CLPR-12: Security Hardening

## Epic CLPR-12: Security Hardening

**Parent:** hiero-ledger/roadmap#48
**Repo:** hiero-ledger/hiero-consensus-node + Ethereum contracts repo

### Objective

Prepare CLPR for mainnet through security audit, penetration testing, and hardening.

### Expected Functionality

1. **Threat model** — Proof forgery, replay, response ordering manipulation, Connector fund theft, queue exhaustion, endpoint impersonation, verifier compromise, reentrancy, MEV attacks.
2. **External audit** — Hiero handlers, Ethereum contracts, verifier contracts, endpoint modules.
3. **Audit remediation** — All critical/high fixed. Medium triaged.
4. **Formal verification** — Running hash chain integrity, response ordering, connection state machine, slashing arithmetic.
5. **Penetration testing** — Adversarial testing on testnet: malicious endpoints, fabricated proofs, race conditions, fund extraction.
6. **Hardening** — Rate limiting, circuit breakers, emergency pause, monitoring alerts.

### Dependencies

- CLPR-1 through CLPR-10 (feature complete and integration tested)

### Risk

**High** — May uncover design-level issues requiring protocol changes.

Start by reviewing CLPR-1 through CLPR-10 and the CLPR-12 roadmap entry at hiero-ledger/roadmap#48, then map the listed threats across hiero-consensus-node and the Ethereum contracts repo. Define the audit, formal-verification, penetration-testing, and hardening work, with all critical/high findings fixed and medium findings triaged.

Written by the indexing model from the issue text.