Ethereum contracts deployedTransactions may use real assets. Primary-market minting and instant redemption are KYC-gated; deployment does not mean every product or entry path is open. Review the legal and risk disclosures.

Solana and curator correctness review

Internal review. This is an internal engineering review of source, not an independent external audit, and it does not by itself authorize a production launch. It reviews the source at the baseline below, which is not necessarily identical to the code deployed on any network. Forest Road Vault is live on Ethereum mainnet; its Solana curator vault remains on devnet and BSC has its own deployment status. An open finding applies only to the product, version and deployment state named by this review. Each review's scope bounds what its clean result is worth. Nothing here is a securities-law representation; token characterization is a matter for counsel.

Scope
The ten Solana curator-vault Rust files, client and deployment tooling, curator website paths, and focused Ethereum and BSC CuratorModule dependency closures.
Method
Internal source review with SBF and host builds, LiteSVM lifecycle tests, independent integer models, randomized sequences, frontend interaction checks and focused EVM curator suites.
Reviewed baseline
Ethereum/Solana dde4cd43; BSC 45174c80; later superseded by the 20 September curator-vault remediation baseline
Internal report
docs/remediation/SOLANA_CURATOR_REVIEW_2026-09-18.md

Findings and remediation history

  • SC-M1MediumRemediated

    Revoking curator approval hid an existing withdrawable Ethereum position

    The website now retains positive-balance positions after revocation, disables only new posting and preserves withdrawal and closed-round settlement. The contract had never revoked the holder's withdrawal right.

  • SC-M2MediumRemediated

    Reown rejected the live WalletConnect origin

    The owner created the replacement Reown project and allowlisted all three intended domains. Release builds query the public origin policy and refuse promotion if the required origins are absent.

  • SC-L1LowSuperseded

    Failed Ethereum curator reads could appear as healthy zero values

    Closed by the later curator-vault package, which requires successful gating reads and includes pause, custody and failed-read state in the displayed withdrawal amount.

  • SC-L2LowSuperseded

    Solana confirmation could be shown beside stale unlabelled state

    Closed by the later package's ordered refresh, visible failure state and wallet-local read controls.

  • SC-L3LowSuperseded

    The interest route did not reject a missing form object cleanly

    Closed by runtime shape validation and later constant-cost admission, concurrency and cleanup controls.

  • SC-L4LowSuperseded

    Coupon payment timing differed from the completed-month specification

    The program now separates total coupon owed from the amount payable through the completed month boundary; later earned amounts remain for the next boundary.

  • SC-L5LowSuperseded

    Unsolicited SPL-token balances were absent from the accounting identities

    The later package defines direct transfers as measured surplus and adds bounded principal and coupon recovery paths without spending accounted funding.

  • SC-L6LowSuperseded

    Wallet Standard inferred cluster from the RPC URL

    Later release configuration binds the cluster, manifest and wallet metadata and rejects inconsistent production inputs.

  • SC-L7LowSuperseded

    Zero-key validation and the position initialization sentinel were incomplete

    The versioned account layout now rejects zero authorities and owners and no longer uses a zero owner as the initialization sentinel.

Result at the checkpoint

The internal review found one Medium website defect that hid an existing Ethereum curator position after approval revocation, and one Medium external-configuration defect that made WalletConnect reject the live origin. It also recorded seven Low program, accounting and interface issues.

The revoked-position defect was fixed without changing the contract's withdrawal rights. The owner replaced the Reown project and configured the intended origins, while the release gate now checks the provider's public origin policy.

Later status

The 20 September Corrovera curator-vault review and its remediation packages supersede this checkpoint. They corrected the remaining accounting and interface items, expanded program and frontend tests, produced a reproducible release artifact and activated the exact artifact on devnet.

No Solana mainnet deployment occurred. The review used local builds, LiteSVM, independent integer models, randomized state sequences, frontend checks and focused EVM curator tests.

Earlier roundCorrovera review of the accrual and open-finding diffs→