Assurance
Audit register
Every source-level review run against this protocol, newest first. Each round keeps its own findings list and its own remediation history, including the findings that were accepted rather than fixed.
Review rounds
15
Findings published
196
Still open or accepted
92
Counted as open unless remediated or superseded.
These are internal reviews. They are published in full — including the findings that remain open — because a protocol that custodies capital against legal claims should be reviewable before it is trusted. An internal review is not a substitute for the independent external audit that the production-assurance gates require, and it does not by itself authorize a mainnet launch. Nothing on this page is a securities-law representation; token characterization is a matter for counsel.
- 2 August 2026Round 16
Internal adversarial audit of the whole protocol
The core value-custody mechanics held under direct attack: cascade ordering, conservation and subordination headroom across 163,840 stateful calls with the per-event backstop cap binding for the first time; queue solvency, FIFO and no-double-claim across another 163,840; the whole attestation signature layer; reentrancy closed by building and installing a hostile module rather than by argument; and flash-loan atomicity tested by genuinely borrowing at a pinned block. The failures cluster in exactly two places — economic controls derived from spot-read balances, and the role-admin topology, where one missing override produces three symptoms that had been filed as three findings. The round also corrected four of its own earlier conclusions. On 3 August 2026 Forest Road accepted the corrected residual risks for D7-01 at Medium and D4-01 at Low; both mechanisms remain proven and live, but neither is resolved or a release blocker. Production source measures 100% line and branch coverage, and every defect found lives in fully covered code.
8Medium16Low4InformationalRead the report → - 30 July 2026Round 15
Protocol fee stack, full-delta review
The fee stack composes correctly: the impairment ordering that guards the never-suppressible loss path holds by construction, the fee arithmetic cannot degenerate in any reachable state, and every cross-module lock is atomic. The cross-slice defect is elsewhere — the launch decision to recognize yield instantly silently voided the band clause of a vault-entry guard in code this work never touched, reducing it to the point test its own rationale rejects. Reproduced executably; the recommended fix was implemented and measured at 116 bytes against 88 bytes of remaining contract size, so it cannot currently be applied.
1High2Medium2LowRead the report → - 30 July 2026Round 14
Protocol fee stack, instant-recognition re-check
The first round in this sequence whose substantive findings are about the governance record rather than the arithmetic. Both behavioural changes are implemented correctly and there is no High finding. Instant recognition retracts one of the two original reasons for vesting honestly and correctly, but overrides the other — a red-team finding about pro-rata capture at the payment instant — without dispositioning it, and the pre-mainnet economic-review gate is carried against a parameter value it was not signed against. One accounting finding remains open on which valuation base the fee-share mint is denominated in; its arithmetic is confirmed and its reachability is argued rather than executed.
2Medium3LowRead the report → - 30 July 2026Round 13
Protocol fee stack, composition re-check
The first round in this sequence that does not continue it: no High finding, no safety-list invariant broken, and the surviving residual costs the protocol its own revenue rather than costing holders theirs. The exit fix delivers a real guarantee — the per-share high-water mark is now monotonically non-decreasing across every exit — which makes the earlier failure direction structurally impossible. The round's substantive result is an impossibility: basis-additive entry, pro-rata exit and round-trip neutrality cannot all hold with a single scalar hurdle, which is why three prior remediations each relocated the same defect. That trade-off is a financial-mechanic decision and is referred upward rather than patched.
4Medium3LowRead the report → - 30 July 2026Round 12
Protocol fee stack, dual-NAV re-check
All four prior code findings were closed, but the exit leg still adjusted a performance-NAV-denominated hurdle using assets priced on the higher redemption NAV. That let an exiting holder transfer deferred fee exposure to stayers. The working tree now uses the greater of asset carry and pro-rata carry, fixes the adjacent upgrade and backstop-ordering issues, adds divergent-NAV assurance, and discloses the global deferral risk; independent review of that delta remains pending.
1High4Medium1LowRead the report → - 29 July 2026Round 11
Protocol fee stack, remediation re-check
Three of the four Round 10 fixes were properly closed. The fourth reintroduced the same defect class on a different axis: the bracket added to make junior-capacity writes fee-neutral inferred its hurdle adjustment from an observed NAV movement rather than the capital that moved, making the high-water mark non-monotone and producing both an over-charge and a mirror under-charge. Round 12 independently confirmed that all four code findings from this report were closed, while identifying a separate dual-NAV exit defect.
2High3Medium3LowRead the report → - 29 July 2026Round 10
Protocol fee stack, ADR-0031
Twenty-nine candidates, fifteen survivors, consolidated to four code defects and six findings about the tests. The headline defect is that the fee-free hurdle ratchet was keyed on a per-share rate while the hurdle it protects is proportional to share supply, so it was not asset-preserving during a live impairment and the eventual cure was charged as profit. The more uncomfortable half of the round was the test suite: the entire exit half of the change had no value-asserting test, and the rate-integrity invariant had been weakened rather than the code fixed.
3High4Medium3LowRead the report → - 29 July 2026Round 9
Full-system audit, round nine
Eighty-four candidates, consolidated to thirty, of which two were dropped outright by the critic — one would have recommended undoing an earlier fix. No Critical or High finding, and nothing that reaches a loss of funds, an unauthorized mint, a backing break, a cascade inversion or a compliance bypass. About half of what survived is documentation drift. The round's clearest new defect was a residual on the previous round's own remediation, and the honest conclusion is that source review has now plateaued.
3Medium20Low4InformationalRead the report → - 28 July 2026Round 8
Remediation re-check
A dedicated re-audit of the previous round's fixes, on the principle that a remediation pass is itself a change that can introduce defects. It found exactly that: one of the twelve fixes had introduced a Medium liveness regression that could permanently freeze the only sUSDfr exit. That regression, and one further residual, were reproduced by executable proof before being fixed rather than argued from source. All five findings are now remediated, along with the three structural gaps the critic refused to sign off on.
1Medium3Low3InformationalRead the report → - 28 July 2026Round 7
Full-system multi-pass audit
A full re-audit of the whole system after the Round 6 remediations, six rounds in. Eighteen independent reviewers raised 71 candidates; these merged to 30, and every one then faced two refutation attempts. All 30 mechanisms held, but 22 had their consequence corrected downward — four filed Mediums ended as Informational. No Critical or High finding. Nothing breaks the backing invariant, inverts or skips the loss cascade, bypasses the mint gate or compliance, over-distributes the queue, or reaches an unauthorized mint. Post-audit, all two Medium and ten Low findings were remediated and verified; the remaining 18 Informational findings retain their original dispositions.
2Medium10Low18InformationalRead the report → - 28 July 2026Round 6
Release-branch differential review
A differential review of everything the release branch changed. Eleven candidate issues were raised and each was adversarially re-verified against source: one was refuted outright, one restated an earlier finding, and most had their consequences corrected downward. The live Medium, the attestation-boundary Low, and four frontend/documentation findings were remediated on 28 July; one grouped efficiency finding was partially remediated. No Critical or High finding, unauthorized-mint path, or permissionless theft path was confirmed.
1Medium3Low5InformationalRead the report → - 27–28 July 2026Round 5
Clean mainnet-v1 defensive audit
The controlling review for the current release. Eight findings — two High, six Medium. Four are now remediated with regression tests; four were explicitly accepted or deferred by the protocol owner for launch, including one High. Accepted is not fixed, and the prerequisite for each acceptance is recorded so it can be revisited.
2High6MediumRead the report → - 20–25 July 2026Rounds 3–4
Pre-mainnet campaign
The largest campaign run against the protocol, and the one that found the most serious defects — including a Critical path that burned whole queued positions for zero assets. Findings below are the consolidated register with each item's current status. The register is the authoritative published record: it carries every finding, its severity and its current disposition. The underlying working documents are superseded by it — they describe contract addresses and evidence from deployments that have since been archived and replaced — and are retained internally rather than published, because publishing several undated reports that disagree with the current register would mislead rather than inform. They are available to a reviewer on request.
14High11Medium3LowRead the report → - 14 July 2026Round 2
Five-pass source review, Round 2
Nine further findings in the modules the first round treated as trusted. Most were resolved by later architectural decisions rather than point patches — and one Informational item was later escalated to Critical when a design change destroyed the premise that had made it immaterial.
2High3Medium3Low1InformationalRead the report → - 14 July 2026Round 1
Five-pass source review, Round 1
The first structured review. Nine findings, none of them elementary coding mistakes — they sat at the module boundaries the tests treated as trusted, principally backing valuation and the facility lifecycle.
2High4Medium2Low1InformationalRead the report →