Adversarial review record

This dated internal review was updated for the two-token candidate on 2026-07-18. It is not an independent audit or a continuously valid launch opinion.

Verdict

The candidate is suitable for independent review but is not authorized for funded mainnet markets. The replacement removes scheduled inflation and the multi-token accounting stack, materially reducing token and operational complexity. The remaining launch blockers are primarily sequencer protection, economic policy, external-token controls, supply-chain evidence, production operations, and independent audit.

Findings

STK-001 — High — Sequencer outage and recovery are not enforced onchain

Open under the signed-exception process. Production explicitly uses an unprotected PRICE implementation until an approved canonical feed exists. See the risk record. Zero markets bound deployment exposure but do not close the issue.

STK-002 — Medium — Bond minimum payout

Remediated. Deposits enforce both maximum price and minimum payout after the actual treasury balance delta and final price read. Frontend and ABI use the bounded method.

STK-003 — High — Economic parameters lack external approval

Open. The contracts enforce conservative issuance accounting but cannot guarantee realizable reserve value after correlated gaps, freezes, depegs, or illiquidity. Launch emissions are now structurally zero, removing one source of dilution. Governance must still approve stress reserve targets, concentration and liquidity limits, aggregate live unsold capacity, and drawdown actions.

STK-004 — High — External reserve-token control

Open. Robinhood tokens and USDG can have issuer-controlled pause, blocklist, supply, or upgrade surfaces. PRICE pins decimals and fails closed on metadata drift, but monitoring, counterparty diligence, exposure caps, and permanent write-down procedures remain launch gates.

STK-005 — Medium — Safe separation

Code remediation present. Deployment and verification reject shared controlling quorums, unsafe modules/guards, and unapproved fallback handlers. Real device, owner, and provider separation still requires operational evidence.

STK-006 — Medium — Independent final-state verification

Code remediation present. The view-only verifier binds live runtime hashes, configuration, controls, Safes, feeds, and token/vault wiring to the manifest from an independent RPC. A second operator still must run it after a real broadcast.

STK-007 — Medium — Configuration bounds

Code remediation present. Assets, markets, notes, prices, deviations, capacity, and payout paths are bounded. Economic parameter quality remains a human governance gate.

STK-008 — Medium — Vault rounding and donation behavior

Code remediation and tests present. StonkVault uses OpenZeppelin ERC-4626 virtual-share accounting, equal asset/share decimals, preview functions, and bounded transaction overloads. Unit, fuzz, and stateful invariant tests cover first-deposit donation attacks, rounding, conservation, revenue donations, and vote checkpoints. Independent review and standard ERC-4626 property testing remain required before launch.

STK-009 — Low — Supply chain and frontend controls

Open. CI validates contracts, rehearsals, ABI reproducibility, TypeScript, build, and browser paths. Release approval still requires pinned CI/toolchain inputs, current dependency and secret scans, artifact provenance, static-host security headers, restricted Privy/RPC configuration, and production-origin smoke tests.

STK-010 — Informational — Backing is not redemption

STONK holders cannot redeem STONK for treasury assets. stSTONK redemption returns only STONK held by StonkVault. Product copy must keep this distinction prominent.

Positive controls

• MINTR isolates and bounds issuance.
• Bond deposits use actual received balances, reentrancy protection, capacity, payout, maximum-price, and minimum-output limits.
• Invalid prices fail closed and external token decimals are pinned.
• USDG upside is capped and volatile assets receive configured haircuts.
• StonkVault has no privileged operator, scheduler, or inflation path.
• Revenue donations cannot mint supply or votes.
• Guardian shutdown/cancellation is narrower than governance execution.
• Production handoff removes deployer roles and pins protocol and Safe bytecode.

Required retest

Before freezing the release, archive current results for formatting, full tests, 10,000-run fuzzing, high-depth invariants, coverage, Slither plus a second analyzer, dependency and secret scans, Anvil lifecycle rehearsal, current mainnet fork rehearsal, ABI reproducibility, frontend build/Playwright, and production-origin wallet smoke. Record exact versions, commit, fork block, and advisory database dates.

Limitations

This internal work does not include signer/device inspection, legal or custody diligence, historical market simulation, funded public-testnet campaign, independent source audit, production mainnet deployment, DNS/CDN/Privy control review, or alert delivery. External token and feed contracts were not fully audited.