Security

This page exists because a protocol that has never been audited and a protocol that has been audited and says nothing about it read identically from outside.

What was run#

On 26 August 2026, 124 agents across six dimensions, each finding then put to independent verifiers prompted to refute it rather than confirm it.

Nothing was dropped for being hard to reach. Several severities were corrected downward where the mechanism was confirmed but the consequence did not survive checking, and each of those says so in the full report.

What was fixed#

All seven reachable findings, plus one that was unreachable only by accident.

What the audit checked and found sound#

Worth recording, because a list of defects with no list of confirmed-correct reads as a code base nobody looked at properly.

• Funding scale, end to end, checked against the live devnet market rather than derived: index 600000, mark 602408, premium 40 bps, cumulative_funding 12e9 after five cranks, and the open 166.666-unit long owes exactly $2.00.
• Every vAMM helper rounds the surviving reserve with div_ceil, so the remainder always stays on the curve, and k is never rewritten.
• peard_amm conservation: booked_quote moves by exactly the vault delta on both legs, arrivals are measured post-reload so a transfer-fee mint cannot over-promise, reconcile is downward-only, and sell refuses to draw on the virtual leg.
• Every one of the hand-derived byte offsets in peard_perps, peard_vault and peard_tote was recomputed field by field against the real Borsh layout and is correct, and no site slices past the length it required.
• The receipt invariant holds across every exit: issue caps at items_held, redeem and write-off refuse to drop below receipts_issued, and roll deliberately keeps the count constant.

What is still open#

• No third-party audit. See the note at the top.
• Mainnet governance is a single hot key. init_global ran on 2026-08-26 and set admin, oracle_authority and fulfillment_authority all to 69TtCQGHCeDM2wxN8j5PFHEijq2xvGyy5utj9eKUNm3d, which is one keypair on one laptop. That key can push a price, sign a fulfilment, and change governance, and a price is the input to every settlement and every liquidation. Devnet has dedicated keys for the oracle and fulfilment roles; mainnet does not yet. Rotate with set_authorities before the first price is pushed, not after.
• Ten confirmed findings are unfixed. All ten were verified unreachable on any live cluster: five are in peard_tote, which is deployed nowhere, and the rest need a peard_vault reserve holding items, of which there are none. They are real and they are written down; they are not urgent and pretending otherwise would misrank them.
• 14 of 15 manual price attestations are hand-typed. Every surface that shows a price is required to carry a provenance badge for exactly this reason. See the oracle page.
• No leverage above 1x anywhere, deliberately, because leverage needs a funded insurance fund and a liquidator standing behind it and neither has been exercised against a position that actually went under.
• The insurance fund holds nothing. The drain above is fixed, but a fund with no money in it protects nobody.

The full report#

docs/AUDIT-2026-08-26.md in the repository, 45,000 words, with every finding carrying its file and line, a concrete failure path, a reachability verdict checked against live RPC, and a fix. It is not summarised away here; this page is the index to it.