Reference
Security findings
Three internal reviews on 2026-09-28 with proof-of-concept tests (appendix/review/).
Fixed, with regression tests
| ID | Severity | Summary | Commit |
|---|---|---|---|
| A-01 | critical | squatted series with another strike unit charged an 8x-too-small strike | 187c3e3 |
| A-02 | high | anyone could burn a live position NFT | 187c3e3 |
| A-03 | high | 1 lamport to the boost vault bricked activation | 187c3e3 |
| A-05 | high | sandwichable cover-shortfall buy drained backer SOL | 187c3e3 |
| A-07 | high | pre-funded collection address bricked activation | 187c3e3 |
| C-01 | high | direct creator-fee collection skipped backers' share | 187c3e3 |
| F-01 | high | DLMM oracle growth froze the put vault | d90aa0c |
| F-04 | medium | init_vault squatting: only INIT_AUTHORITY may create put vaults (D5) | e0ebe78 |
| (pre-launch test) | treasury buying an order-book listing failed its own fee check | f906973 |
Open
| ID | Severity | Summary |
|---|---|---|
| A-04 | medium | settle_expired can close an empty account owned by the creator PDA, halting buys until recreated |
| A-06 | low | H can be ratcheted up on an idle pool |
| F-02 | medium-high | the check pool can veto a round; the day settles on the next day's S |
| F-03 | medium | wipe-out plus a queued deposit can brick settle_day |
| F-05 | medium | settlement-read manipulation cheaper than the spec implied |
| F-06 | medium | buy reads instantaneous spot without TWAP or check pool |
| F-07 to F-11 | low-medium to info | lister trust, sale window overlap, oracle validation, Pyth selection, dust |
| C-02 to C-07 | medium | distributor unchecked, points by donation, JIT deposits, creator-PDA donation, dust repayments, mode-b write-off |
| C-08 to C-15 | low to info | backstop accounting and documentation items |
No external audit (owner decision D17).