Critical-risk tools in Gala
26 of the 324 tools in Gala are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
gala_launchpad_action_flagDestructiveTake action on a flag. Actions available: - DELETE_CONTENT: Remove the flagged content - BAN_USER: Ban the reported user from the token - DELETE_AND_BAN: Both delete content an...
-
gala_launchpad_burn_tokensDestructivePermanently burn (destroy) one or more token types on GalaChain in a single transaction. **WARNING: THIS OPERATION IS IRREVERSIBLE!** Once tokens are burned, they are permanen...
-
gala_launchpad_clear_cacheDestructiveClear token caches. With tokenName: clears that launchpad token. Without tokenName: clears ALL caches (launchpad metadata + bridgeable tokens). Caches auto-warm from fetchPools/...
-
gala_launchpad_delete_chat_messageDestructiveDelete a chat message. Removes a message from the chat. Supports multiple authorization methods: - Message author (JWT auth) - Pool owner (JWT auth) - Moderator with MANAGE_CHA...
-
gala_launchpad_delete_commentDestructiveDelete a comment. Soft-deletes a comment from the pool's comment section. RETURNS: { success: true } Authentication: Requires JWT session or API key Authorization: Comment au...
-
gala_launchpad_delete_messageDestructiveDelete a message. Soft-deletes a message (CHAT or COMMENT) from the pool. **Authorization:** - Message author (JWT auth) - Pool owner (JWT auth) - Moderator with MANAGE_CHAT/M...
-
gala_launchpad_delete_recordingDestructiveDelete a stream recording. Permanently removes the recording. This action cannot be undone. RETURNS: { success: true } Authentication: Requires wallet signature (stream creat...
-
gala_launchpad_estimate_remove_liquidityDestructiveEstimate token amounts released by a current-contract GSwap liquidity withdrawal.
-
gala_launchpad_fetch_bridgeable_tokens_by_networkDestructiveFetch bridgeable tokens for a specific network with pagination. Queries DEX API to discover which tokens can be bridged. Results are cached permanently.
-
gala_launchpad_fetch_wrappable_tokensDestructiveFetch wrappable tokens with pagination. Wrappable tokens are token pairs that can be wrapped/unwrapped into each other (e.g., MUSIC ↔ GMUSIC). Results are cached permanently.
-
gala_launchpad_logoutDestructiveClear JWT token and end session. Future protected operations will fail until login() is called again.
-
gala_launchpad_remove_banDestructiveRemove a ban for a user on a token. Unbans the user, allowing them to send chat messages and reactions again. RETURNS: { removed: true, tokenName, userAddress } Authenticatio...
-
gala_launchpad_remove_content_reactionDestructiveRemove a reaction from a pool message. Requires JWT or API key authentication. Only the user who created the reaction can remove it. RETURNS: { success: true } Authentication...
-
gala_launchpad_remove_liquidityDestructiveRemove current-contract GSwap liquidity and return confirm() output.
-
gala_launchpad_remove_reaction_from_chat_messageDestructiveRemove a reaction from a chat message. Convenience wrapper for removeContentReaction specifically for chat messages. RETURNS: { success: true } Authentication: Requires JWT s...
-
gala_launchpad_remove_reaction_from_commentDestructiveRemove a reaction from a comment. Convenience wrapper for removeContentReaction specifically for comments. RETURNS: { success: true } Authentication: Requires JWT session (ca...
-
gala_launchpad_remove_simulcast_targetDestructiveRemove a simulcast target from a stream. Stops rebroadcasting to the specified platform. RETURNS: { success: true } Authentication: Requires wallet signature (stream creator ...
-
gala_launchpad_reset_stream_keyDestructiveReset the stream key for a token. Generates a new stream key, invalidating the previous one. Use this if the stream key has been compromised. RETURNS: { tokenName, streamKey, ...
-
gala_launchpad_revoke_api_keyDestructiveRevoke an API key. This performs a soft delete - the key becomes immediately unusable but is retained for audit purposes. RETURNS: { success: true, message: "API key revoked" ...
-
gala_launchpad_revoke_moderator_inviteDestructiveRevoke a moderator invite. Revokes an invite by ID, preventing it from being claimed. If already claimed, the moderator loses access to the token. RETURNS: { success: true, me...
-
gala_launchpad_revoke_overseerDestructiveRevoke an overseer's access. Revokes an overseer by wallet address, removing their global platform access. RETURNS: { success: true, message: "Overseer access revoked" } Auth...
-
gala_launchpad_revoke_overseer_inviteDestructiveRevoke an overseer invite. Revokes an invite by ID, preventing it from being claimed. If already claimed, the overseer loses access to the platform. RETURNS: { success: true, ...
-
gala_launchpad_unban_tokenDestructiveRemove a ban from a token (overseer only). When a token is unbanned: - Restored to all pool listings - Visible on creator's profile again - Comments re-enabled - Live streaming...
-
gala_launchpad_unsubscribe_from_global_feed_referenceDestructiveReference: Unsubscribe from the global feed. **IMPORTANT**: The global feed is a CLIENT-SIDE feature in the SDK. This tool provides documentation. Unsubscription happens in you...
-
gala_launchpad_transfer_galaFinancialTransfer GALA tokens via GalaChain.
-
gala_launchpad_transfer_tokenFinancialTransfer launchpad tokens via GalaChain.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.