External review by Corrovera Security

External review. This review was conducted by a party other than Forest Road. What the engagement did and did not cover is set out under Method and in the report itself, the limits of a review bear on what its findings are worth, and should be read alongside them. It does not by itself authorize a production launch. It reviews the source at the baseline below, which is not necessarily identical to the code deployed on any network. Forest Road Vault is live on Ethereum mainnet; its Solana curator vault remains on devnet and BSC has its own deployment status. An open finding applies only to the product, version and deployment state named by this review. Each review's scope bounds what its clean result is worth. Nothing here is a securities-law representation; token characterization is a matter for counsel.

Scope: The whole protocol as it stood on 4 August 2026: 37 Solidity files, 10,502 lines of contracts/src, byte-identical to the contracts/src tree at b5245398 ON THAT DATE. The source has since grown to 49 files and has NOT been re-reviewed by Corrovera; treat this review as scoped to the 4 August tree, not to current source. First review of this protocol conducted by a party other than Forest Road.
Method: Corrovera's AI-assisted security review tier: their deterministic Solidity analysis, Slither over the full compiled project, the project's own Foundry suite, and whole-protocol review by five independent model lineages under two specialist lenses, economic sequencing, and cross-contract invariant conservation, with the project's 36-entry findings register supplied as an exclusion list so a rediscovery could not be reported as a discovery. The surviving candidate was put to four further lineages instructed to refute it, and every load-bearing claim was validated against source by the reviewing engineer. Explicitly not run, per the report: model qualification benchmarking, generated fork reproduction, coverage-guided fuzzing, symbolic execution or formal verification, and a deterministic consensus pipeline, adjudication was by one engineer.
Reviewed baseline: d2ef15a5, contracts/src byte-identical at b5245398
Internal report: audit-reports/corrovera-ai-assisted-review-20260804.md

Findings and remediation history

F-01MediumAccepted
A curator can inflate the price its own queued redemption settles at, by posting and withdrawing first-loss capital around the settlement
Pending senior impairment nets a class's at-risk principal against a LIVE, UN-SNAPSHOTTED read of the curator's first-loss pool, and that residual flows into the conservative asset figure that prices queued exits at settlement. Separately and deliberately: a past-due mark does not freeze curator withdrawals: that omission is what removed the permissionless-griefing surface in the H-5 redesign, and reversing it would reintroduce that surface. Each decision is individually sound; together they permit an approved curator who also holds senior tokens to raise the pool balance, settle their own eligible queued request against the improved price, and withdraw the capital again, with the impairment snapping back afterwards. Both the past-due trigger and the epoch settlement are permissionless, so the actor controls the timing of both. RATED MEDIUM on reachability, not on mechanism: three independent refuting reviewers all rated it High and all said the mechanism survives, and the reviewing engineer rated it down after Forest Road raised the 21-day request-anchored FIFO cooldown, which removes opportunistic execution but does not gate curator withdrawal, the curator module contains no timestamp logic at all. SCOPE IS THE MATERIAL POINT: near-unreachable while Forest Road is sole curator, because its first-loss capital is consumed before any senior loss and franchise value dwarfs a single exit gain, so the round trip would extract from seniors while its own junior capital stays exposed. It goes live from the first non-Forest-Road curator approval: a third-party curator has no franchise at stake and nothing in code bars a curator from holding senior tokens, curator approval being admin-gated only. Best read as a precondition on a planned capability rather than present exposure. Remediation is to snapshot the curator pool balance used for impairment netting at epoch open rather than reading it live at settlement, and it should land before any third-party curator is approved. ACCEPTED BY FOREST ROAD ON 4 AUGUST 2026 as low practical risk, after its own analysis. Accepted is used strictly and is not a synonym for fixed: the mechanism is unrefuted and Corrovera's Medium rating stands as recorded, and this entry does not restate it as Low. The acceptance rests on the actor-scope argument above, that the only currently approved curator is the party whose junior capital the round trip would leave exposed. IT MUST BE REVISITED BEFORE ANY NON-FOREST-ROAD CURATOR IS APPROVED, if a Forest Road curator wallet holds a material sUSDfr position or eligible queued redemption during delinquency or impairment, if curator incentives/first-loss/withdrawal/netting/settlement mechanics change, or if new evidence widens reachability or impact. Reproduction detail is withheld while the mechanism is unremediated, as with every live finding on this register.
F-02MediumAccepted
Ordinary forbearance suppresses the senior impairment mark, with no misconduct required
The permissionless past-due mark is gated entirely on a servicer-controlled payment date, movable both by an originator-role term amendment and by the waterfall advancing it on a payment classified as performing. While that date is rolled forward, past-due principal stays zero, pending senior impairment never reflects the delinquency, and queued seniors settle against an unimpaired mark. CORROVERA WITHDREW THEIR OWN FIRST FRAMING of this as a deliberate deferral, and the correction makes the finding worse rather than better: rolling a payment date for a borrower with a temporary liquidity problem is ordinary forbearance and standard credit practice, and an originator concealing delinquency would destroy their own book. The harm needs no intent, a well-intentioned servicer produces the same suppression, so likelihood rises because forbearance is routine, while the profit motive disappears and it is less likely to be noticed precisely because nobody is behaving badly. BOUNDED TWO WAYS. It only bites where a class's impairment exceeds its first-loss capacity; inside that capacity no senior is mispriced at all and the anchor curator absorbs it exactly as the cascade intends, but that is also, unavoidably, the tail where the capital providing that alignment has already been consumed. And both deferral routes require an attestation, so attestation discipline is the control, which is the control the register already records as concentrated at m == n == 2 with both attesters under one key and the attester being the servicer. The report is explicit that F-02 and that entry compound and that neither captures the interaction alone. Recorded as an observation rather than an allegation: management fees are AUM-linked and performance fees run against a high-water mark on the conservative rate, so the party deciding whether to grant forbearance is not financially indifferent to that decision. Distinct from the register's existing marks, it inverts the over-mark entry rather than restating it, and concerns a different input from the stale-valuation entry. ACCEPTED BY FOREST ROAD ON 4 AUGUST 2026 as low practical risk, after its own analysis. Accepted is used strictly: no code change was made: the mechanism is unrefuted, and Corrovera's Medium rating stands as recorded rather than being restated here as Low. The acceptance rests on the two bounds above: that the senior mark cannot move until a class's first-loss capital is exhausted, so no senior is mispriced for any delinquency the curator absorbs, and that both deferral routes require an attestation. IT MUST BE REVISITED if class losses approach or exceed first-loss capacity, if the attester quorum or its key custody changes, if the servicer ceases to be the attester or a further deferral route is added, or if forbearance ceases to be exceptional in practice. The compounding interaction with the concentrated-attestation entry is the part to watch: neither entry captures it alone, and the acceptance of each assumes the other holds.
F-03InformationalOpen
Challenge to the D7-01 risk acceptance: a later redesign may have widened the trigger surface it was scoped against
Advisory rather than a finding. The D7-01 acceptance of 3 August 2026 rests on the premise that the default declaration is atomic and private, so a post-declaration exit is already priced at the impaired conservative mark. One of ten independent opinions dissented with a specific and testable mechanism: the H-5 redesign introduced the past-due mark as a PERMISSIONLESS, PUBLIC trigger that also raises pending senior impairment, so an observer can see it in the mempool and act ahead of it, a channel the acceptance premise does not cover, because that premise was written about the default declaration. The other nine judged the acceptance sound. This does not overturn it; it records that a later redesign may have widened the surface the acceptance was scoped against, and Forest Road is treating it as a recorded revisit trigger. Consensus across all ten opinions was that the separate D-RATE-02 acceptance is sound.

What this is

Corrovera Security reviewed the whole protocol, 37 Solidity files, 10,502 lines of contracts/src: at commit d2ef15a5, and the reviewed source is byte-identical to the current contracts/src tree at b5245398. This is the first review of this protocol conducted by a party other than Forest Road.

It is an AI-assisted security review, which is the tier Corrovera delivered and the tier we commissioned. We are publishing what it did and did not cover, in their words rather than ours, because the distinction matters to anyone deciding what this page is worth.

What ran: Corrovera's deterministic Solidity analysis; Slither over the full compiled project; our own Foundry suite; whole-protocol review by five independent model lineages under two specialist lenses, with our 36-entry findings register supplied as an exclusion list so that nothing already known could be re-reported as new; adversarial cross-examination of the surviving candidate by four further lineages instructed to refute it; and manual source validation of every load-bearing claim by the reviewing engineer.

What did not run, and what Corrovera says it costs:

| Absent | Consequence | |---|---| | Model qualification benchmark | No lineage has measured competence at this task | | Generated fork reproduction | No finding reaches confirmed | | Coverage-guided fuzzing | No state-space exploration beyond our own suite | | Symbolic execution / formal verification | No property proven | | Deterministic consensus pipeline | Adjudication by one engineer |

Their summary of what a clean section means is worth quoting directly: "A clean result in any section is evidence that these methods at this depth found nothing there. It is not evidence of security."

What they found

Two new Medium findings and one challenge to an existing risk acceptance. All three fall outside the 36 entries we supplied, which is the result that matters: the exclusion list was designed to make a rediscovery impossible to pass off as a discovery.

One lineage produced three candidates; the other four produced none. The strongest was put to the remaining four for refutation. Three returned verdicts and all three said it survives, each rating it High. The reviewing engineer rated it down to Medium on reachability grounds after we raised the redemption cooldown, a calibration the refuting reviewers were not asked to challenge, and the report says so.

F-01: a curator can inflate the exit price it redeems at

Our impairment calculation nets a class's at-risk principal against a live, un-snapshotted read of the curator's first-loss pool, and that figure flows into the price at which queued redemptions settle. Separately, and deliberately: a past-due mark does not freeze curator withdrawals, that omission is what removed a griefing surface in an earlier redesign.

Each decision is sound alone. Together they let an approved curator who also holds senior tokens raise the pool balance, settle their own queued exit against the improved price, and withdraw the capital again, with the impairment snapping back afterwards. Both the trigger and the settlement are permissionless, so the actor controls the timing of both.

Scope is the important part. This is near-unreachable while Forest Road is the sole curator: our first-loss capital is consumed before any senior loss, so the round trip would extract from seniors while our own junior capital stays exposed, and the franchise is worth more than any single exit. It becomes live from the moment a third-party curator is approved: they have no franchise at stake, and nothing in code stops a curator holding senior tokens.

It is best read as a precondition on a planned capability rather than present exposure. The acceptance reopens before any third-party curator is approved; remediation or a fresh, explicit owner decision is required at that boundary.

F-02, ordinary forbearance suppresses the senior mark

The permissionless past-due mark is anchored on a servicer-controlled payment date. While that date is rolled forward, the delinquency never reaches the senior impairment figure, and seniors exiting in that window are priced against a facility that is not performing.

Corrovera withdrew their own first framing of this as misconduct, and the correction makes it worse rather than better: rolling a payment date for a borrower with a temporary liquidity problem is ordinary credit practice, and the mechanism needs no bad intent. Likelihood rises, because forbearance is routine, and it is less likely to be noticed precisely because nobody is behaving badly.

Two things bound it. It only bites where a class's loss exceeds its first-loss capacity, inside that capacity the curator absorbs it and no senior is mispriced, which is the cascade working as designed. And both deferral routes require an attestation, so attestation discipline is the control. That control is the one our own register already flags as concentrated, and the report is explicit that the two findings compound.

They also record, as an observation rather than an allegation, that management and performance fees are not neutral to the forbearance decision.

F-03, a challenge to an existing acceptance

Nine of ten independent opinions judged our D7-01 acceptance sound. One dissented with a specific, testable mechanism: that acceptance was written about a private, atomic trigger, and a later redesign introduced a permissionless, public trigger that raises the same figure. That does not overturn the acceptance; it records that a redesign may have widened the surface the acceptance was scoped against. We are treating it as a revisit trigger.

What they confirmed and dismissed

Our open C-01 was confirmed still open: the deliberately-red invariant marker fails as designed over 256 runs and 32,768 calls, and inverts when the finding is fixed.

Of 134 static-analysis results touching in-scope source, all 38 Mediums were individually adjudicated and dismissed with reasons: the flagged token transfers are role-gated and balance-delta verified, all thirteen reentrancy sites carry guards: the divide-before-multiply is deliberate decimal dust retention, and the unused-return flags read a field the code does not need. One candidate from an outside lineage was self-refuted by the reporting model during its own verification.

Our suite ran 947 passed, 2 failed, 204 skipped, one failure the intentional C-01 marker, the other environmental.

Forest Road's decision, 4 August 2026

Forest Road analysed both Medium findings and accepted them as low practical risk. Forest Road also confirmed that one external audit is the applicable launch requirement, so this received Corrovera engagement satisfies that gate. Publishing the reasoning matters more than publishing the conclusion: the policy decision does not expand the engagement's scope or method, and it does not turn accepted findings into fixed ones.

Accepted is not fixed. Neither mechanism was refuted and neither was remediated in code. Corrovera's Medium ratings stand as they wrote them: we have not restated them as Low on our own register, because a client's risk tolerance is not a re-rating of an auditor's finding.

Each acceptance rests on a stated condition, and each carries revisit triggers recorded against the finding. F-01's rests on actor scope: the only approved curator is the party whose own junior capital the round trip would leave exposed, so it must be revisited before any third-party curator is approved: the precise event that makes it live. F-02's rests on the loss sitting inside first-loss capacity and on attestation discipline, and the interaction with our existing concentrated-attestation entry is the part to watch, since the acceptance of each assumes the other holds.

What a reader should weigh against that. No finding in this review reached confirmed, because fork reproduction was not part of the engagement. No property was formally proven. No fuzzing ran beyond our own suite. Adjudication was by one engineer. Those are the report's own disclosures, not our characterisation of it, and they are reproduced in full above so that anyone can judge the acceptances and evidence tier for themselves.

What the review did do is more useful than a clean report would have been: it put five independent reviewers on the whole protocol with our known findings excluded, and they came back with two real structural observations we had not made ourselves, one of which gates a capability we were planning to enable, and now gates it explicitly.

The exact Forest Road rationale, conditions and revisit triggers are archived separately in audit-reports/CORROVERA_OWNER_DISPOSITIONS_2026-08-04.md; the vendor report remains the source review record.

Earlier roundFirst audit of the marked-to-market executor→