Threat model
What OpenTrigger protects against, what it relies on, and what it does not do.
What you rely on
- Arkiv stores rules, claims, receipts and heartbeats, and records each one's
$creator. - A worker to fire your rule. A public worker is run by someone else; you trust it to act on time
and honestly report what happened. You can verify that it acted (its receipt, and for webhooks its
signature) but not that it acted well (a worker could record
failedwithout trying). - Your own wallet for writing rules, and the faucet for gas.
What it protects against
| Threat | Protection |
|---|---|
| A forged receipt | The receipt's worker is Arkiv's $creator, set by the chain, not by the writer |
| A forged webhook | Every call is signed by the worker; verifyWebhook checks it against workers you trust |
| A replayed webhook | Each firing has one event ID inside the signed body; de-duplicate on it |
| Two workers firing one rule | Claims: earliest wins, leases, and an 18-block safety margin |
| A worker going down | Its claims lapse; any other worker picks the rules up |
| A rule making a worker run code | Rules can only name one of four actions |
| A webhook aimed at a private network | Public workers refuse URLs that resolve to private addresses |
| Personal data on Arkiv | Chat IDs only sealed; warnings for URLs that look secret |
What it does not do
- No incentives yet. Public workers fire rules for free. Nothing makes a worker stay online.
- No guarantee of timeliness beyond what workers provide. If no worker is online, rules wait.
- No hiding of metadata. Who created a rule, when it fires and its action are public.
- Not audited. Testnet only.