduct the security assessment, identify vulnerabilities and perform a re audit after the reported issues are addressed.

OrbitLabs would then develop the required fixes and prepare the necessary chain upgrade proposal for implementation.

The proposal also requests a 20% buffer on the SolidProof fee because the community may fund the engagement using LUNC while the actual audit invoices are denominated in USDC.

SolidProof Payment Schedule Is Milestone Based

The payment schedule in the SolidProof agreement provides three payment milestones.

1. Agreement Signing and Commit Freeze

The first payment is 50% of the total audit fee, equal to $35,400.

This payment becomes due when the agreement is signed and the audit commit is frozen.

This means the auditor receives half of the audit fee at the beginning of the engagement.

2. Interim Findings Report

The second payment is 20%, equal to $14,160.

This payment is linked to the delivery of the Interim Findings Report.

The proposal describes this stage as an opportunity for significant findings to be communicated before the complete audit is finished.

3. Final Audit Report

The final payment is 30%, equal to $21,240.

This payment is linked to delivery of the Final Audit Report.

The agreement therefore does not require Terra Classic to transfer the full $70,800 before receiving any audit deliverables.

The complete structure is:

$35,400 at the beginning

$14,160 after the Interim Findings Report

$21,240 after the Final Audit Report

Total: $70,800

The Difference Between Upfront Payment and Full Upfront Payment

This distinction is important for the community debate.

Calling the entire $70,800 an upfront payment would not accurately describe the payment schedule contained in the agreement.

However, 50% of the audit fee is still committed at the beginning of the engagement.

That means the community assumes some financial exposure before receiving the interim and final audit reports.

At the same time, the remaining 50% is connected to later deliverables, giving the payment structure a milestone component.

This makes the discussion more nuanced than simply asking whether the community should pay an auditor upfront.

The more precise question is whether the proposed 50% initial payment and subsequent 20% and 30% milestone payments provide an appropriate structure for a community funded blockchain security audit.

SolidProof Will Be Paid in USDC

Another important detail appears in the agreement.

SolidProof invoices and receives payment in USDC, while the community proposal may fund the engagement using LUNC.

The agreement states that the audit fee is fixed at $70,800 USD and does not change according to the price of LUNC or another asset.

This creates a conversion and price exposure issue for the Terra Classic community.

If LUNC is used to fund the payment, the amount of LUNC required to obtain the necessary USDC can change depending on the market price and conversion conditions.

The agreement places this conversion and slippage risk on the client.

Why Is There a 20% Buffer?

The proposal requests an additional 20% buffer above the $70,800 audit fee.

That brings the requested SolidProof allocation to:

$70,800 + 20% = $84,960

The purpose of the buffer is to account for conversion and slippage when the community pool funds the engagement using LUNC.

Importantly, the agreement states that SolidProof will not automatically receive the unused buffer.

Any portion of the buffer that is not consumed during the conversion is intended to be returned to the community pool.

Therefore, the $84,960 figure should not be interpreted as SolidProof’s audit fee.

The agreed audit fee remains $70,800.

What Will SolidProof Actually Audit?

The proposed audit has a broad scope covering significant parts of the Terra Classic blockchain.

SolidProof would examine the source code of the Terra Classic protocol, with particular attention to its custom modules, Cosmos SDK modifications, transaction processing, fee handling, application and IBC wiring and CosmWasm integration.

The audit would also examine the framework migration introduced by the Cosmos SDK 0.53 upgrade.

This includes the chain’s upgrade handlers and the hand written migration of the CosmWasm key value store.

Economic Security Is Also Included

The audit is not limited to traditional code vulnerabilities.

The proposed scope includes an assessment of several economic mechanisms implemented by Terra Classic.

These include:

• Oracle vote aggregation and rewards
• Treasury seigniorage and policy
• Burn tax collection and exemptions
• Dynamic validator commission enforcement

The auditor would also perform adversarial simulations involving scenarios such as oracle manipulation, burn tax bypass, treasury drain and denial of service.

Terra Classic’s Custom Modules Will Receive Detailed Review

The audit scope covers the chain’s custom modules, including the oracle, treasury, market, tax, tax exemption, dynamic commission and vesting modules.

The review would examine areas such as:

• Oracle voting and reward distribution
• Treasury calculations and governance handling
• Market swap mechanisms
• Burn tax calculations and exemptions
• Validator commission enforcement
• Custom vesting account behaviour

These components are particularly important because they contain Terra Classic specific logic rather than simply relying on standard upstream blockchain code.

Cosmos SDK and CosmWasm Integration Are Also in Scope

The proposal also includes the review of Terra Classic’s modifications to the Cosmos SDK and its integration with CosmWasm.

The auditor would examine the custom Cosmos SDK overrides, module ordering, authority permissions and compatibility functionality.

For CosmWasm, the review includes custom queries and messages, reentrancy and state consistency, gas accounting and the migration surface created by the transition between older and newer versions of wasmd and wasmvm.

IBC integration is also included, covering packet handling, acknowledgements, timeouts and the changes associated with the ibc go migration.

State Migration Is a Major Focus

One of the more technical areas of the audit concerns the migration of the CosmWasm key value store.

The audit would examine the migration of contract keys, code keys, contract storage, contract history, secondary indexes, sequence keys and parameters.

The review would also assess the compatibility layer used for historical queries after the migration.

This is important because problems in state migration can potentially affect the consistency and determinism of blockchain state.

What Happens When Vulnerabilities Are Found?

The audit is designed to include remediation and verification rather than stopping at the initial report.

OrbitLabs would work with the auditors to develop fixes for identified issues.

The proposal allocates $20,000 for this work.

OrbitLabs estimates approximately 10 days for development of the fixes and another six days for preparation of the required upgrade proposal.

Unlike the SolidProof audit payment schedule, the OrbitLabs fee is proposed to be paid after its work is completed.

SolidProof would then conduct the re audit of the remediation and provide the final audit report.

The intended process is therefore:

Security audit

Findings

Development of fixes

Chain upgrade proposal

Re audit

Final audit report

What Are the Main Questions About the Payment Structure?

The newly clarified payment schedule changes the discussion from whether the entire audit fee should be paid upfront to whether the milestone structure is appropriate.

There are several reasonable questions the community can examine.

Is 50% Appropriate at the Start?

The first milestone requires $35,400, or half of the total audit fee, when the agreement is signed and the commit is frozen.

Community members may consider whether that initial percentage is appropriate for a specialized security audit.

Are the Milestones Clearly Defined?

The remaining payments are connected to the Interim Findings Report and Final Audit Report.

The community can examine the agreement to determine exactly what constitutes delivery of those reports and what contractual obligations apply at each stage.

Does the Final Payment Provide Enough Protection?

The final 30%, or $21,240, remains unpaid until delivery of the Final Audit Report.

This creates a financial link between the final deliverable and the remaining payment.

However, the community may still wish to examine whether the milestone structure provides sufficient protection if there are disagreements over scope, quality or timing.

How Does This Compare With Other Audit Proposals?

The Terra Classic community can also compare the SolidProof proposal with other audit options based on audit scope, provider experience, cost, payment structure, remediation arrangements and final deliverables.

This allows voters to examine both the technical and financial aspects rather than focusing only on the headline price.

The Proposed Timeline

SolidProof’s proposed timeline is approximately 6.5 weeks for the audit, with additional time expected for remediation and completion of the final report.

The proposal estimates approximately 10 weeks overall for the audit process and expected fixes.

The exact timing of each payment milestone therefore depends on when the relevant stages and reports are completed under the agreement.

How Significant Is the $90,800 Total Cost?

The proposal states that the Terra Classic community pool was approximately $747,000 when the proposal was prepared.

That consisted of approximately:

$431,000 in LUNC

$316,000 in USTC

The proposed $90,800 total cost therefore represents approximately 12.2% of the stated community pool balance.

The proposal also states that the $90,800 would represent approximately 21.1% of the LUNC portion of the community pool.

This makes the audit a significant treasury decision for the Terra Classic community.

The Real Debate Is About Security and Treasury Structure

The updated SolidProof payment information changes the framing of the debate.

The proposal is not asking Terra Classic to transfer the entire $70,800 audit fee before receiving any work.

Instead, the agreement establishes:

50% at agreement signing and commit freeze

20% after the Interim Findings Report

30% after the Final Audit Report

The community therefore needs to consider both sides of the proposal.

One side is the potential value of obtaining a comprehensive independent security review of the current Terra Classic codebase.

The other is how much of the community treasury should be committed at each stage and whether the proposed payment milestones provide sufficient protection for community funds.

The payment structure, audit scope, remediation process and final deliverables can all be examined independently before voters make their decision.

Would You Accept the 50% Upfront Payment?

The newly available payment schedule gives the Terra Classic community a more specific question to debate.

SolidProof’s agreement calls for $35,400 at the beginning, followed by $14,160 after the Interim Findings Report and $21,240 after the Final Audit Report.

The question is no longer simply whether Terra Classic should pay an auditor upfront.

It is whether 50% upfront followed by milestone payments is an appropriate structure for a $70,800 blockchain security audit funded by the community pool.

Would you be comfortable with 50% paid at the start, or would you prefer a smaller initial payment with more of the fee tied to completed audit milestones?

Would you accept the proposed payment structure?