External review. This review was conducted by a party other than Forest Road. What the engagement did and did not cover is set out under Method and in the report itself, the limits of a review bear on what its findings are worth, and should be read alongside them. It does not by itself authorize a production launch. It reviews the source at the baseline below, which is not necessarily identical to the code deployed on any network. Forest Road Vault is live on Ethereum mainnet; its Solana curator vault remains on devnet and BSC has its own deployment status. An open finding applies only to the product, version and deployment state named by this review. Each review's scope bounds what its clean result is worth. Nothing here is a securities-law representation; token characterization is a matter for counsel.
- Scope
- The Solana curator-vault program, its tests and release tooling, the curator website paths, the canonical artifact and devnet evidence. It is not a review of the Ethereum V2 credit protocol, and no Solana mainnet deployment was in scope.
- Method
- Independent Corrovera review followed by two remediation verifications, execution probes, event and error census, stateful campaigns, committed mutation controls, reproducible-build checks and byte-for-byte comparison with the devnet ProgramData account.
- Reviewed baseline
- Initial closeout 99b0371; final remediated source b7164af; canonical devnet program 3ZPRvNDUDRZuZ8Hug873JtSDJueA8D7PEVE21uLLAvwh
- Internal report
- audit-reports/curator-vault-audit-2026-09-20/
CV-M1MediumRemediated
The served frontend revision was not bound to the reviewed commit
Production builds now require the Vercel commit identity, expose it through /api/revision and provide a release verifier. Every promotion must still run the verifier against the served domain; the control is not a claim that an arbitrary future deployment is current.
CV-M2MediumRemediated
The deployed Solana artifact was not independently reproducible from pinned inputs
The release uses a digest-pinned solana-verify container, explicit SBF v3 and platform-tools v1.57. The committed 475,824-byte ELF is bound to source and IDL hashes and matches the active devnet ProgramData bytes, including zero trailing allocation bytes.
CV-M3MediumRemediated
The program test campaign and mutation evidence did not support its assurance claims
The final suite covers all 25 instructions, 38 errors and every field of 23 events. Its stateful campaign records outcomes and reaches withdrawals; nine compiled program mutations each fail both a directed regression and the campaign before pristine restoration.
CV-M4MediumRemediated
A screened position could continue receiving coupons until multisig action
A one-way emergency authority may pause deposits and draws or halt one position's coupon payout immediately. It cannot clear a halt, move principal, rotate authority or perform administrative actions; clearing remains with the designated authorities.
CV-R1MediumRemediated
The first notice guard could lock treasury draw access for the whole position term
The guard now protects only the exit window: committed principal remains drawable while its contractual lock is live, and a pending notice refuses new draws once the lock deadline opens the curator's protected exit window.
CV-I1InformationalDeferred
Solana mainnet release remains a human and specialist-review gate
The canonical artifact is active on devnet. Counsel approval, a production 2-of-4 Squads, a separate emergency signer, specialist Solana review and the human mainnet ceremony remain required before any Solana mainnet launch.
Result
The review and its two remediation verifications closed the four confirmed Medium source and
test-assurance findings. The final package also corrected the notice/draw regression introduced by
the first remediation. No High or Medium program-source or test-assurance finding remains in the
current devnet release.
This result applies to the Solana curator vault and its website paths. It does not review the
Ethereum V2 credit contracts, and it does not authorize Solana mainnet deployment.
Evidence that changed the verdict
The final package added field-level decoding for every event, a complete instruction/error/event
surface census, a stateful campaign that records every result and reaches real withdrawals, and
compiled mutation controls that also make the campaign fail. The release build pins its container,
Solana version, SBF architecture and platform tools.
The canonical 475,824-byte ELF has SHA-256
c3f365f888cda2daf06bbf8339c7e8ea89cd090b2dac030367f346e78f3b450e. It is active on devnet at
program 3ZPRvNDUDRZuZ8Hug873JtSDJueA8D7PEVE21uLLAvwh, and the verifier matched the deployed
ProgramData bytes and published IDL exactly. State accounts remained byte-identical across the
artifact activation.
Remaining boundary
The production Vercel release must expose and verify its exact commit on every promotion. Solana
mainnet still requires counsel approval, a reviewed 2-of-4 Squads, a separately chosen emergency
signer, specialist Solana review and a human deployment ceremony.