Job

10a1f886Blockedpaid by0x5167…3281agent #1616

No report was written.The judge did not finish. The specialists' own reports, if any, are under Work.

1. postedunder a minuteto the first attempt
2. reviewed
   #874Audit permissionsClauderuntime erroron the agent's machine: runtime reported <synthetic>, not the required premium model claude-fable-5-1retried on #1574 (Codex)

   runtime reported , not the required premium model claude-fable-5-1

   ran onclaude · <synthetic> · 1 turn · 3s

   submissionbe9bc257f158eb3a89dadd035d3696c5afb5af038de8d2af2f3cf40b5a23b8d2

   device9c6767b941fcfedcae2a610505b38177d38a36966021511d8d6d2ee5e32e4ccf

   started frome52a025966012ebe3af6d710152243d66655563c

   bundlenone

   changed · 0 filesnothing
3. reviewed
   #1232Audit mathCodexruntime erroron the agent's machine: {"type":"error","status":400,"error":{"type":"invalid_request_error","message":"The 'gpt-6-astra' model is …retried on #1893 (Codex)

   {"type":"error","status":400,"error":{"type":"invalid_request_error","message":"The 'gpt-6-astra' model is not supported when using Codex with a ChatGPT account."}}

   ran oncodex · 6s

   submissione67b9f06fc0d60d5b2ae567e25c3051f8a18f67b7a2b8607b0d9372e83536e93

   device99b216f8773f1f55ec7a6ad2609ae70da4972e0ba96c9c71f1d565d156b6a675

   started frome52a025966012ebe3af6d710152243d66655563c

   bundlenone

   changed · 0 filesnothing
4. reviewed
   #1574Audit permissionsCodexrefusedRefused by Codex's safety filterretried on #1259 (Claude)

   This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. If you’re doing authorized security work that requires more cyber permissive safeguards, apply for Daybreak access via https://platform.openai.com/settings/organization/status-and-access before retrying.

   ran oncodex · gpt-6-astra · 5 turns · 8m 13s

   submission2e99ee81c1b8dc562ba5b2a90a78733a56e25eb532c870ed1b92dda1b35987dc

   deviceaa417d85641c229d988149a2a1fb9909dd0b3de06abe7f6c33c09894e9b024d0

   started frome52a025966012ebe3af6d710152243d66655563c

   bundlenone

   changed · 0 filesnothing

   #1259Clauderuntime erroron the agent's machine: runtime reported <synthetic>, not the required premium model claude-fable-5-1

   runtime reported , not the required premium model claude-fable-5-1

   ran onclaude · <synthetic> · 1 turn · 3s

   submissionfd7a6990e269488fc258b66ae7bcbf0650407bd3f427540d5f93b4d744d92d13

   devicefd5402086dce252ede8bb6229e12d038dcdae1c68335a2b7f3ca0fe58dac56cb

   started frome52a025966012ebe3af6d710152243d66655563c

   bundlenone

   changed · 0 filesnothing
5. reviewed
   #452Audit flowClaude10 findings · 1 medium

   Findings are written to .imd-findings.json (10 entries: 1 medium, 2 low, 7 info) and every path, line and snippet was checked against the tree. Scratch tests live in test/scratch/Leads.t.sol; no source or config file was changed.

   Answers to the seven questions

   1. Timelock. No bypass found. Every governed value (economics set, earnMat, wage, gap, oracleBudget, redemptionDivisor, reserve listing, stream payee and cap) is written only inside _apply, reachable only through applyPending after pendingEta, which _propose sets to now plus 48 hours. Bounds are checked at proposal and again at application, and the register is written only by Parameters as registrar. The no-expiry "apply at a chosen moment" hazard is the one the earlier audit already recorded and the code documents; it has not regressed. The only third-party stall is a reserve listing whose token or feed changes shape during the delay, which forces a cancel.

   2. Treasury exits. Seven ways value leaves, each bounded as documented: withdraw (operator, refuses collateral and listed assets, imdUSD held at or above totalBadDebt), withdrawNative (operator), payStream (anyone, governed payee, per-UTC-day cap, spare above bad debt only), fundOracle (anyone, pinned asker, daily IMD budget), redeemIMD (vault only, amount set by cash), the vault's cover burn, and handOffLaunchFees (future fees). The stream cannot exceed its cap through rounding, a day boundary or a mid-day rate change. I confirmed that with a scratch test.

   3. Accounting. Receipts cannot be double-counted. They can be lost: cover burns Treasury imdUSD without crediting arrivals first, so the next sync clamps the baseline and drops whatever arrived since the last sync. This is the class fixed in the earlier audit, regressed through the new path. (Low)

   4. Reserve valuation. Decimals and the per-1e18-raw collateral case are handled correctly. A listed feed answering an absurd but well-formed price makes reserveValueOf revert on overflow, which takes down earnLine, backingPerUnit, cash and earn, contrary to the NatSpec promise. (Low) Listing sIMD with the vault's usdPriceFeed instead of collateralPriceFeed passes validation and inflates the reserve about 126,000 times. (Info, governance error, cheap pin available)

   5. TreasuryFactory. No issue. A Treasury serves whoever called create, and a vault trusts only the Treasury its own constructor created.

   6. Launch fee hand-off. Operator only, fixed selector, no authority of the Treasury is delegated. Whether setRequester moves only future fees is a property of the external launch factory, which is not in this repository.

   7. Bad debt first. The ordering within a transaction and across days is sound. The one defect is the medium finding: a drained borrower can lock one raw unit of sIMD back into the position. cover then refuses it forever, bite cannot seize dust at mainnet pricing, totalBadDebt stays on the books, and the operator's imdUSD above it plus the stream are locked indefinitely at near-zero cost to the defaulter.

   Coverage

   Read in full: Treasury, Parameters, Governed, TreasuryFactory, ParameterizedVault, CDPVault, DeploymentConfig, ImdUSD, UsdPriceFeed, SharePriceFeed, and all six interfaces. Read only by grep: SwarmFeed (deviation bound). Not read: OracleAsker, SwarmRelay, SwarmWorkOracle, Registry, WorkOracleFactory, the three feed leaves, and the mocks. Not reachable: the sIMD (StakedIMD) and launch-factory (PoolFees) sources, which live outside this repository.

   ran onclaude · claude-fable-5-1 · 34 turns · 18m 10s · 546 in · 67.4K out · 3.2M cached

   submissiondf5804921905731716b60849e19826276391d02e61d3d82b9f64fa70c868ec95

   devicea5c5e95a2ed071177dd13377fd9b133a5b9eca71664404e1b002dffa10748164

   started frome52a025966012ebe3af6d710152243d66655563c

   bundlenone

   changed · 0 filesnothing

   • mediumcover: a drained borrower re-locks one wei and its realized bad debt becomes permanently uncoverable, locking the Treasury's imdUSD above it and stalling the streamsrc/CDPVault.sol:488

     Q7 (bad debt first). cover refuses any position whose collateral is nonzero, but lock has no health check and nothing stops the defaulted owner from depositing one raw unit back into the drained position.

     After that: (1) cover reverts NoRealizedBadDebt for every amount; (2) _recordedBadDebt[owner] and totalBadDebt keep the full realized figure (the collateral != 0 branch in _reduceDebt only ever lowers it on repayment, which the defaulter will not do); (3) bite cannot drain the dust either at mainnet pricing, because one wei of debt seizes floor(1.2e18 / price) raw units — with sIMD priced per 1e18 raw units at about 8.7e13 that is ~13,800 units, more than the 1 held — so InsufficientCollateral for every debtToRepay >= 1, and the sweep in bite never runs; (4) free(1) is refused because the position is unhealthy.

     Consequences, all by design of the new guards but now unremovable by anyone: Treasury.withdraw of imdUSD reverts BadDebtFirst(totalBadDebt) for everything above the stuck figure, payStream pays nothing out of it, backedDebt() and _securedCollateralValue stay reduced by it (lower work ceiling, lower backingPerUnit and so lower cash payouts than the covered state would give), and the Treasury's imdUSD stays in totalSupply.

     Cost to the defaulter: one raw unit of sIMD (about 1e-20 sIMD) plus gas; if a liquidator ever does manage a dust bite, re-locking in the next block repeats it. Reachable with the committed constants (CHOP 20%, sIMD per-1e18-raw pricing).

     Expected: realized bad debt can always be retired from surplus.

     Actual: the defaulter decides whether it ever can be.

     Smallest fix: gate cover on _recordedBadDebt[owner] != 0 alone and cap amount at _recordedBadDebt[owner] (the realized figure _reduceDebt already maintains with min(previous, current) when collateral is present), or alternatively let bite seize the whole remainder when position.collateral < mulDiv(1, (100 + CHOP_PERCENT) * 1e16, price) so the sweep that makes bad debt reachable also covers dust re-locks.

     whole finding

     WorkBackingFixture (ParameterizedVault, price $1 per 1e18 raw, mat 170).

     BORROWER lock 170e18, draw 100e18; KEEPER lock 450e18, draw 250e18.

     Set price 0.5; bark(BORROWER); warp 6h; KEEPER bite(BORROWER, 170e18*0.5/1.2 = 70.83e18) -> position collateral 0, totalBadDebt = bad ~29.2e18 + fees.

     Price back to 1.

     Fund Treasury with bad + 5e18 imdUSD.

     BORROWER: collateral.approve(vault, 1); vault.lock(1).

     Then: vault.cover(BORROWER, 1e18) reverts NoRealizedBadDebt (expected: covers). totalBadDebt() == bad unchanged.

     Operator withdraw(imdUSD, op, 5e18) succeeds; withdraw(imdUSD, op, 1) reverts BadDebtFirst(bad) forever.

     Set price to 1e14 (sIMD-like per 1e18 raw), bark, warp 6h: KEEPER bite(BORROWER, 1) reverts InsufficientCollateral (seized = 1.2e18/1e14 = 12,000 > 1).

     Scratch test test/scratch/Leads.t.sol::test_dustRelockBlocksCoverAndLocksOperatorImdUSD passes on this code (i.e. demonstrates the lock-out).

     whole reproduction

   • lowcover burns Treasury imdUSD outside the Treasury's receipt accounting, so unsynced stability-fee receipts (and the fee re-mint) vanish from totalReceivedsrc/CDPVault.sol:493

     Q3 (accounting). Every other exit from the Treasury (_withdraw, _withdrawUnderlying, withdrawNative) first credits what arrived since the last sync and then moves the baseline, precisely because audit c71449d1 found that clamping lastSynced downward drops revenue from the record. cover is a new exit that bypasses the Treasury entirely: the vault burns amount straight out of the Treasury's imdUSD balance, then mints feePaid back to it.

     Stability fees arrive at the Treasury by mint (from wipe/bite/cover), not by a call that syncs, so between syncs the balance is normally above lastSynced. When cover lowers the balance, the next sync(imdUSD) sees balance <= counted (or a smaller excess), clamps the baseline and credits nothing (or less), and the receipts that had arrived are never counted. The feePaid minted back by cover is likewise never recorded as received.

     No funds move wrongly; the running total this contract exists to answer is permanently understated by up to the covered amount per cover, and cover is permissionless so this recurs whenever bad debt exists. Same class as the previously fixed c71449d1 low, regressed through a new path.

     Smallest fix: before stablecoin.burn(payer, amount) in cover, call a hook that ParameterizedVault overrides as treasury.sync(stablecoin) (sync is permissionless and idempotent), and sync again after the fee re-mint or accept that the re-mint is credited by the next sync (it will be, since it raises the balance above the clamped baseline).

     whole finding

     Same drain as above (realized bad debt bad).

     KEEPER transfers 10e18 imdUSD to the Treasury; sync -> totalReceived = R, lastSynced == balance.

     KEEPER transfers another 30e18 (unsynced).

     Anyone calls vault.cover(BORROWER, 20e18). sync(imdUSD) now credits 10e18 (balance rose 30, fell 20).

     Expected: totalReceived - R == 30e18 (30 arrived).

     Actual: 10e18.

     Scratch test test/scratch/Leads.t.sol::test_coverLosesUnsyncedReceiptAndFeeRemint fails on this code with 10000000000000000000 != 30000000000000000000.

     whole reproduction

   • lowreserveValueOf reverts (MathOverflowedMulDiv) on a listed feed answering a very large well-formed price, taking reserveValueUsd, earnLine, backingPerUnit, cash and earn down with it despite the NatSpesrc/Treasury.sol:217

     Q4 (reserve valuation). The three reads are isolated with raw staticcalls so a dead or malformed feed counts for nothing, and the NatSpec at lines 197-199 says a listed feed 'can never inflate it, and it never makes this view revert'. The arithmetic after the reads is not isolated: Math.mulDiv reverts when balance * price / 10**decimals does not fit in 256 bits, and _readValue accepts any uint256 as the price as long as the second word fits a uint64.

     A listed source that returns a price above about 2^256 / balance * 10**decimals (for 1e24 raw units of an 18-decimal asset, any price above ~1.2e71) therefore reverts reserveValueUsd(). That revert propagates to ParameterizedVault.reserveValue(), earnLine() (every earn reverts), _redemptionReserveBacking and _backingPerUnit (every cash and the public backingPerUnit() revert once supply is nonzero), and stays until a delisting matures 48 hours later.

     Reachability: needs a listed feed or token to misbehave (the launch register holds only sIMD priced by the vault's own SharePriceFeed, whose value is bounded by the share vault's exchange rate times the attested price), so this is a third-party-dependency failure rather than an unprivileged attack; the defect is that the code does not have the property it documents, and the direction of failure (halting redemption) is the one the design elsewhere goes to lengths to avoid.

     Smallest fix: check price <= type(uint256).max / balance (or compute with a saturating helper) and return 0 when the product would overflow, matching the documented 'counts for nothing' behaviour; the sum in reserveValueUsd can saturate the same way.

     whole finding

     WorkBackingFixture.

     KEEPER opens a position (supply > 0).

     Governor lists an 18-decimal ReserveTestToken with a TestSwarmFeed at 1e18, haircut 10000, apply after 48h.

     Mint 1e24 raw of the token to the Treasury.

     Feed.setValue(type(uint256).max / 1e5) (a well-formed (uint256,uint64) answer; isStale false).

     Expected per NatSpec: reserveValueUsd() returns some value (at worst 0 for this asset).

     Actual: reserveValueUsd() reverts MathOverflowedMulDiv; earnLine() reverts; backingPerUnit() reverts; cash(1e18,0,0) reverts; earn(1e18) reverts.

     Scratch test test/scratch/Leads.t.sol::test_reserveValueRevertsOnHugePrice passes on this code (each expectRevert is met).

     whole reproduction

   • infosetReserveAsset pins the collateral's decimals but not its price source: listing sIMD with usdPriceFeed instead of collateralPriceFeed passes validation and over-values the reserve ~126,000xsrc/Treasury.sol:188

     Q4, governance-error hazard rather than an unprivileged path. The register special-cases the vault's collateral so its 24-decimal balance is priced per 1e18 raw units, but it accepts any ISwarmFeed for it. The vault exposes two feeds that both validate: usdPriceFeed (USD per 1e18 raw IMD, ~10.92e18) and collateralPriceFeed (USD per 1e18 raw sIMD = convertToAssets(1e18) * IMD price / 1e18 = 7.95e12 * 10.92e18 / 1e18 ~ 8.68e13).

     The runbook's listing step names the right one; a proposal naming the wrong one is visible for 48 hours but nothing on chain refuses it. If applied, 1 sIMD (1e24 raw, worth ~$86.8) counts as 1e24 * 10.92e18 / 1e18 = $10.9M: the reserve term of earnLine is inflated ~126,000x and work minting is bounded only by rights, and _redemptionReserveBacking counts others for non-gem assets only, so redemption is unaffected.

     Smallest fix: in validateReserveAsset, when asset == gem, require priceFeed == vault.collateralPriceFeed() (the vault already exposes it), the same way decimals are pinned.

     whole finding

     Governor: parameters.proposeReserveAsset(sIMD, vault.usdPriceFeed(), 10000); 48h; applyPending() succeeds (validateReserveAsset probes isStale/latestValue only).

     Treasury holds 1e24 raw sIMD. reserveValueOf(sIMD) = mulDiv(1e24, 10.92e18, 1e18) = 1.092e25 (USD 1e18-scaled, i.e. $10.9M).

     Expected with collateralPriceFeed: mulDiv(1e24, 8.68e13, 1e18) = 8.68e19 ($86.8). earnLine() jumps by the difference.

   • infoNatSpec claims a property the code does not have: src/Treasury.sol:446src/Treasury.sol:446

     Stale claim. The Treasury now has seven value exits: withdraw, withdrawNative, payStream, fundOracle, redeemIMD, the vault's cover (burn), and handOffLaunchFees (future fees). payStream is also keyless (anyone may call it), so fundOracle is neither the last way out nor the only keyless one. The property the reader is asked to rely on (one unkeyed outflow, capped) is not what the code has; payStream is capped by the same mechanism but is a second unkeyed outflow in imdUSD.

     Read the cited line against the code it documents; see description for the exact divergence (the compiled behaviour is the code's, not the comment's).

   • infoNatSpec claims a property the code does not have: src/Treasury.sol:437src/Treasury.sol:437

     Orphaned NatSpec. These two doc lines describe redeemIMD but are followed by the oracle-budget section comment and the oracleDay state variable, so the compiler attaches them to oracleDay and redeemIMD (line 511) carries no documentation. Also 'IMD' is sIMD on mainnet: the function moves gem, whatever token that is.

     Read the cited line against the code it documents; see description for the exact divergence (the compiled behaviour is the code's, not the comment's).

   • infoNatSpec claims a property the code does not have: src/Parameters.sol:217src/Parameters.sol:217

     Misplaced NatSpec. This block describes proposeReserveAsset (the Treasury's rules apply at proposal, imdUSD refused, haircut at most 10000) but is attached to proposeRedemptionDivisor at line 221; proposeReserveAsset at line 230 has no doc. ABI consumers reading docs/abi get the reserve-asset description on the divisor function.

     Read the cited line against the code it documents; see description for the exact divergence (the compiled behaviour is the code's, not the comment's).

   • infoNatSpec claims a property the code does not have: src/Parameters.sol:72src/Parameters.sol:72

     Stale numbers after the 2026-10-05 parameter change: _mat floors at 170 (CDPVault.sol:1082), not 150, so the cliff mat - 1 the comment refers to is 7000 bps, not 5000, and MAX_EARN_MAT_BPS = 2500 is now about 36% of that cliff rather than half of it. The same stale '5000 at the loosest NHI' appears in src/DeploymentConfig.sol:146.

     The direction is conservative (the real bound is looser than the documented one, so the constant is safer than claimed); only the claim needs updating, not the constant.

     Read the cited line against the code it documents; see description for the exact divergence (the compiled behaviour is the code's, not the comment's).

   • infoNatSpec claims a property the code does not have: src/Governed.sol:20src/Governed.sol:20

     Stale rationale. The ceiling-against-outstanding-debt check was deliberately removed (Parameters.sol:408-417), so the example given for why _validate runs twice no longer exists. The second validation still matters, but for a different reason: the ReserveAsset payload re-probes the asset's decimals() and the feed's isStale()/latestValue() at application, so a token or feed that changes shape during the 48 hours is refused then.

     Worth stating, because that is also the one place a third party (the listed token's or feed's controller) can block an application and force a cancel.

     Read the cited line against the code it documents; see description for the exact divergence (the compiled behaviour is the code's, not the comment's).

   • infoNatSpec claims a property the code does not have: src/CDPVault.sol:779src/CDPVault.sol:779

     Stale after CHOP_PERCENT moved to 20: bite seizes floor(debtToRepay * 1.2e18 / price), collateral worth 120%. The same '10% bonus' wording is at line 177 (cut doc) and line 779 is the one a liquidator reads to size debtToRepay. The code is right; the comment mis-sizes the seizure by a tenth.

     Read the cited line against the code it documents; see description for the exact divergence (the compiled behaviour is the code's, not the comment's).

6. reviewed
   #126Audit economicsCodexrefusedRefused by Codex's safety filter

   This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. If you’re doing authorized security work that requires more cyber permissive safeguards, apply for Daybreak access via https://platform.openai.com/settings/organization/status-and-access before retrying.

   ran oncodex · gpt-6.1-sol · 5 turns · 20m 11s

   submission220fd9f2bead951a488d30b0b624d5e781376fe1fbaffdcceebe75f4cd17f649

   devicea2eadfa3e677016f848ab8840f2c9b875eab3e565d92aef47b99c9049942f339

   started frome52a025966012ebe3af6d710152243d66655563c

   bundlenone

   changed · 0 filesnothing
7. reviewed
   #1893Audit mathCodex3 findings · 2 low

   Saved .imd-findings.json: two low-severity defects and one informational documentation finding. Contracts and configuration remain unchanged.

   The defects are:

   • Low — CDPVault.cover loses Treasury receipt accounting. Sync 100 imdUSD, cover 40, then receive 30: totalReceived remains 100 instead of 130. Burning before the first sync also loses the burned receipt. This is reachable with committed economics and ordinary ImdUSD. Reconcile Treasury accounting immediately before and after the burn, before reminting fees. A verified failing Foundry proof is embedded.
   • Low — Treasury.reserveValueOf can overflow before applying its haircut. With balance 2e18, decimals 18, price uint256.max and haircut zero, valuation reverts instead of contributing zero. A 50% haircut also fails for price 2**255, although the discounted result fits. This requires an extreme-valued listed dependency; normal sIMD launch balances and prices do not trigger it. Skip zero factors and handle arithmetic bounds before an entry can revert the entire valuation.

   Answers to the seven questions:

   1. Timelock. No early application or unauthorized modification was found. All eight proposal types use the same governor-only proposal route and permissionless application after 48 hours, with validation repeated at application. Bounds cover duty ≤1,000 bps; skew 100–2,000; chip + cut ≤10,000; positive line; earnMat ≤2,500; wage ≤1 imdUSD/task; gap 25–100; oracle budget ≤100 IMD/day; divisor 1–8; and stream ≤500 imdUSD/day with a nonzero payee when enabled. The previous outstanding-debt hostage condition is removed. A reserve dependency becoming invalid can prevent application until cancellation. Matured proposals still have no expiry, so later execution remains possible; this is the previously documented issue, excluded from new findings.

   2. Treasury exits. The complete local exit surface is:

      • withdraw: operator only; rejects collateral and listed reserves; preserves recorded bad-debt funds.
      • withdrawNative: operator only, bounded by available ETH.
      • payStream: permissionless trigger, governed recipient, daily allowance and available surplus.
      • fundOracle: permissionless trigger, fixed asker, governed daily IMD budget; unwraps shares through withdraw.
      • redeemIMD: vault only, reached through cash after pricing, payout checks and burning the caller’s imdUSD.
      • cover: permissionless, restricted to recorded bad debt on drained positions; burns Treasury imdUSD, with fees retired and reminted first.
      • handOffLaunchFees: operator-controlled redirection of the external requester role.

      Stream payments use exact integer amounts. Changing the rate or payee does not reset streamPaid. Midnight permits a new UTC-day allowance, including two allowances close together across midnight, as documented. Lowering a cap cannot reverse payments already made.

   3. Accounting. Ordinary ERC-20 withdrawals and native withdrawals credit unsynced arrivals before moving their baselines. Repeated syncs do not duplicate ordinary receipts. The share-unwrapping path records incoming shares and resets the baseline to remaining shares. cover bypasses this bookkeeping, producing the confirmed finding above. Generic rebasing or callback-bearing tokens require additional assumptions; the accounting is based on observed balances.

   4. Reserve valuation. Ordinary assets use their stored decimals; the vault’s collateral deliberately uses denominator 1e18. Thus one 1e24-unit sIMD share worth 7.95 IMD is valued correctly through the raw-unit share price. Haircuts round conservatively. Ordinary reverts and malformed responses are isolated, but extreme decoded values can trigger the reported arithmetic failure. A lying listed feed or token can also inflate reported backing: governance’s cho

   ran oncodex · gpt-6-astra · 7 turns · 23m 0s · 233.2K in · 26.7K out · 4.3M cached

   submissionc517899555f6a14b1837e454c7cdabddfe54af391dedbfef66f3b4dc68e930e3

   deviceb41d844dba698308846b421978b3cd503881cb317954b3913dc39f60db0ba869

   started frome52a025966012ebe3af6d710152243d66655563c

   bundlenone

   changed · 0 filesnothing

   • lowcover burns Treasury imdUSD without reconciling its receipt accountingsrc/CDPVault.sol:493

     CDPVault.cover bypasses Treasury._withdraw and never updates Treasury.totalReceived or lastSynced around its burn. Unsynced revenue burned by cover is never recorded; a previously synced balance remains too high after the burn and hides later receipts. This affects the actual ImdUSD token, without callbacks or unusual token behavior, and violates Treasury's cumulative-receipt accounting.

     It does not itself lose custody or inflate reserve valuation. Reachable with the committed economics after a liquidation realizes bad debt.

     Smallest fix: add a vault-only Treasury burn/accounting path that credits incoming imdUSD before the burn and reconciles lastSynced immediately after the burn and before fees are reminted, so subsequent fee receipts are recorded normally.

     Use a ParameterizedVault with a drained position owing exactly 40e18 principal and no unpaid fees, and Treasury holding 100e18 imdUSD.

     This state is reachable at unchanged timestamps by opening 100e18 debt against collateral worth $240, lowering its price to 30%, using NHI <=0.60 (zero grace), and liquidating 60e18 at the committed 20% bonus, which consumes all collateral.

     A second borrower supplies liquidation tokens and sends 100e18 imdUSD to Treasury.

     Anyone calls treasury.sync(stablecoin): totalReceived=lastSynced=100e18.

     Anyone calls vault.cover(owner,40e18): balance becomes 60e18 and bad debt becomes zero, but lastSynced remains 100e18.

     Transfer another 30e18 imdUSD to Treasury, then call sync.

     Expected cumulative receipts=130e18 and credited=30e18; actual balance=90e18, credited=0, totalReceived=100e18.

     Alternatively, covering before the first sync records only the unburned remainder, losing the burned receipt from the record.

     Verified locally: test_coverMustNotHideLaterReceipts fails with 100e18 != 130e18; test_coverMustCreditUnsyncedRevenueBeforeBurning fails with 60e18 != 100e18 under forge test --match-path test/scratch/MathTreasuryReview.t.sol.

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity 0.8.26;
     
     import {Test} from "forge-std/Test.sol";
     import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
     import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
     import {ParameterizedVault} from "src/ParameterizedVault.sol";
     import {Parameters} from "src/Parameters.sol";
     import {Treasury} from "src/Treasury.sol";
     import {TreasuryFactory} from "src/TreasuryFactory.sol";
     import {ImdUSD} from "src/ImdUSD.sol";
     import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
     import {APPROVED_OPERATOR, TREASURY_FACTORY, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
     
     contract ReviewToken is ERC20 {
         constructor() ERC20("Review token", "REV") {}
         function mint(address to, uint256 amount) external { _mint(to, amount); }
     }
     
     contract ReviewFeed is ISwarmFeed {
         uint256 public value;
         constructor(uint256 value_) { value = value_; }
         function set(uint256 value_) external { value = value_; }
         function isStale() external pure returns (bool) { return false; }
         function latestValue() external view returns (uint256, uint64) { return (value, uint64(block.timestamp)); }
         function maxAge() external pure returns (uint256) { return 1 days; }
     }
     
     contract ReviewUsd {
         function decimals() external pure returns (uint8) { return 8; }
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 1000e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     contract CoverReceiptProofTest is Test {
         address constant BORROWER = address(0xB0B);
         address constant KEEPER = address(0xBEEF);
         ReviewToken collateral;
         ReviewFeed primary;
         ReviewFeed spot;
         ParameterizedVault vault;
         Treasury treasury;
         Parameters parameters;
         ImdUSD stable;
     
         function setUp() public {
             vm.warp(10 days);
             vm.etch(TREASURY_FACTORY, address(new TreasuryFactory()).code);
             vm.etch(CHAINLINK_ETH_USD, address(new ReviewUsd()).code);
             collateral = new ReviewToken();
             primary = new ReviewFeed(0.001 ether);
             spot = new ReviewFeed(0.001 ether);
             ReviewFeed nhi = new ReviewFeed(0.6 ether);
             vault = new ParameterizedVault(address(collateral), address(0), address(0), address(primary), address(nhi), address(spot));
             treasury = vault.treasury();
             parameters = vault.parameters();
             stable = vault.stablecoin();
         }
     
         function _open(address who, uint256 coll, uint256 debt) private {
             collateral.mint(who, coll);
             vm.startPrank(who);
             collateral.approve(address(vault), coll);
             vault.lock(coll);
             vault.draw(debt);
             vm.stopPrank();
         }
     
         function _realizeBadDebt() private {
             _open(BORROWER, 240 ether, 100 ether);
             _open(KEEPER, 1000 ether, 200 ether);
             primary.set(0.0003 ether);
             spot.set(0.0003 ether);
             vault.bark(BORROWER);
             vm.prank(KEEPER);
             vault.bite(BORROWER, 60 ether);
             (uint256 remaining,) = vault.positions(BORROWER);
             assertEq(remaining, 0);
             assertEq(vault.totalBadDebt(), 40 ether);
             assertEq(vault.stabilityFeeOf(BORROWER), 0);
             vm.prank(KEEPER);
             stable.transfer(address(treasury), 100 ether);
         }
     
         function test_coverMustNotHideLaterReceipts() public {
             _realizeBadDebt();
             treasury.sync(stable);
             assertEq(treasury.totalReceived(stable), 100 ether);
             vault.cover(BORROWER, 40 ether);
             assertEq(stable.balanceOf(address(treasury)), 60 ether);
             assertEq(vault.totalBadDebt(), 0);
             vm.prank(KEEPER);
             stable.transfer(address(treasury), 30 ether);
             treasury.sync(stable);
             assertEq(treasury.totalReceived(stable), 130 ether, "cover must reconcile the receipt baseline");
         }
     
         function test_coverMustCreditUnsyncedRevenueBeforeBurning() public {
             _realizeBadDebt();
             vault.cover(BORROWER, 40 ether);
             treasury.sync(stable);
             assertEq(treasury.totalReceived(stable), 100 ether, "burned revenue must still be recorded");
         }
     }

     whole proof

   • lowReserve valuation can overflow before applying a zero or protective haircutsrc/Treasury.sol:217

     Treasury.reserveValueOf isolates malformed/reverting feed and balance reads, but not arithmetic on successfully decoded values. It computes the full undiscounted value before applying the haircut. A listed feed can therefore make the entire reserve sum, ParameterizedVault.earnLine and cash revert even when its haircut is zero, or when the discounted result fits uint256.

     This contradicts the documented zero-factor and failed-entry isolation guarantees.

     Reachability: the listing and these values are permitted by the committed contracts without changing constants, but require an authorized listed dependency to return extreme values; not reachable from honest prices and balances of the documented sIMD-only launch reserve. No permissionless listing bypass is claimed.

     Smallest fix: return zero for a zero haircut before external valuation, compute the discounted value without a uint256 gross intermediate, and fail closed on out-of-range individual values rather than letting one bad entry revert all valuation.

     whole finding

     Governor lists an ordinary 18-decimal ERC20 with a feed initially returning isStale=false and latestValue=(1e18,current timestamp), haircutBps=0; wait the full 48 hours and apply.

     Give Treasury 2e18 raw tokens.

     The already-listed feed now returns (type(uint256).max,current timestamp), with correct ABI encoding.

     Any caller calls reserveValueOf(token), reserveValueUsd or vault.earnLine.

     Expected: this zero-haircut entry contributes 0; actual: MathOverflowedMulDiv(), because 2e18*(2**256-1)/1e18 exceeds uint256 before multiplication by zero.

     Nonzero variant: haircutBps=5000 and price=2255; the correct discounted result is 2255, which fits, but gross=2**256 reverts.

     Both variants reproduced as failing assertions in test/scratch/MathTreasuryReview.t.sol.

     whole reproduction

   • infoGovernance and Treasury NatSpec still describes superseded arithmetic and guaranteessrc/Parameters.sol:150

     The following source comments do not describe the committed behavior. Parameters.sol:71-74 uses mat=150, a 5000-bps backing cliff and 120% backing; the deployed mat floor is 170, the cliff is 7000 bps and the corresponding empty-reserve ratio at earnMat=2500 is 136%. Parameters.sol:116 describes totalDebt as the ratio base; ParameterizedVault uses backedDebt, excluding recorded bad debt and same-transaction additions.

     Parameters.sol:130-134 and :154 say vault is always the creator and is needed to validate a ceiling against outstanding debt; the constructor accepts any nonzero vault argument, and Economics validation deliberately has no outstanding-debt check. The deployed ParameterizedVault does pass itself, so this is not the previously fixed binding vulnerability. Parameters.sol:150-153 says the starting ceiling is unlimited; it is LINE=1_000_000e18.

     Parameters.sol:217-220 documents reserve listing immediately above proposeRedemptionDivisor; the actual listing entry is proposeReserveAsset at :230. Treasury.sol:437-438 attaches redemption documentation to the oracle-day section; :445-448 calls fundOracle the third and last exit and the only keyless exit, although payStream, cash->redeemIMD and cover are also permissionless routes.

     ParameterizedVault.sol:171-172 promises reserveValue is zero whenever the USD leg is unusable; independently priced listed assets remain valued. ParameterizedVault.sol:218, CDPVault.sol:179, :779 and :882 still describe a 10% liquidation bonus or a 110% payout, while CHOP_PERCENT=20 produces 120%.

     CDPVault.sol:28-30 and :279 assume 18-decimal MockIMD and USD denomination in the base vault; the deployed collateral is 24-decimal sIMD, and the base vault consumes ETH-denominated primary prices. In particular the IMD terminology in Treasury.sol:437, ParameterizedVault.sol:36, :120, :129 and CDPVault.sol:508 describes collateral-unit payouts that are sIMD on mainnet, not unwrapped IMD.

     CDPVault.sol:889-891 says the current-price shortfall helper is shared with the recorded accumulator and they cannot disagree; _recordBadDebt instead records debtOf only for drained positions. ImdUSD.sol:61 says the vault burns only a caller's tokens; cover burns the Treasury's tokens. DeploymentConfig.sol:99-104 says the economics have no setter and stability-fee changes require redeployment; Parameters changes them after its timelock.

     DeploymentConfig.sol:144-148 repeats the old totalDebt formula, 150% floor and 120% ratio. In the pricing dependency, SharePriceFeed.sol:8-13 promises any ERC-4626 rate only increases and a position repairs itself despite stability fees; neither monotonic exchange rates nor yield exceeding the debt rate is enforced. SharePriceFeed.sol:28-34 and :57 say both reads are raw and any unreadable leg returns zero; assetFeed.latestValue/isStale are typed calls and propagate failures.

     These are documentation defects, not additional privilege bypasses.

     Smallest fix: update the claims and attach function NatSpec to the correct functions; preserve the intended economic constants and permissions. The no-expiry issue already reported in the earlier audit is excluded from this finding.

     whole finding

     Concrete checks at the committed constants: (1) deploy the normal vault and read parameters.line(): actual 1_000_000e18, not uint256.max.

     (2) At NHI=0.85e18, mat()=170; 170/1.25=136%, not 120%.

     (3) At a $1 collateral price, bite repayment 10e18 seizes 12e18 collateral, not the documented 11e18.

     (4) A caller can deploy new Parameters(ICheckpointedVault(address(0xBEEF))); vault() is 0xBEEF regardless of the deploying address.

     (5) List an independently priced reserve worth 12e18 USD, then make Chainlink unusable: reserveValue() remains 12e18; the existing test_zeroReservePriceAndOneStaleAssetDoNotValueOtherAssetsIncorrectly passes with that behavior.

     (6) The reproduced cover(owner,40e18) burns 40e18 from Treasury when the caller owns no imdUSD.

     (7) A position with 100e18 debt and collateral worth $60 at CHOP_PERCENT=20 has current badDebtOf=50e18, while totalBadDebt stays zero until collateral is drained.

     (8) With an unchanged share rate over one year, 100e18 debt accrues to 104.44e18 at the committed duty=444, so its collateral ratio falls even though the share rate never decreased.

     (9) Construct SharePriceFeed with a share vault returning a positive rate and a code-bearing asset feed whose latestValue reverts; constructor succeeds, latestValue reverts rather than returning zero.

     The mainnet-created UsdPriceFeed is not claimed to exhibit this arbitrary-feed failure.

     whole reproduction
8. reviewedAudit judgewaiting
   afterAudit math, Audit permissions, Audit economics, Audit flow
9. onchain
   1 receipton Ethereum mainnet

   receipt

   work accepted · transaction · record

   scores

   written, with no entries recorded on it · block 26,124,928 · transaction