External review. This review was conducted by a party other than Forest Road. What the engagement did and did not cover is set out under Method and in the report itself, the limits of a review bear on what its findings are worth, and should be read alongside them. It does not by itself authorize a production launch. It reviews the source at the baseline below, which is not necessarily identical to the code deployed on any network. Forest Road Vault is live on Ethereum mainnet; its Solana curator vault remains on devnet and BSC has its own deployment status. An open finding applies only to the product, version and deployment state named by this review. Each review's scope bounds what its clean result is worth. Nothing here is a securities-law representation; token characterization is a matter for counsel.
- Scope
- Changed Ethereum and BSC contracts and their focused regression packages. The review included execution probes and refutation/rescue rounds; it was not a fresh line-by-line review of every unchanged protocol file.
- Method
- Multi-reader review, two-refuter checks for material candidates, rescuer review of proposed kills, full-suite reruns and focused probes with deliberate incorrect changes against each fix.
- Reviewed baseline
- Five reviewed diffs covering continuous accrual, assessment ratcheting, ceremony controls, custody exits, impairment recovery and legacy PIK default handling
- Internal report
- audit-reports/corrovera-diff-audit-2026-09-17/
DA-M1MediumRemediated
Past-due accrual invalidated a recovery assessment one second after publication
The assessment now ratchets its recorded exposure, fee mark and senior mark with the assessed cohort. The exit quote remains conservative without opening the accrual leak that simply dropping the cohort from the risk hash would have created.
DB-M1MediumRemediated
Armed-loss exit gates had dust-funding and reconciliation gaps
The exit predicate was moved to the durable payable-basket boundary, and BSC ratification reconciles live custody before releasing the latch. Focused controls covered permissionless dust, KYC minting, repayment and credit-role deposits.
DB-M2MediumRemediated
A fixed 200,000-gas recovery probe could misclassify a healthy source
The production-shaped cold read exceeded the old stipend. The revised probe uses a bounded in-frame budget with measured headroom and remains constant in facility count through its aggregate read path.
DD-L1LowRemediated
Legacy default could forfeit completed but uncranked PIK coupons
Legacy default now records completed PIK before declaring default across unmarked, marked, prepared and accelerated paths. Fresh V2 uses continuous accrual from genesis but retains the corrected legacy code.
DE-M1MediumAccepted
The legacy 16-coupon default cap was not a safe bound in the bound upgrade state
Accepted only because Ethereum V2 was deployed fresh with accrual enabled before funding, so the legacy upgrade path is not used. Any later legacy migration must size against its exact bound state and batch before default; the 16-coupon value is not a mainnet gas guarantee.
DE-M2MediumAccepted
The legacy multi-transaction preparation exposed curator withdrawal before freeze
Accepted under the same fresh-genesis decision. If the legacy route is ever revived, the procedure must pause both the queue and CuratorModule before publishing default evidence and must not use the historical atomic wording.
DE-L1LowAccepted
Closed-round share rescaling can retain a bounded storage remainder
The ceiling division remainder is bounded by the number of classes minus one wei and has no practical value consequence. The owner declined a bytecode-costly change and retained the bound as a documented limitation.
DE-L2LowAccepted
A custody token becoming unreadable after a BSC latch can block its exit verbs
This is a fail-closed dependency on the selected token's balance query. The owner accepted it as an exceptional token failure risk; BSC had not been deployed at this review.
Result
The diff sequence covered the continuous-accrual follow-up, recovery-assessment ratchet, ceremony
checks, custody-exit corrections, impairment-source recovery and legacy PIK default handling.
Material candidates passed through independent refutation and focused execution probes.
The confirmed live-path defects were corrected. The assessment no longer dies merely because its
past-due cohort earns another second of interest; the cold impairment-source read no longer crosses
an undersized fixed probe; armed custody review cannot be changed by permissionless dust funding;
and completed legacy PIK is recorded before default rather than forfeited.
Legacy-only acceptances
The review showed that a 16-coupon legacy default cap was not a safe gas bound once the old proxy
was fully bound to the accrual system. It also showed that the old multi-transaction preparation
could expose curator withdrawal between public evidence and the later freeze.
Forest Road accepted both only because Ethereum V2 was deployed fresh with continuous accrual
active before any facility funding. The legacy upgrade route remains uncleared: any future use
must size the actual state, batch before default, and pause the queue and CuratorModule before
publishing default evidence.
Scope
This was a review of five diffs and their tests. It does not convert unchanged code outside those
diffs into reviewed code, and BSC findings do not describe the deployment status of Ethereum V2.