Audits

Current status

No audit has been completed. No audit is in progress. No firm has been engaged.

The contracts are not written. The specification is not frozen. Fifteen on-chain hypotheses that could each change the specification remain unresolved, and several of them can cancel the design rather than adjust it.

This page describes the plan. When there is a report, it will be linked here, in full, including findings that were acknowledged rather than fixed.

The sequence

Eight steps, in order. Each one must finish before the next begins (Rule R-16.6).

1. Internal review and static analysis

A full internal review, then Slither and Aderyn with zero unjustified High or Medium findings. This is a gate before any external work, not a parallel activity. Paying an auditor to find what a static analyser finds for free is a waste of the audit budget.

2. Freeze the specification and resolve every hypothesis

The specification and the invariant suite are frozen. All fifteen on-chain hypotheses are resolved — the token's freeze and upgrade behaviour, where oraclePaused lives, whether the balance is raw or scaled, whether a sequencer uptime feed exists, real feed behaviour over 28 days, measured depth over 30 days, the legal memorandum, the pause grace observed on a real corporate action, historical round availability, gas cost after the subsidy, the reference lending market, the readability of v3 and v4 pools, the proxy scheme, and the calendar against the published NYSE list.

Freezing the specification freezes the constants. There is no later calibration pass.

Auditors receive the frozen specification, the invariant suite, the fuzz reports and the zero-setter deployment report.

3. First private audit

One firm with genuine CDP experience: Dedaub, Spearbit, Trail of Bits or ChainSecurity. Particular attention is requested on four areas the design record flags as the hardest (Rule R-16.6):

• The Uniswap v3 and v4 depth readers in LiquidityOracle — tick iteration, StateView semantics, gas bounds, and behaviour when a pool is migrated or drained.
• MarketCalendar — the daylight-saving rule, the Gregorian Easter algorithm, the observation rules for each holiday, and the degradation after 2036.
• CollateralSale — the discount ramp, the bucket, and the interaction with wrapper NAV.
• Closer — the cumulative bounds, the expiry, and above all the guarantee that no freeze can block any operation on the liveness list.

4. Fixes and re-fuzz

Corrections, then the full invariant suite re-run at nightly volumes. A fix that breaks an invariant is not a fix.

5. Public contest

Code4rena, Sherlock or Cantina. This format is included deliberately: it is what surfaced thirty-one bugs in Lybra, the protocol Fyber exists to not repeat.

6. Second private audit

Targeted at the diffs produced by the contest, plus a formal review of the solvency invariants of Branch — Certora if the budget allows.

7. Bug bounty before mainnet

An Immunefi programme live before any mainnet deployment. Scope and tiers: Bug bounty.

8. Launch small

SPY and QQQ only, at 100 000 USD of debt capacity each for fourteen days, then 1.0 M. The dated capacity tiers enforce this in code rather than by intention: nothing anybody does can raise the ceiling faster than the calendar allows, and any bad debt locks it permanently at whatever tier it had reached (Rule R-5.4.4).

What will be published

Everything, in the repository, permanently, with a copy archived on IPFS:

• Every audit report in full, including findings that were acknowledged rather than fixed, and the reasoning for each acknowledgement.
• The contest results and the leaderboard.
• The frozen specification and the invariant suite.
• The fuzz reports.
• The zero-setter deployment report, contract by contract.
• The mutation testing score.
• The LICENSE.

The design record is explicit about why: the disappearance of Lybra's GitHub repository cost it whatever residual trust it had. Publication is not a courtesy.

What an audit cannot cover

Stated so that a completed audit is not read as more than it is.

A specification error. An auditor checks that the code does what the specification says. If the specification is wrong — a threshold too tight, a band too narrow, a capacity tier too generous — the code will be correct and the protocol will still be wrong. That failure mode is permanent here, and it is why the parameters are conservative and the caps start small.

An unfavourable answer to a hypothesis. If the Stock Token can be frozen by its issuer, no audit changes that. The mitigation is verification before deployment, and abandonment if the answer is bad enough.

An atomic exploit. A single-transaction exploit is not addressable by any key, before or after an audit. Only design helps: the same-block guard, the absence of flash minting, the refusal to wrap collateral, and never reading a rate from a manipulable contract.

Anything after deployment. There is no upgrade path. A finding after mainnet is handled by shutting a branch down and building a new version, at a cost of a differential audit plus migration — four to eight weeks — and nobody can shorten that.

Monitoring instead of patching

Because patching is not available, monitoring carries more weight than usual. An open-source watcher ships in the repository, runnable by anyone, on which the protocol depends in no way at all. It alerts on the supply identity breaking, a degraded state lasting more than four hours on a weekday, a mint freeze, open sales touching more than 2% of a branch in one shut period, decaying depth, a PSM reserve below 5% of supply, any Closer freeze, a dormant branch becoming activatable, and a capacity tier locking (Rule R-16.6.1).

During the Closer's twelve months, the company runs it on a 24/7 on-call rotation. That is a commitment outside the protocol, and the design record is blunt about the consequence: without that monitoring, the Closer is worth nothing, and this is said publicly rather than implied.

Run your own copy. Do not assume anybody else is watching.

Last reviewed: 2026-09-07 · Spec v0.4