Historical round. This page records the source as it stood on 14 July 2026 and what happened to each finding afterwards. It is not a description of the current contract surface: ADR-0030 later removed the debt-service reserve, the reserve-instrument valuation path, the generic stablecoin registry and the legacy role and storage paths that several of these findings concern. Where this page and the clean mainnet-v1 round disagree, the later round governs.
Executive summary
The codebase reviewed here was materially stronger than a typical pre-mainnet protocol: roles were narrowly wired, value-moving functions were generally guarded and non-reentrant, the accounting was explicit, and the test suite already included meaningful stateful invariants. No permissionless theft path and no direct unauthorized-mint path was identified.
The round produced two High, four Medium, and three Low or Informational findings. None of them were elementary Solidity mistakes. They sat at module boundaries that the tests treated as trusted — principally the valuation inputs to backing, and the facility lifecycle's missing exits.
The findings in detail
A revoked valuation stayed cached and kept counting as backing
Revoking a valuation cleared the oracle record's payload and timestamp, but the reserve manager held its own cached copy of the reserve-instrument value and continued adding it to backing. Revocation neither notified nor invalidated that cache, and re-synchronizing after a revocation could not clear it, because the synchronization path rejected an oracle record with a zero timestamp. A valuation explicitly declared invalid could therefore continue supporting minting until governance replaced it with a newer non-zero mark.
This was fixed together with the stale-mark finding below: backing was changed to read the mark live and validity-aware, so a governance revocation drops it from backing in the same block, and a mark older than a governance-set maximum age is excluded rather than trusted.
Marked-to-market facilities were counted at par
All deployed facilities contributed their outstanding principal to backing, so the marked-to-market digital-assets class was counted at par until a servicer realized a loss. Its attested valuation drove origination and margin triggers but never the backing figure, which meant reported backing could overstate economic backing in the window between a collateral mark falling and the servicer recognizing it.
This was resolved as a design decision rather than a patch. The marked-to-market class is protected by a fast, permissionless margin-call, liquidation and loss-cascade remedy — that remedy, not a continuously-marked backing figure, is the depositor protection. A characterization test now pins the behaviour, so any future move to continuous haircut backing is a deliberate economic choice rather than a drift.
Funding could occur after maturity or on a stale valuation
Maturity and valuation freshness were checked only at origination. The funding path checked that the facility was still pending and that the amount matched principal — not that maturity was still in the future, not that mandatory attestations still held, and not that a marked-to-market valuation was still fresh. A facility could sit pending past maturity, or until its mark went stale, and still receive funding.
Funding now re-validates maturity, class activity, required attestations and mark freshness immediately before funds leave the treasury. This fix should be read alongside FRV-BR-01 in the most recent round: when the permissionless past-due trigger was later re-anchored from maturity to the next payment date, the funding gate was not extended to match, leaving a residual of the same shape.
Pending facilities could not be cancelled
Origination immediately recorded the full facility principal as book exposure, and the state machine offered no cancellation or expiry path. An abandoned or erroneous pending facility therefore consumed class, borrower, state and total-book concentration headroom permanently. A controlled cancellation now retires the position and atomically reverses its recorded exposure.
Fully recovered defaulted facilities could not close
Principal recoveries were permitted while a facility was defaulted or accelerated, but the transition to repaid was only available to a facility that had been performing. Because the reserve refund required the repaid state, a fully recovered workout could not use the intended close-out path, leaving the lifecycle unresolved and the facility position frozen. A resolved close-out state was added. A later round noted this closed the recovery half of the problem but not the write-off half, which was addressed separately.
The reserve valuation never expired
The reserve-instrument timestamp was stored and exposed but never used when calculating backing. Once synchronized, a valuation remained valid indefinitely — submission expiry controlled only when an attestation could enter the oracle, not how long an accepted mark could support supply. A governance-bounded maximum mark age is now enforced, with fail-safe exclusion once a mark expires.
Lower-severity findings
Governance transfers still require owner approval. The transfer hook requires the caller to hold the admin role and then still delegates to the standard authorization check, so governance cannot move a custody position unless it is also the owner or has been approved by the owner. This is stricter than the documentation's description and could block an emergency custody migration if the holder were unavailable or hostile. Independently re-confirmed as still present on 21 July. The open question is whether governance should have migration authority at all — if not, the documentation is what needs correcting.
Reward-stream dust can become inaccessible. Integer division leaves sub-rate dust, and rewards that stream while nothing is staked are not allocated, with no recovery or rollover path after a stream ends. The no-staker leg was later closed — notifying rewards with a zero staked supply now reverts rather than silently stranding the stream. The rounding-dust leg remains tracked.
Approved-asset and operational-role assumptions are load-bearing. The contracts assume approved stablecoins have stable balances, reliable decimals, no transfer fees, no adversarial rebasing and trustworthy balance reporting; and the servicer chooses funding recipients and controls reserve service, acceleration and realized-loss amounts within bounds. These are deliberate permissioned-protocol assumptions, recorded here so they are treated as security controls rather than routine administration.
Method — five passes
- Architecture and trust boundaries — mapped the production contracts, upgradeable proxies, role topology and cross-module calls; confirmed the primary trust boundaries and reviewed deployment wiring and protocol exemptions.
- Access control and upgradeability — reviewed every external and public mutator and its role, pause and reentrancy controls; confirmed production deployment removes placeholder mint authority and wires credit roles to protocol modules. No permissionless upgrade, mint, reserve release or cascade bypass was identified.
- Accounting and invariants — recomputed mint and redeem normalization, backing composition, fee capitalization, the payment waterfall, reserve accounting, curator shares, backstop coverage and depositor loss ordering. This pass produced the par-versus-marked mismatch and the cached-revocation gap.
- Lifecycle and edge cases — walked origination, funding, amortization, default, acceleration, recovery, loss, reserve, queue and staking lifecycles. This pass produced the stale-funding, missing-cancellation and missing-close-out findings.
- Adversarial integration and economics — reviewed oracle replay and revocation, external token behaviour, queue griefing, stale marks, compliance exemptions, reward streaming and governance assumptions, with static analysis manually triaged by detector class.
Verification performed
The offline contract suite passed 459 tests across 29 suites with no failures, with five tests skipped because they required live fork access. Static analysis covered 98 compiled contracts after excluding dependency, test and script paths, with findings manually triaged.
The existing stateful invariant suites were reviewed for model boundaries. They covered the implemented accounting strongly but did not model mark validity or the missing lifecycle transitions — which is precisely why those findings surfaced in manual review rather than in the suite.
Limitations
A source-level review only: not a formal-verification engagement, and not an audit of deployed bytecode, multisig configuration, custody, legal enforceability, attester operations, frontend signing flows or live infrastructure. Third-party library internals were not re-audited beyond their integration boundaries. An independent external audit remains a required production gate.