Glossary
Plain definitions of the terms used in deebug reviews and writing. Definitions are general; where firms use a term differently we say so. For how the terms are used in practice, see the withdrawal-path checklist and the invariant catalogue.
Allowlist
A list of destination addresses a withdrawal may be sent to. A request to any other address is blocked or held for extra approval. Also called a whitelist.
Blind signing
Approving a transaction whose contents the signing device cannot show in readable form, so the signer relies on another screen to know what they are approving.
Check-then-act race
A defect where a program checks a condition (for example, enough balance) and acts on it (the debit) in separate steps. Two concurrent requests can both pass the check before either debit is applied.
Circuit-breaker
An automatic halt or hold on withdrawals or trading when a threshold is crossed or something looks abnormal.
Cold, warm and hot wallets
Hot wallets are online and serve day-to-day withdrawals. Cold wallets keep keys offline and hold most reserves. Warm wallets sit between the two. Firms draw the lines differently, so ask what a firm means by each.
Confused deputy
A component that has legitimate authority is tricked into using it for an attacker, for example a signing service that signs whatever a compromised caller asks.
Durable nonce
On some chains, such as Solana, a mechanism that lets a transaction be signed now and submitted later because it does not expire like an ordinary transaction. A pre-signed transaction using one stays valid until it is used or cancelled.
Finality
The point after which a transaction can no longer be undone by the chain reorganising. Different chains reach it differently, and exchanges set their own confirmation thresholds.
HSM (hardware security module)
A tamper-resistant device that stores keys and signs with them without exposing the key itself.
Idempotency key
An identifier sent with a request so that repeating the request, after a timeout or a retry, has the same effect as sending it once.
Invariant
A rule that must be true after every operation, whatever order the operations arrive in. See the invariant catalogue.
Key ceremony
A documented procedure for generating, backing up or rotating keys, usually with named participants and records kept as evidence.
Ledger
The exchange's internal record of who owns what: balances, locks and the postings that change them.
Lock and unlock symmetry
The rule that the amount locked for an order is released in the same amount and with the same rounding when the order ends.
Matching engine
The component that pairs buy and sell orders and decides what trades.
MPC (multi-party computation)
A way to split a key into shares held by separate parties or devices that sign together without any one of them holding the whole key.
Multisig
A wallet that needs signatures from several keys, for example any three of five, to authorise a transaction.
Not-reviewed list
The section of a deebug report that states what was not looked at, so the reader knows the limits of the review.
Pre-signed transaction
A transaction signed in advance and held for later broadcast. Whoever holds it can send it, so how it is stored and revoked matters.
Proof of concept (PoC)
A working demonstration, usually a test or script, that a finding is real. A deebug proof of concept fails before the fix and passes after it.
Reconciliation
Comparing the internal ledger with on-chain balances and custodians' records and explaining any difference.
Reorganisation (reorg)
When a blockchain replaces recent blocks with a different set, reversing transactions in the replaced blocks.
Signing environment
The systems and devices where keys are used to sign: the signing service, its hosts, the hardware and the people who operate them.
Velocity limit
A cap on how much or how many outflows are allowed in a period, enforced independently of the application that creates the withdrawal.
Withdrawal path
The route a withdrawal takes from a customer request or back-end command to a signed, broadcast transaction: who can start it, approve it, change it and sign it, and what stops a wrong one.