Ethereum mainnetTransactions use real assets. Access is KYC-gated; review the legal and risk disclosures before transacting.
Solana and curator correctness review
Internal review. This is an internal engineering review of source, not an independent external audit, and it does not by itself authorize a production launch. It reviews the source at the baseline below, which is not necessarily identical to the code deployed on any network. Forest Road Vault is live on Ethereum mainnet; its Solana curator vault remains on devnet and BSC has its own deployment status. An open finding applies only to the product, version and deployment state named by this review. Each review's scope bounds what its clean result is worth. Nothing here is a securities-law representation; token characterization is a matter for counsel.
Scope
The ten Solana curator-vault Rust files, client and deployment tooling, curator website paths, and focused Ethereum and BSC CuratorModule dependency closures.
Method
Internal source review with SBF and host builds, LiteSVM lifecycle tests, independent integer models, randomized sequences, frontend interaction checks and focused EVM curator suites.
Reviewed baseline
Ethereum/Solana dde4cd43; BSC 45174c80; later superseded by the 20 September curator-vault remediation baseline
Revoking curator approval hid an existing withdrawable Ethereum position
The website now retains positive-balance positions after revocation, disables only new posting and preserves withdrawal and closed-round settlement. The contract had never revoked the holder's withdrawal right.
SC-M2MediumRemediated
Reown rejected the live WalletConnect origin
The owner created the replacement Reown project and allowlisted all three intended domains. Release builds query the public origin policy and refuse promotion if the required origins are absent.
SC-L1LowSuperseded
Failed Ethereum curator reads could appear as healthy zero values
Closed by the later curator-vault package, which requires successful gating reads and includes pause, custody and failed-read state in the displayed withdrawal amount.
SC-L2LowSuperseded
Solana confirmation could be shown beside stale unlabelled state
Closed by the later package's ordered refresh, visible failure state and wallet-local read controls.
SC-L3LowSuperseded
The interest route did not reject a missing form object cleanly
Closed by runtime shape validation and later constant-cost admission, concurrency and cleanup controls.
SC-L4LowSuperseded
Coupon payment timing differed from the completed-month specification
The program now separates total coupon owed from the amount payable through the completed month boundary; later earned amounts remain for the next boundary.
SC-L5LowSuperseded
Unsolicited SPL-token balances were absent from the accounting identities
The later package defines direct transfers as measured surplus and adds bounded principal and coupon recovery paths without spending accounted funding.
SC-L6LowSuperseded
Wallet Standard inferred cluster from the RPC URL
Later release configuration binds the cluster, manifest and wallet metadata and rejects inconsistent production inputs.
SC-L7LowSuperseded
Zero-key validation and the position initialization sentinel were incomplete
The versioned account layout now rejects zero authorities and owners and no longer uses a zero owner as the initialization sentinel.
Result at the checkpoint
The internal review found one Medium website defect that hid an existing Ethereum curator position
after approval revocation, and one Medium external-configuration defect that made WalletConnect
reject the live origin. It also recorded seven Low program, accounting and interface issues.
The revoked-position defect was fixed without changing the contract's withdrawal rights. The
owner replaced the Reown project and configured the intended origins, while the release gate now
checks the provider's public origin policy.
Later status
The 20 September Corrovera curator-vault review and its remediation packages supersede this
checkpoint. They corrected the remaining accounting and interface items, expanded program and
frontend tests, produced a reproducible release artifact and activated the exact artifact on
devnet.
No Solana mainnet deployment occurred. The review used local builds, LiteSVM, independent integer
models, randomized state sequences, frontend checks and focused EVM curator tests.