GGOODSMASH

Security Audit 🔬

The permanent audit log. Every contract, every test, every finding — and every fix — documented honestly. No fabricated green checks; what’s listed here was run and verified.

11
contracts audited
50+
security tests
6
live contracts verified on-chain
8
findings tracked & fixed/reviewed

Audit categories

Ownership Security
  • Owner protection
  • Access controls
  • Role-based permissions
  • No privilege escalation
Zero-Amount Protection
  • Fee validation
  • Input sanitization
  • Edge case handling
  • onFees(0) patched
Unauthorized Access
  • Function protection
  • Modifier enforcement
  • Privilege escalation blocked
State Integrity
  • Balance consistency
  • Allocation splits
  • Reserve tracking
  • 30-day accrual verified
Overflow Protection
  • SafeMath usage
  • Precision handling
  • Boundary conditions
Reentrancy Guards
  • nonReentrant modifiers
  • State changes before external calls
  • No reentrancy paths
External Dependencies
  • Oracle availability
  • Feed freshness
  • Index calculations
  • Fail-closed on stale
Token Economics
  • Supply limits
  • Mint controls
  • Burn mechanisms
  • Per-wallet + per-block caps

Findings log

FIXED
CRITICAL — Zero-amount fee bypass

onFees(0) succeeded without payment. require(amount > 0) added. Patched in source; next full deploy carries it.

VERIFIED
50K volume stress test

Exact 10/40/50 splits maintained under high load. Treasury/buyback/index allocations precise.

VERIFIED
Access control matrix

All owner functions protected. Non-owners cannot mint, change allocations, or drain funds.

VERIFIED
State consistency

30-day accrual: 4.78M–5.13M points monotonic growth with crash absorption.

REVIEWED
Solvency model

BULL2x notes can pay >1x on hard rally; pool can be momentarily short — safeTransfer reverts fail-closed (can't steal other principal); treasury war chest + buyback vault = recap backstop.

PROVEN LIVE
Stale-oracle guard

Composite index reverts the whole mark on stale/zero feed — demonstrated on live testnet mocks.

PROVEN
Fee→NFT conversion

50 units × $2.50 basket mark = $12,500 vault unit NFT, attributes exact (Units/Basket Mark/Vault Value).

PROVEN
900K sUSD live stress

10/40/50 exact through live on-chain fee loop; underfunded batch correctly rejected (fail-closed, not a bug).

Note: the on-chain verified finding list is the source of truth. Anything shipped after this log is appended on the next audit pass. Nothing here is financial advice.