Ethereum mainnetTransactions use real assets. Access is KYC-gated; review the legal and risk disclosures before transacting.
Review of the exact deployed Ethereum V2 contracts
Internal review. This is an internal engineering review of source, not an independent external audit, and it does not by itself authorize a production launch. It reviews the source at the baseline below, which is not necessarily identical to the code deployed on any network. Forest Road Vault is live on Ethereum mainnet; its Solana curator vault remains on devnet and BSC has its own deployment status. An open finding applies only to the product, version and deployment state named by this review. Each review's scope bounds what its clean result is worth. Nothing here is a securities-law representation; token characterization is a matter for counsel.
Scope
All 18 live Ethereum V2 proxies, their implementations and linked libraries, production roles and parameters, plus cross-contract scenarios on a fork of the exact deployed state. This was an internal finding-only review, not an external audit.
Method
Read-only live validation, clean compilation, complete serialized fork population, focused deployed-address scenarios, deliberate failure controls, generated access-control and invariant partitions, storage/layout gates and manually triaged static analysis.
Reviewed baseline
Ethereum deployment block 26,006,832; review block 26,021,143; contracts/src tree 3095b3b8acac7a511b86681036f80709225d6353
An exhausted loss cascade can leave a sub-USDC-unit rounding remainder
If curator, sGROVE and senior assets are all exhausted, the bounded remainder can leave supply slightly above recognized backing and close value-sensitive operations. It transfers no value to an attacker. The owner selected an exact, funded correction worker capped at 0.01 USDC per payment, 0.10 USDC per rolling day and ten payments per day.
EV2-L1LowAccepted
Conservative protocol-fee withholding can repeat while impairment remains
Each interest receipt may withhold against the same standing impairment because the impairment stock is not consumed by the withheld fee. This can reduce protocol revenue more than the initial stock; it favors senior backing and cannot extract investor assets.
EV2-I1InformationalBy design
Strict delivery measurements can fail closed after a governed callback replacement
A future governance-installed callback that injects value inside an exact balance-delta measurement can make the operation revert. The deployed fixed modules do not do this, and replacing them requires governance with direct upgrade authority.
Result
No new Critical, High or Medium contract defect was confirmed. The review targeted the exact 18
mainnet proxy addresses, their implementation and linked-library identities, and their live role
and parameter state. It made no Solidity change and submitted no mainnet transaction.
The clean serialized fork population passed 537 tests across 69 suites with zero failures or
skips. Focused scenarios exercised lifecycle, accounting, governance and cross-contract failure
modes against the deployed addresses. Deliberate incorrect changes turned each important new test
red before the source was restored.
Live-state limit
The credit book was empty during review. Fork scenarios created facilities, capital, accrual,
defaults and losses against the deployed bytecode; they are not a claim that a real mainnet loan
had completed those events. The first real facility still needs its own reviewed signed facts and
capital.
The extreme rounding remainder and conservative fee-withholding policy remain disclosed in the
findings list. Both favor a fail-closed or senior-protective result; neither is described as fixed.
Subsequent acceptance
The same deployed implementations later completed the funded mainnet canary and the Ops Safe
jurisdiction block/unblock drill. Supply equalled backing, physical USDC equalled the idle reserve
ledger, and no implementation or role changed during those exercises.