Known limits

This page lists what Certichain does not do yet, what is built but switched off, and what waits on a decision or a review. It is a snapshot as of 2026-10-24, taken from the code and the handbook's progress tracker. Each item says where to look for more.

Readiness

Limit	Detail
Test network only	Deployed on Sepolia with synthetic data. No production deployment exists.
No external audit	The external smart contract audit and the external zero-knowledge audit are planned roadmap steps and not started.
No independent cryptography review yet	The encryption and key-derivation design was meant to be reviewed independently; the reviewer and date are still to be named.
Manual checks pending	Several browser checks with MetaMask (admin registration, upload, verify page states, the v0.3 screens, /access) and a two-phone test of the phone wallet are recorded as waiting for the owner.
Live storage smoke for sharing	Sharing by grant and link, key replacement and removal of old copies have passed automated tests; a live run against Pinata with the right token scopes is still open.

Contracts and governance

Limit	Detail
Admin handover to the timelock	Set 0.5.0 is administered by the timelock. For the active set 0.3.0 the timelock was nominated on 2026-10-17 and could accept from 2026-10-20 08:42 UTC; completion is not recorded in the handbook. See Access control and governance.
Set 0.5.0 not active	Key retirement with a successor and guardian unpause exist only in contract version 0.5.0, which is deployed on Sepolia but not the active set. Activating it is a separate decision; some test issuers still need registering in it.
Guardian cannot unpause in 0.3.0	Only the admin (a multisig) can lift a pause in the active set.
Expiry not offered in the form	Contracts support validUntil; the issue form always sets 0 (no expiry).
Issue time set by the issuer	issuedAt is set by the issuer's browser, so the contract accepts a time earlier than the block (accepted by design).
Zero commitments not refused on chain	The registry does not reject a zero subjectCommitment or metadataHash; the app never produces them.
Access groups are small	At most 64 commitments per credential ever (removal does not free a slot); proofs for group depth above 6 are not served.

Wallets and keys

Limit	Detail
Contract-wallet issuers in the app	A Safe or other ERC-1271 wallet can be an issuer on chain, but the site cannot derive student salts or document keys for it and refuses with a clear message. Such an issuer cannot invite students or protect documents through the site.
Deterministic signing required	Features that derive keys need a wallet that signs the same typed data the same way twice (RFC 6979). Other wallets are refused.
Issuer key changes	A new issuer wallet means new student salts, a new encryption key and a new badge key. Retirement in 0.5.0 keeps credentials valid, but encrypted documents and custom record types stay with the old key. See Key management.
Phishing for key signatures	A site that gets a user to sign the EncryptionKey typed data can derive that user's encryption key.

Documents and storage

Limit	Detail
Access cannot be withdrawn retroactively	A recipient or link holder who already read the document, or kept the key and a copy, keeps access. Key replacement protects only new copies.
Capability links are bearer keys	Anyone with the link can read the document.
Metadata visible on stored containers	The header shows the issuer and document hash; the size is visible to the nearest 64 KiB.
Erasure is best effort	Unpinning removes Pinata's copy; other IPFS nodes or gateway caches may keep ciphertext for a while.
No second pinning service yet	The machinery exists, but no adapter is registered; naming any service in SECOND_PIN_PROVIDER fails.
File types and size	PDF, PNG and JPEG only, up to 3.5 MB per file (4 MB per encrypted upload).
Not post-quantum	X25519 and ECDSA are not resistant to quantum computers; the container format is versioned so the suite can change.

Verification and standards

Limit	Detail
Reads trust the RPC endpoints	Several endpoints are used for failover, not compared. Status reads can lag a just-mined change briefly.
Offline checks cannot see status	An offline package check or a phone QR code checked offline proves the signature, not the current status; status needs a chain read.
Built but off until configured	The verification API (needs API_SIGNER_KEY), status lists (need STATUS_LIST_SIGNER_KEY and two public settings) and the monitor (needs CRON_SECRET, OPS_WEBHOOK_URL and a schedule) are switched off until the owner sets them. The canary probe and monitor history also need Redis and OPS_PROBE_*.
Custom cryptosuite	Generic VC libraries need a plugin to check the certichain-eip712-2026 proof. The plain status list entries in an exported VC are not themselves signed (the lists are).
Standard badge proof scope	The eddsa-rdfc-2022 proof alone does not show that the key belongs to a registered institution or that the credential is still valid.
Open Badges validator	Checked against the vendored 1EdTech schema; a run through an official validator is still open.
Future validFrom	The VC check does not reject a validFrom in the future.
Trusted setup evidence	The key checks show the Semaphore keys are consistent with the circuit source and the public Powers of Tau, not that the ceremony was honest; the ceremony outcome page and the Semaphore v4 audit report are still to be located.

Web application and server

Limit	Detail
Content security policy	The policy has no script-src directive yet; a strict script policy needs nonces.
No hosted indexer	Lists are rebuilt from logs in the browser; v0.2 lists need NEXT_PUBLIC_START_BLOCK. Long histories can make first loads slow.
Bulk import pace	One wallet prompt per row; a try that was never sent waits for a manual choice. A 50-row run with a funded wallet on Sepolia is still open.
Legacy v0.2 path	When the app is configured for v0.2 it reads and writes plaintext personal data on chain and accepts plaintext uploads. Use synthetic data only.

Privacy and compliance

Limit	Detail
DPIA not reviewed	The data protection impact assessment is a draft awaiting legal review. See Privacy design.
Access receipts show the sender	The access gate hides which admitted identity proved, not the address that sent the proof.
Issuer can link enrolled students	The issuer can re-derive a student's stable salt and so link that student's commitments.

Source files

• docs/progress/PROGRESS.md (handbook tracker, status as of 2026-10-24)
• src/lib/security-headers.ts, src/lib/doc-crypto/constants.ts, src/lib/upload-limits.ts
• src/lib/server/pinning/providers.ts
• src/services/domain/enrolment-service.ts, src/services/documents/document-errors.ts
• blockchain/contracts/v03/IssuerRegistry.sol, blockchain/contracts/zk/CertichainAccessGate.sol
• src/contracts/v03/deployment.11155111.json