19 attacks · adversarial

First-principles attacks

Original 7 from Iteration 4 plus 12 from Phase 9. Each attack examined for what it would prove, the architecture's defense, and the residual exposure.

Original attacks (Iteration 4)

• Attack 1

  Do we even need smart contracts?

  Solo landowners don't operate hardware wallets. Land trusts have institutional governance already. Corporate landowners want board-style governance. For Templates A, B, D, E, G, smart contracts are over-engineering — a Vermont LLC with a sound operating agreement and a multi-sig treasury wallet does the job at roughly 10% of the cost.

• Attack 2

  The 99-year smart contract is fantasy

  Ethereum is 10 years old, USDC is 8, Cloudflare is 16. Trusting any specific blockchain or stablecoin for 99 years is naive. If the chain dies in year 30, the smart contract is inaccessible, the DAO cannot operate, the wrapper entity cannot make distributions, and the property's governance freezes.

• Attack 3

  Template C as currently specified risks paternalism

  If Landseed engineers design Template C's smart contract with FPIC checkpoints and cultural-guardian multi-sig, they are encoding their own interpretation of what indigenous governance should look like — not the community's protocols. The NURJ paper is explicit that indigenous epistemologies must define the logic, not be encoded by outsiders. Forcing every indigenous deployment into a single Template C reproduces the colonial governance pattern the paper critiques.

• Attack 4

  Economic uncertainty isn't honest with landowners

  Landseed claims 60–85% landowner share is competitive with carbon markets, but Earth Credits don't yet have established price points. A landowner asking 'how much will I make per year' cannot get a clear answer. The first 10 properties are price discovery, not predictable revenue, and pretending otherwise to win deals is bad faith.

• Attack 5

  Long-term archival assumes infrastructure that doesn't exist

  'Hash-pinned methodology with three-archive redundancy' sounds rigorous, but IPFS may not exist in 50 years and Software Heritage has uncertain longevity. No archival system has been demonstrated to survive 99 years. If all digital archives fail, the methodology version pinned at deed execution becomes unverifiable.

• Attack 6

  Methodology reference value updates

  EC-M-1.1 includes 286 reference values defining 'healthy' for each ecosystem. Some of these will change over the 99-year term as scientific understanding evolves. If reference values are baked into the property at execution, the property is stuck on outdated science; if they automatically update, landowners face involuntary methodology changes that may reduce their credit yield.

• Attack 7

  The kitchen-table pitch assumes acceptance

  The 5-sentence plain-English summary in the NRD-lite assumes the landowner accepts the basic premise of verified ecological condition as a commodity. Some landowners will reject the 99-year commitment as a hard no, regardless of how clearly it is explained.

Phase-9 attacks

• Attack A-1 · spec-refinement

  Argentine cepo cambiario creates unintended derivative structure

  The offshore-wrapper-plus-local-paymaster pattern, when combined with USDC-denominated Earth Credits sold into Argentine markets, may look to BCRA and CNV like an unregistered FX derivative. The Argentine beneficiary receives pesos at a controlled exchange rate while the credit is denominated offshore in USDC, creating a structured synthetic USD exposure that regulators can characterize by economic function, not label.

• Attack A-2 · architectural-tension

  Rights-of-Nature plaintiff attacks the buffer pool as commodification

  An Ecuadorian rights-of-nature plaintiff brings an Article 71 constitutional claim arguing that the buffer pool — which holds Earth Credits and can retire or replace them — constitutes commodification of nature's right to exist and regenerate. The plaintiff argues that holding ecological-condition credits in a reserve and retiring them is economic exploitation of nature.

• Attack A-3 · spec-refinement

  Bangladesh BFIU enforcement against the local NGO partner

  Bangladesh Financial Intelligence Unit investigates the NGOAB-registered local partner for receiving 'proceeds of crypto transactions' — the USD wire transfer from the Singapore VCC wrapper. BFIU characterizes the wire as money laundering under the Money Laundering Prevention Act 2012 because the source of funds is a stablecoin treasury whose existence is visible in public blockchain records.

• Attack A-4 · architectural-tension

  Foundation governance capture by methodology steward majority

  Three methodology stewards hold seats on a 7-member Foundation board. By coordinating with the Landseed PBC Representative, they can form a 4/7 majority and control audit committee nominations, budget, and insurance backstop decisions. The audit committee's 'independence' is nominal if its members were selected by the same steward majority that could also control buffer contribution rates and invoke methodology error invalidation against disputing landowners.

• Attack A-5 · spec-refinement

  Methodology archive integrity attack via M4 chain-of-versions manipulation

  An adversary with write access to one of the three archives substitutes a modified methodology document that changes reference values in a way that reduces ECI scores for a specific property, making existing credits appear over-issued and triggering methodology error invalidation. Members voting on the ratification proposal may vote on content whose hash matches the compromised version.

• Attack A-6 · spec-refinement

  Vermont Town Clerk rejects the NRD-lite as unrecognized property category

  A Vermont Town Clerk refuses the NRD-lite for recording because the instrument's novel features — hash incorporation by reference, methodology-update-by-hash mechanism, and Earth Credits reversion carve-out — are not recognized forms for a conservation easement under 10 V.S.A. §§ 821–824 in that clerk's office practice. The instrument is returned unfiled.

• Attack A-7 · architectural-tension

  IRS denies Form 1023; buffer pool stranded under Landseed PBC

  IRS denies the Methodology Foundation's Form 1023 — or issues a lengthy information request that delays determination past Month 18 — leaving buffer pool in Landseed PBC's interim fiduciary structure while first credit issuances have already occurred. The formation plan treats IRS denial as a restructure scenario without addressing what happens to already-issued credits if Landseed PBC fails during the extended determination period.

• Attack A-8 · architectural-tension

  Successor-trustee captures the buffer pool during Landseed PBC failure

  Landseed PBC fails in Year 1 before Foundation formation. The named successor trustee — who takes over the registry account holding buffer credits — disputes Foundation formation or the Foundation's claim to the pool, and refuses to transfer it to an emergency-formed Foundation. No clear dispute-resolution path is specified in the architecture.

• Attack A-9 · spec-refinement

  Tier 1 multi-sig signer compromise during Year 0–18 gap

  In a Tier 1 deployment, the wrapper LLC's multi-sig treasury (2-of-3 signer threshold) is compromised — one or more signers' keys obtained by an adversary — during the Year 0–18 gap when neither the Foundation nor its oversight mechanisms are operational. Compromise of 2 signers in a 2-of-3 configuration is sufficient for a complete treasury drain.

• Attack A-10 · architectural-tension

  Indigenous community publicly rejects deployment despite NURJ alignment

  After a Template C co-design process that followed all NURJ paper recommendations and received indigenous-rights advocate review, a member faction of the specific community publicly rejects the deployed DAO as colonial governance in a media-visible statement. Co-design does not guarantee unanimous community acceptance; factional disputes within indigenous communities are common.

• Attack A-11 · spec-refinement

  Cross-jurisdiction regulatory arbitrage (US/Ecuador differential characterization)

  A US-based Earth Credit buyer purchases credits issued against an Ecuadorian property. The SEC opens an inquiry arguing that the Ecuadorian structure — Ecuadorian fundación + Marshall Islands DAO LLC + economic flows from credit sales — constitutes an investment contract from the US buyer's perspective: investing money in a common enterprise with expectation of profit from the efforts of Ecuadorian community stewards.

• Attack A-12 · spec-refinement

  M5 attestation race condition during catastrophic buffer pool draw

  During a catastrophic event, the registry initiates both a buffer pool draw (invalidating affected credits in buyer accounts) and a notifyInvalidation call to M5. M3's _attestationDistributed mapping shows the original attestation as distributed (preventing double-distribution) while the Foundation's buffer pool replacement creates new credits whose receiptHash differs from the original, potentially allowing double-distribution of the same underlying economic value.