Round 7 · 28 July 2026

Full-system multi-pass audit

Internal review. This is an internal engineering review of source, not an independent external audit, and it does not by itself authorize a production launch. It reviews the source at the baseline below, which is not necessarily identical to the code deployed on any network. No mainnet deployment has been authorized or attempted. Nothing here is a securities-law representation; token characterization is a matter for counsel.

Scope: Every production contract and all frontend functionality — 9,148 lines of Solidity across twenty implementation contracts, 7,303 lines of frontend, plus deployment, validation and configuration tooling.
Method: Nine surfaces, each reviewed twice by independent agents with different briefs and no sight of each other's work, then two adversarial refuters per candidate — one on mechanism accuracy, one on consequence and reachability — then a completeness critic.
Reviewed baseline: 33713ec (clean working tree). Read-only: nothing was executed.
Internal report: audit-reports/FULL_SYSTEM_AUDIT_2026-07-28.md

Findings and remediation history

FRV-FS-01MediumRemediated
Servicing dead end: once a facility's next payment date equals its maturity, any performing receipt that leaves residual principal reverts
Remediated after the audit. WaterfallEngine now treats only the exact terminal schedule state — current due equals maturity and the attested next due also equals maturity — as a no-op. Every non-terminal receipt still passes through ClaimBridge's strict monotonic due-date guard. Regressions prove interest-only and partial-principal receipts remain serviceable at maturity, prove an unchanged pre-maturity due date still reverts atomically, and walk one facility through thirteen consecutive receipts to and through the maturity clamp. The complete post-remediation contract run passed 865 tests with zero failures; 182 environment-gated fork tests were skipped by the unconfigured run.
FRV-FS-02MediumRemediated
The redeem card does not disclose the 21-day minimum hold before an irrevocable, non-cancellable queue entry
Remediated after the audit. The frontend ABI now exposes redeemCooldown, eligibleToSettleAt and RedeemCooldownSet. The card reads the live configured cooldown, labels the one-day epoch timer only as a settlement heartbeat, states that FIFO and liquidity can extend the wait, and will not submit a queue request until the live cooldown has loaded and the user explicitly acknowledges that the entry cannot be cancelled or withdrawn. Every queued position renders first eligibility from requestedAt plus the live cooldown. The stale hardcoded error copy was corrected. Frontend logic, 332 contract↔UI synchronization checks, lint, TypeScript and the production build all passed.
FRV-FS-03LowRemediated
Vault entry closes when one yield distribution exceeds three times the staked base — a ratio the protocol does not couple to anything
Remediated after the audit. The vault now caps the amount that may remain in the vesting stream against the live staked base and recognizes any excess immediately as an upward-only NAV step, with a dedicated YieldInstantlyRecognized event. A healthy oversized receipt therefore cannot close entry, ordinary receipts remain smoothly vested, and the post-loss anti-skim guard remains effective. A deterministic low-staking/high-interest regression and the credit invariants passed.
FRV-FS-04LowRemediated
An unprivileged dust contribution to backstop coverage can void a live recovery assessment
Remediated after the audit. Assessment validity now separates risk state from global backstop capacity and snapshots both. A permissionless capacity increase leaves the assessment active, while a decrease below the snapshot, a curator-pool change, or any book/default revision still invalidates it conservatively. Storage additions are append-only. Unit, integration and a real SGrove dust-contribution regression passed.
FRV-FS-05LowRemediated
The queue's anti-starvation heartbeat tests for exactly zero distribution, so a dust-sized fill still consumes the epoch
Remediated after the audit. A pending queue now rolls back rather than advancing when aggregate settlement value is below the governed minimum economic value. A drained final tail may still complete, and the independent zero-distribution guard remains active when the entry floor is set to zero. Deterministic dust and zero-floor regressions plus 256×128-call queue invariants passed.
FRV-FS-06LowRemediated
A wallet-side Cancel or Speed Up is reported as a confirmed transaction, linking to a hash that was never mined
Remediated after the audit. The shared write flow handles receipt replacement explicitly: cancellation or replacement by a different call is an error, while same-call repricing succeeds with the replacement transaction hash that actually mined. Contract-to-UI synchronization tests pin both branches.
FRV-FS-07LowRemediated
The gross-collateral tile values receivables at origination principal against a live outstanding balance
Remediated after the audit. A receivable facility's reference collateral is now derived from live outstanding principal divided by its LTV. The numerator and denominator therefore amortize together, and a principal write-down cannot make displayed coverage rise. Logic tests pin the invariant.
FRV-FS-08LowRemediated
The position panel prices a holding at the deposit rate rather than the exit rate while an impairment is declared
Remediated after the audit. The position and gain tiles now read previewRedeem and explicitly label the value as current exit NAV, matching the impairment-netted value the queue would pay rather than the deposit conversion rate.
FRV-FS-09LowRemediated
The production build verification gate lives in a lifecycle hook that routine build invocations skip
Remediated after the audit. The receipt-bound verifier runs from Next's own production-build phase as well as npm prebuild, so direct next build cannot bypass it. GitHub Actions now runs the contract suite and frontend tests, lint, TypeScript and production build. No production receipt was fabricated before deployment: a mainnet build remains blocked until the real ceremony supplies the approved manifest and receipt.
FRV-FS-10LowRemediated
The build-profile selector falls through to the testnet profile when its chain variable is unset, and the verification is conditioned on that same variable
Remediated after the audit. NEXT_PUBLIC_CHAIN_ID is mandatory in both frontend configuration and the build verifier. An unset profile fails immediately; an explicit negative probe and production build both passed.
FRV-FS-11LowRemediated
An in-flight write is not cancelled when the account changes, so its result lands on the newly-selected account
Remediated after the audit. The shared write flow is bound to the submitting account and a generation counter. Account switches invalidate all pending continuations; current connector identity is rechecked after asynchronous boundaries, preventing stale status or success callbacks from landing on the new account.
FRV-FS-12LowRemediated
The realized-annualized figure divides cumulative income since deployment by the vault's current asset base
Remediated after the audit. The invalid cumulative-income/current-assets annualization was removed. The panel retains current expected yield, projected position income, realized income history and the observation period without presenting a rate whose denominator changes independently of its numerator.
FRV-FS-13InformationalOpen
The per-state concentration dimension is optional at origination and silently unmeasured when omitted
Origination requires a non-zero borrower identifier but not a non-zero state identifier, and every registry path that would measure, limit or disclose state exposure short-circuits on zero. A facility booked without one is therefore exempt from the per-state limit and contributes nothing to it, and because there is no key to query, no breach or drift event can ever fire. Inert on the current testnet ramp, where all limits are open; live on the production configuration, which sets a real state limit. Class and borrower limits continue to bind, so this is the loss of one of three diversification controls rather than of the control itself.
FRV-FS-14InformationalOpen
The payment interval is stored and attested but never enforced by any state transition
The facility's payment interval is required at origination and committed in the signed terms, but no transition checks a new due date against it — only that the date strictly increases and does not exceed maturity. The schedule a quorum signed is therefore not the schedule the contract enforces.
FRV-FS-15InformationalOpen
Production genesis renounces every deployer authority in the same broadcast, at a point where governance voting power is zero
The deployment hands over and renounces in one transaction, at a moment when no governance token has been distributed and voting power is provably zero. This is the intended fail-safe posture and the launch runbook covers the sequencing, but the deploy path itself carries no assertion that a governing party exists before authority is dropped.
FRV-FS-16InformationalOpen
Latent — not reachable at launch: the governor is the timelock's only proposer and can be repaired only through itself
Unreachable at v1, where governance is not yet distributed. Becomes reachable on the signposted token distribution: because the governor is the timelock's sole proposer, a governor that cannot reach quorum cannot be replaced except through a proposal it cannot pass.
FRV-FS-17InformationalOpen
Nothing requires the attester set to be larger than the largest configured threshold
Neither the contracts nor post-deployment validation asserts that the number of attesters exceeds the highest threshold in use, so a quorum can in principle be configured with no redundancy — every attester required for every signature, and any one unavailable key blocking the path. The production roster size is not published here; it is operational detail and no roster is fixed in source. The underlying parameter risk is already open under its original identifier.
FRV-FS-18InformationalOpen
Latent — not reachable today: the vault's yield notification takes the delivered amount on trust
The vault accepts the notified amount without reconciling it against an observed balance delta. Unreachable while a single trusted caller delivers yield, which is the case today; it becomes reachable the moment a second yield-delivering path exists, which is a routine extension.
FRV-FS-19InformationalOpen
The queue can be blocked at its head when the conservative exit price clamps to zero
When declared-but-unrealized impairment meets or exceeds vault assets, the conservative exit price clamps to zero and the head of the queue cannot be settled, which stalls the queue behind it. The clamping state is reachable by an unprivileged past-due flag and clears when the impairment is realized or cured, so this is a stall rather than a loss — but the stall is applied to holders who are not party to it.
FRV-FS-20InformationalOpen
Two contract documentation blocks describe a superseded mark-freshness rule
The contract notes state that protective margin-call and liquidation triggers accept a mark of any age, which was the earlier ADR-0017 rule. ADR-0030 deliberately reversed it — all marked-to-market calls, cures and liquidations now require a fresh attested mark — and the code correctly implements the current rule. The ADR carries a supersession banner; only the contract documentation was left behind. Recorded because four independent reviewers read the stale note and concluded the code was wrong; see the narrative for why that matters more than the typo does.
FRV-FS-21InformationalRemediated
Latent — not currently observable: the vault has no reentrancy guard, and its deposit leg has a transient rate window mirroring the published exit-leg one
No value-moving vault function carries a reentrancy guard; the current asset set makes this unreachable. Separately, the deposit path has a window in which assets are credited before shares are minted — the entry-side mirror of the exit-side window already published as an Informational item, with the same comment-only remedy. Per unit of flow the exit-side distortion is the larger of the two. Neither is observable by any on-chain rate reader today. CLOSED by the ADR-0031 work: the vault inherits `ReentrancyGuardUpgradeable` and `deposit`/`mint`/`withdraw`/`redeem` plus every fee checkpoint are `nonReentrant`, with separate transient locks covering the points callback and the yield-delivery window. Verified in Round 14.
FRV-FS-22InformationalAccepted
The backstop address setter accepts any address with no zero-check or interface probe
Setting the cascade's second layer to the zero address silently skips that layer while the backstop still holds coverage, with no revert and no distinguishing event. A timelocked governance action, so this is a fat-finger guard rather than an attack surface. CLOSED by the ADR-0031 work: `DefaultManager.setBackstop` now calls `_validateBackstop`, which requires an ERC-165 identity declaration and a bounded, well-formed capacity read before a candidate can be installed. Verified in Round 14. PARTIALLY CLOSED, corrected on re-review: the interface-probe half is genuinely fixed, but the zero-check half named in this finding's own title is deliberately PRESERVED — `_validateBackstop` opens with an explicit early return for `address(0)`, so a single timelocked `setBackstop(address(0))` still removes cascade layer 2. That is an intended capability (the backstop is legitimately unset before Phase H), not an oversight, but recording the finding as fully remediated overstated what was done.
FRV-FS-23InformationalOpen
The protocol fee setter is bounded only at 100% while its sibling origination-fee setter is capped at 10%
One timelocked governance call could route the entire interest stream to the fee recipient. The asymmetry with the adjacent setter, which carries a hard 10% cap, suggests the omission is an oversight rather than a decision.
FRV-FS-24InformationalOpen
The cooldown and epoch-duration setters are unbounded above and apply retroactively to queued, non-cancellable requests
Both parameters can be raised without limit and take effect on requests already committed to the queue, which cannot be withdrawn. This is the exit-lockout risk the bounded setters elsewhere in the system exist to prevent.
FRV-FS-25InformationalOpen
The endpoint credential check does not cover keys embedded in a URL path or query
The guard that stops a keyed endpoint reaching the client bundle inspects only the URL's userinfo and fragment. Provider keys are commonly carried in the path or query string, where they would pass the check and be compiled into the public bundle.
FRV-FS-26InformationalOpen
Loopback detection uses raw string matching rather than URL normalisation
The rule that a loopback endpoint must be paired with the local development chain is enforced by matching the URL as text, so equivalent forms of the same address are not recognised and the pairing can be evaded. Strictly a development-profile guard.
FRV-FS-27InformationalOpen
The reserve deposit path accepts either of two roles, widening who can credit the backing denominator
Crediting idle reserves — one half of the backing figure — is gated on either the controller or the credit role, rather than on the single role the access-control model describes for that path. Both are protocol-internal, so this is a least-privilege observation rather than an exposure.
FRV-FS-28InformationalOpen
Latent — not reachable today: a rate-epoch struct lacks the layout-frozen annotation both sibling structs carry
The points rate-epoch struct is an array element with no layout-frozen marker, unlike the two comparable structs beside it. Harmless as written; it becomes a storage hazard on the most natural extension of that module, which is exactly what the markers on its siblings exist to prevent.
FRV-FS-29InformationalOpen
An interface comment understates the vault share unit by a factor of a million, and a calibration note cites a constant that no longer exists
The exchange-rate interface documents the wrong share precision, and the configuration rationale beside it refers to a constant that has since been removed. Documentation only; no caller depends on either statement.
FRV-FS-30InformationalOpen
The published access-control matrix has drifted from the source it describes
The matrix documents a function that no longer exists, omits six role-gated functions, and omits three permissionless keeper entry points. This is a re-observation of an item already open under an earlier identifier; it is recorded again because the drift is still present and because the matrix is one of the audit-onboarding artefacts an external reviewer would work from.

Historical snapshot — superseded. This narrative predates ADR-0031 and the move to instant yield recognition. Statements below about receipts vesting smoothly describe the seven-day streaming window in force at the time; Forest Road set the launch window to zero on 30 July 2026, so realized interest now enters NAV as a step. Optional streaming remains available to governance. See the Round 14 report for the current behaviour.

What this round was

The five rounds before this one each answered a narrower question: two five-pass source reviews, a pre-mainnet campaign, a defensive review of the clean mainnet-v1 tree, and a differential review of what the release branch changed. This one re-audited everything — every production contract and all frontend functionality — after the Round 6 remediations had landed.

The brief asked for findings confirmed by multiple passes. That was implemented as independent double discovery followed by adversarial verification, not as one pass reviewed twice:

The system was split into nine surfaces — six across the contracts (token layer, credit layer, loss cascade, reserve and queue, trust boundary, and governance/upgradeability/ storage) and three across the frontend (write paths, read and display correctness, configuration and security posture).
Each surface was reviewed twice, by reviewers with different briefs — one on correctness and value safety, one adversarial and economic — and the second reviewer never saw the first one's work. Agreement between them is independent corroboration rather than confirmation bias.
The 71 raw candidates were merged by mechanism, not by wording, into 30. Where two reviewers disagreed on severity, the lower was carried.
Every one of the 30 then faced two independent refuters instructed to refute rather than confirm, and to default to rejection where the evidence was not airtight: one testing whether the code actually says what the finding claims, at the line claimed, without a guard the finder missed; the other testing whether the stated consequence follows, who must act to reach it, and whether a validator or an existing test already blocks it.
A completeness critic then challenged the severities and — more usefully — enumerated what the audit had failed to cover.

All 30 mechanisms held. 22 of the 30 had their consequence corrected downward, four filed Mediums ending as Informational. The severities published here are post-correction.

The result

No Critical and no High finding. Nothing found in this round breaks the backing invariant, inverts or skips the loss cascade, bypasses the facility mint gate, defeats compliance, over-distributes the redemption queue, or reaches an unauthorized mint.

One contract-level defect is reachable through ordinary operation — FRV-FS-01. The other Medium is a disclosure defect at the point of an irreversible signature. Four of the top six findings are frontend-to-contract reconciliation defects, which is the class the operating rules assign to live-system QA — a pass this round could not perform.

Six rounds in, that a full re-audit yields one composed state-machine dead end and a cluster of display-accuracy defects is itself a result about the contracts. It is not a statement that the system is ready to launch.

Post-audit remediation update — 28 July 2026

All two Medium and ten Low findings have since been remediated and verified. The original audit narrative below is preserved as the evidence at baseline 33713ec; these changes do not retroactively turn the source-only review into an executed audit.

FRV-FS-01: the waterfall now skips schedule advancement only for the exact terminal maturity-to-maturity case. ClaimBridge's strict later-date rule still binds every non-terminal receipt. Regressions cover interest-only and partial-principal receipts at the terminal due date, rejection of an unchanged pre-maturity date, and a deterministic thirteen-receipt facility lifetime through the maturity clamp.
FRV-FS-02: the redeem card now reads the live configured cooldown, distinguishes it from the settlement heartbeat, warns that FIFO and liquidity can extend the wait, requires an explicit acknowledgement that queue entry is non-cancellable, and renders each position's first eligibility from its request timestamp plus the live cooldown. The request action is disabled until the on-chain cooldown has loaded.
FRV-FS-03: an oversized healthy yield receipt can no longer close vault entry. The vesting stream is capped against the live staked base and any excess is recognized immediately as an upward-only NAV step, while ordinary receipts continue to vest smoothly.
FRV-FS-04: professional assessments now separate risk-state identity from global backstop capacity. Permissionless additions cannot invalidate a live assessment; a capacity decrease, curator-pool change, or book/default revision still fails closed.
FRV-FS-05: a pending queue does not consume its heartbeat for an aggregate fill below the governed economic minimum. The attempted dust fill rolls back; final drained tails remain claimable, and zero liquidity remains blocked even if governance disables the entry floor.
FRV-FS-06: cancellation and different-call wallet replacements now report an error. Same-call repricing succeeds against the replacement hash that actually mined.
FRV-FS-07: receivable collateral is calculated from live outstanding principal divided by LTV, preventing amortization or a write-down from inflating displayed coverage.
FRV-FS-08: position value and gain now use the impairment-netted previewRedeem exit value and say so.
FRV-FS-09: the receipt-bound verifier runs from Next's production-build phase as well as npm prebuild, and CI now executes the contract and frontend gates. No pre-deployment receipt was invented: mainnet builds remain blocked until the deployment ceremony produces the real approved manifest and receipt.
FRV-FS-10: every build must select its chain explicitly; an unset NEXT_PUBLIC_CHAIN_ID fails closed.
FRV-FS-11: writes are bound to both an account and a flow generation, so a result from the prior wallet cannot update the newly selected account's UI or trigger its success callback.
FRV-FS-12: the denominator-unstable cumulative-income annualization was removed. The panel retains current expected yield, projected position income, realized history and the observation period.

Post-remediation verification completed with 865 contract tests passed, zero failures; 182 environment-gated fork tests were skipped by the unconfigured run. The queue and credit invariants each ran 256 campaigns of 128 calls per property without a handler revert. Frontend logic, 332 contract↔UI synchronization checks, lint, TypeScript and the production build all passed; an explicit unset-chain probe failed closed as intended. Slither 0.11.5 analyzed 104 contracts with 101 detectors and returned 84 raw pattern matches; manual triage added no new finding. Its High-labelled outputs were the role-gated exact USDC pull paths and the non-reentrant loss cascade's explicit before/after balance check. The 18 Informational findings retain their original dispositions. This remediation does not close any independent external-audit, legal, economic or production-readiness gate.

Independent agreement is not correctness

This is the most useful thing the round produced, and it is worth stating plainly because it bears on how every finding on this site should be read.

The most corroborated finding of the round — four separate reviewers across two different surfaces, all citing the same six locations, every citation accurate — claimed that the protective margin-call and liquidation triggers wrongly require a fresh valuation, contrary to the documented rule that protective action must never be blocked by a withheld mark.

All four were wrong, in the same way. None noticed that the ADR they were citing carries a supersession banner, and that ADR-0030 deliberately reversed the rule: marked-to-market calls, cures and liquidations now do require a fresh attested mark. The code implements the current rule correctly. What is actually wrong is two stale comment blocks left behind by the reversal — published here as FRV-FS-20, Informational.

Both refuters caught it independently, and the finding fell from Medium to Informational.

Four independent reviewers agreeing is strong evidence that a mechanism is real and weak evidence that a conclusion is right. Corroboration alone would have published a Medium against correct code. That is the argument for the verification stage, and it is why this page records what verification changed rather than only what it confirmed.

The two Mediums

FRV-FS-01 — a servicing dead end. The payment waterfall advances a facility's schedule on every performing receipt that leaves principal outstanding. The credit register accepts only a strictly later date, bounded above by maturity. Once those two coincide — which a bullet facility can do from the day it is originated — the acceptable range is empty and the whole distribution reverts.

Nothing is lost; the revert is atomic and happens before any money moves. What breaks is servicing. A final short payment cannot be recorded. An unscheduled interest-only payment cannot be recorded. That period's senior yield is never minted. And the facility then drifts to its grace deadline, where the permissionless past-due flag can be applied by any address — lowering the redemption NAV while the borrower is in fact paying. Both ways out are governance- or attester-grade, and needed per payment.

The reason no test caught it is worth recording: the invariant campaign runs with reverts treated as failures, and its handler applies the exact clamp that creates the trap. A green run is therefore positive evidence that the fuzzer never walks a single facility through its own amortization schedule.

FRV-FS-02 — an undisclosed lock-up. A queued redemption cannot settle for 21 days, and the queue has no cancel or withdraw function of any kind: custody moves permanently when the user signs. The redeem card states no exit horizon at all — its only time signal is the sub-24-hour epoch countdown. The cooldown is not in the queue interface the app reads and appears nowhere in the frontend; the request's own timestamp is decoded and then never shown.

This is the omission of a hard floor rather than an incorrect number, and it sits immediately above an unrecoverable action on the app's broadest write surface. Two strings in the error catalogue already promise a per-position countdown; they turn out to be unreachable at runtime, which makes them evidence that the interface was believed to have one — not something a user is ever shown.

Grading it Medium is a boundary call and is stated as one: earlier rounds reserve that grade for frontend items with a functional consequence and use Low for display accuracy. It sits with the former because the user acts irreversibly on the incomplete statement.

Findings that touch previously accepted risks

Every reviewer was given the register of findings this protocol has already accepted, deferred or left open, with the rule that a finding sharing an impact class with an accepted item may only be raised if the mechanism genuinely differs — and must say how.

No candidate had to be dropped as a restatement. The closest calls were each checked and kept:

FRV-FS-03 against the accepted yield-guard residual. That acceptance concerns how much a depositor can capture once entry reopens; this is the opposite side of the same test — the guard firing during healthy operation, which undercuts the premise the calibration rests on.
FRV-FS-13 against the accepted concentration-drift item. That one concerns exposure that is measured and drifts above its limit, mitigated by the rule that a breached dimension cannot be grown. Here the dimension is never measured at all, so that mitigation has nothing to attach to.
FRV-FS-04 against the accepted curator-capital item. That is a privileged party posting withdrawable capital to improve a settlement; this is an unprivileged party spending a trivial, unrecoverable amount to degrade one, through a different module.

One acceptance whose premise should be revisited

The marked-to-market class is carried at par as an explicit design decision, and that decision is published on the Round 1 page with a stated rationale: the class is protected by the fast margin-call, liquidation and loss-cascade remedy instead of by a continuously-marked backing figure.

FRV-FS-20 establishes that ADR-0030 changed the conditions on that remedy — those triggers now require a fresh attested mark. The code is right and the change was deliberate. But the published acceptance rationale predates the reversal and does not disclose that the protection it names is now conditional on continuous attester liveness: with a short maximum mark age, a non-signing key, a guardian pause of the oracle, or an administrative revocation suspends the remedy while the loan-to-value ratio deteriorates, and the fallback path needs a quorum through the same entry point.

This is a documentation and governance item rather than a code defect, and it is the one place where this round bears directly on a prior acceptance. It is recorded here so the acceptance can be re-examined rather than inherited.

What this audit did not cover

An audit that overstates its own coverage is worse than one that admits its limits.

Nothing was executed. This round was read-only by instruction: no test suite, no coverage measurement, no invariant campaign, no symbolic checking, no static analysis, no build, no live-chain reads. Every statement here that no test covers a finding is derived from reading and searching the test tree, not from measuring it. The test and coverage figures recorded elsewhere in this repository were not re-verified by this round and are not restated here.

No live-system QA, despite four of the six most significant findings being exactly the frontend-to-contract reconciliation defects that a live pass is designed to catch. All four were found by reading. That reading alone surfaced four is a reason to expect a live pass would surface more; their absence from this page is not evidence they do not exist.

Formal methods remain one file and one property. The only symbolic artefact covers the loss cascade, and it is a separate re-implementation bound to the contract by differential fuzzing rather than the contract itself. The operating rules name two properties for formal treatment — the backing invariant has no symbolic proof at all. No reviewer noticed this; the critic did.

There is no continuous integration. The rule that a red suite blocks a merge is unimplemented, so nothing mechanically prevents any finding — from this round or the five before it — from regressing.

The coverage methodology is self-documented as defective and was not re-measured. The repository's own notes record that the exclusion pattern used for coverage silently omitted one production contract from every figure it has ever reported.

The tests were never audited as a deliverable in their own right, although the operating rules treat them as one. Weak assertions, tautological tests, or handlers that cannot reach a state would have been invisible to this round. Scale and multi-year state growth were not examined at all.

The blind spot, and what should happen next

The weakness this round revealed in itself is one of shape rather than effort: defects that require a single entity to be walked through many sequential operations across a module boundary.

FRV-FS-01 is exactly that shape, and seventeen of the eighteen reviewers missed it — each of the two functions involved is correct in isolation, and the defect exists only in their composition after a facility has amortized. At the audited baseline, the automated suite did not reach it; the post-audit remediation adds a deterministic full-schedule regression. Meanwhile every reviewer's list of properties they could not break is a point-in-time property: reentrancy, rounding direction, replay, domain binding, storage layout, chain binding, decimals, ordering, double-claim. All valuable; none sequential.

The recommendation carried into the next round is to review by entity lifetime rather than by module, as executed integration tests rather than as reading: drive one facility and one vault position through their full terms — many sequential partial repayments including an interest-only and an unscheduled prepayment, a short final payment, past-due, cure, maturity; and stake, accrue across several governance rate epochs, queue, cool down, settle partially across epochs, claim. Add the missing symbolic proof of the backing invariant so the long-sequence question is answered for all inputs rather than sampled.

Status of these findings

At publication, all thirty were open and the evidence behind each was source-only. The post-audit remediation above closes FRV-FS-01 through FRV-FS-12 with executed regression evidence; the remaining 18 Informational findings retain their original dispositions.

Separately: several candidates were reduced or set aside precisely because they re-filed a defect this protocol has already published under an earlier identifier. Reducing a duplicate filing says nothing about the underlying defect — those items remain open under their original identifiers, and at least one of them, the drift in the published access-control matrix, is still present in the source.

Earlier roundRelease-branch differential review→