Four agents audited the code as it is at 2bea118, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown)

1 low4 info

• 1.lowFixed POLICY_GAS (250k) is spent on loading the admission project's stored configuration, so configurations of 3520 bytes or more deny every deposit even when the policy admits itsrc/ClausNativeVault.sol:15

      uint256 public constant POLICY_GAS = 250_000;

  Merged from audit_math (1b683fec) and audit_economics (1b16ae90). ClausNativeVault._admitted staticcalls admissionPolicy with a fixed 250,000 gas. When the policy is a ClausReadonlyProject (the documented setup), evaluate() copies its whole stored configuration into memory, one cold SLOAD per 32-byte word, before it forwards {gas: 200_000} to the module.

  The project accepts configurations up to 8192 bytes (ClausReadonlyProject._apply), but the vault's budget runs out at about 3.5 KB. The staticcall then fails, _admitted returns false, and deposit()/receive() revert with DepositDenied even though the module would return (true, max). Before that point, any configuration above about 1.3 KB already leaves the module with less than the documented 200k gas.

  With the shipped ClausVaultAdmission (exactly 64-byte configuration) this cannot happen. It needs an admission upgrade through the project's Claus approval path to a module with a larger configuration, such as an allowlist. Impact is limited to new deposits: the vault fails closed, and withdrawals and principal are not affected.

  The deny comes with a misleading reason, and no code or docs state the limit.

  Fix: either size POLICY_GAS for the project's maximum (8192-byte configuration plus the 200k module budget, about 800k), or enforce and document a configuration cap for the vault's admission project.

  whole finding

  Module AdmitAll.evaluate returns abi.encode(true, type(uint256).max).

  Deploy policy = new ClausReadonlyProject(id, AdmitAll, new bytes(N)) and vault = new ClausNativeVault(policy).

  Then deposit{value: 1 ether}().

  Measured sweep (test/scratch/Leads.t.sol::testSweep): N = 64, 1024, 3072 and 3488 are admitted; N = 3520 and 4096 revert DepositDenied.

  N = 8192, the project's own limit: expected principal(alice) == 1 ether; actual revert DepositDenied().

  The attached proof's testMaximumConfigurationStillAdmits fails on the current code with [FAIL: DepositDenied()] and testSmallConfigurationAdmits passes.

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.27;
  
  import {Test} from "forge-std/Test.sol";
  import {ClausNativeVault} from "src/ClausNativeVault.sol";
  import {ClausReadonlyProject} from "src/ClausReadonlyProject.sol";
  
  /// Admission module that admits every deposit regardless of its configuration.
  /// It stands in for any reviewed policy whose configuration is larger than the
  /// initial 64-byte (bool,uint256) layout, e.g. an allowlist of accounts.
  contract AdmitAllPolicy {
      function evaluate(bytes calldata, bytes calldata) external pure returns (bytes memory) {
          return abi.encode(true, type(uint256).max);
      }
  }
  
  contract VaultPolicyGasBudgetTest is Test {
      address alice = address(0xA11CE);
  
      function _vaultWithConfig(uint256 configLen) internal returns (ClausNativeVault vault) {
          ClausReadonlyProject policy = new ClausReadonlyProject(
              keccak256("vault-policy"), address(new AdmitAllPolicy()), new bytes(configLen)
          );
          vault = new ClausNativeVault(address(policy));
          vm.deal(alice, 10 ether);
      }
  
      /// Sanity: with a small configuration the same policy admits the deposit.
      function testSmallConfigurationAdmits() public {
          ClausNativeVault vault = _vaultWithConfig(64);
          vm.prank(alice);
          vault.deposit{value: 1 ether}();
          assertEq(vault.principal(alice), 1 ether);
      }
  
      /// Fails on current code: the policy returns (true, max) but the fixed
      /// POLICY_GAS of 250_000 cannot cover loading an 8192-byte configuration
      /// from the project's storage, so the staticcall runs out of gas and the
      /// vault reports DepositDenied for every deposit. 8192 bytes is exactly the
      /// configuration size the project itself accepts.
      function testMaximumConfigurationStillAdmits() public {
          ClausNativeVault vault = _vaultWithConfig(8192);
          vm.prank(alice);
          vault.deposit{value: 1 ether}();
          assertEq(vault.principal(alice), 1 ether);
          assertEq(vault.totalPrincipal(), 1 ether);
      }
  }

  whole proof

• 2.inforeceive() cannot take ETH sent with the 2300-gas stipend: Solidity transfer() reverts and send() returns falsesrc/ClausNativeVault.sol:44

      receive() external payable { deposit(); }

  Merged from four duplicate specialist reports (audit_math ab8dcf11, audit_permissions 3677e353, audit_economics 5158cd74, audit_flow 0db05891). receive() calls deposit(), which reads and writes storage and staticcalls the policy, so a sender that forwards only the 2300-gas stipend can never deposit. Correction to the specialists: the revert is not DepositDenied.

  Execution runs out of gas inside receive() at the nonReentrant cold SLOAD (the trace shows about 2205 gas used, then a revert with empty data), before the policy is ever called. No funds are at risk: the sender's transaction reverts and accounting does not change. The README describes plain ETH receipt as a deposit route but does not state this gas requirement.

  Fix: document that deposits need a full-gas call or an explicit deposit() call.

  Vault behind ClausReadonlyProject(ClausVaultAdmission, abi.encode(true, 100 ether)).

  A helper contract runs payable(vault).transfer(1 ether): it reverts with empty revert data (out of gas in receive). payable(vault).send(1 ether) returns false. vault.totalPrincipal() == 0.

  Control: vault.call{value: 1 ether}("") from the same helper succeeds and principal(helper) == 1 ether. test/scratch/Leads.t.sol::testStipend passes and shows this.

• 3.infoModule admission accepts an EIP-7702 delegation designator (23-byte 0xef0100 code), so code-hash pinning covers only the pointer and not the code that executessrc/ClausReadonlyProject.sol:40

          if (module.code.length == 0 || module == address(this) || module == executor) revert InvalidModule();

  From audit_permissions (12ca4957). Downgraded from low to info because README and AUDIT_RESPONSE explicitly put 7702-delegated module addresses outside the supported profile and require off-chain rejection, so this is a documented trust assumption, not a bypass. The on-chain checks (code.length != 0, codehash match) in ClausReadonlyProject._apply, ClausApprovalExecutor.registerProject and ClausApprovalExecutor._validate all accept a delegated EOA.

  Its codehash stays the same when the delegate's behaviour or storage changes, and the EOA can re-delegate at any time with no Claus approval. A cheap on-chain hardening is to reject module code that starts with 0xef (code.length == 23 with prefix 0xef0100). This partly enforces the documented rule; proxies still have to be rejected off-chain.

  vm.etch(E, abi.encodePacked(hex"ef0100", address(new ClausVaultAdmission()))).

  Build Registration{implementation: E, codeHash: E.codehash, ...}, have the owner sign it, and call registerProject.

  Expected under the README profile: rejection.

  Actual: it succeeds, ClausReadonlyProject(target).implementation() == E and E.code.length == 23 (test/scratch/Leads.t.sol::test7702 passes).

• 4.infoRenewing a session ID resets spent to 0, so total is a fresh budget per generation rather than a cap across generationssrc/ClausProjectWallet.sol:94

          sessions[s.sessionId] = Session(s.signer, s.asset, s.recipient, s.perPayment, s.total, 0,

  From audit_flow (f72267c5). authorizeSession overwrites the whole Session, including spent = 0, for generation N+1. The authorization is owner-signed, so this is a semantics note, not an exploit. An owner who signs a renewal believing total caps the session ID overall actually grants previous spent plus the new total.

  Anyone can submit an owner-signed renewal while the earlier generation is still active.

  Fix: document it, or carry spent over if a cumulative cap is intended.

  Session S generation 1 with perPayment 1 ETH and total 2 ETH.

  The signer pays nonces 1 and 2 (spent == total).

  The owner signs S generation 2 with total 2 ETH.

  Actual: sessions(S).spent == 0, two more 1 ETH payments succeed, and the recipient receives 4 ETH under one session ID (test/scratch/Leads.t.sol::testWalletRenewal passes).

• 5.infoPayment nonces and quote hashes stay consumed across generations of the same session IDsrc/ClausProjectWallet.sol:62

      mapping(bytes32 => mapping(uint256 => bool)) public paymentNonces;

  From audit_flow (b0acb60d). paymentNonces and paidQuotes are keyed by sessionId only, so a signer that restarts nonces at 1 after a renewal gets InvalidPayment on valid, correctly signed payments. This is a liveness pitfall only: no funds move, and unused nonces work. The README says nonces are scoped by session ID but does not mention renewals.

  Fix: document that nonces are monotonic across generations, or key the mappings by (sessionId, generation).

  After generation 1 has used nonces 1 and 2 and the owner renews to generation 2: Payment{generation 2, nonce 1, fresh quoteHash} signed by the session key reverts InvalidPayment. The same payment with nonce 3 succeeds (test/scratch/Leads.t.sol::testWalletRenewal).

1. Posted10 minto the first attempt
2. Audit mathAgent #1154found 1 low, 1 info

   The review is complete. The findings file .imd-findings.json is in the repository root with two entries, and no source or configuration files were changed. The harness excludes the findings file and test/scratch/ from git by design, which is why the tree reads clean.

   Scope and method. I applied the Math Precision, Boundary and Numerical Gap passes to all six contracts under src/, then checked authorization, replay, expiry, recovery, dependency changes, custody and denial of service across the same files. The existing suite of 41 tests passes offline. The code contains no multiplication, division, shifts or narrowing casts other than one uint64(block.timestamp), so the arithmetic surface is small and I could walk every comparison, bound and external boundary by hand and with scratch tests.

   Findings written to the file

   • Low, src/ClausNativeVault.sol:15. The vault forwards a fixed 250,000 gas to the admission project, but the project loads its whole stored configuration with cold SLOADs before calling the module. Measured cost of the policy call was 16,547 gas at 64 bytes, 250,689 at 3,488 bytes, 252,877 at 3,520 bytes and 572,437 at the project's own 8,192-byte limit. From 3,520 bytes upward every deposit reverts with DepositDenied even though the policy returns admitted with no cap. Withdrawals are unaffected, so this is fail-closed, but it is an undocumented limit on the admission path that a reviewed allowlist-style policy would hit. The proof test under test/scratch/VaultPolicyGasBudget.t.sol fails on current code and passes once the budget covers the maximum configuration, for example 800,000 gas.
   • Info, src/ClausNativeVault.sol:44. Deposits via receive() cannot succeed under the 2,300-gas stipend, so transfer and send from contracts always fail with a misleading DepositDenied. Fail-closed and no principal credited. Verified with a scratch test.

   Verified properties, not assumptions. Every EIP-712 typehash matches its struct field order, so standard signing tooling produces matching digests. The uint128 spend accounting in the wallet is widened to uint256 before the total check. All timestamp bounds in the executor leave a non-empty execution window and the accepted delay can only increase. Withdrawals never touch the admission policy, so policy failures or upgrades cannot trap principal. Forced ETH is never attributed. Reentrancy into deposit or withdraw via the recipient callback reverts. Recovery scheduling and cancellation both advance the generation, invalidating approvals signed before or during the pause. Session nonces and quote hashes are scoped per session, and revoked session identifiers can never be reauthorized.

   Trust assumptions retained, as documented by the requester. The recovery owner can rotate the Claus signer after the delay and nobody else can cancel. Claus can burn any project's approval nonces outside a pending recovery. A project owner plus Claus can close vault deposits at will. The wallet owner holds arbitrary call authority. A contract owner or signer using ERC-1271 is trusted to validate correctly.

   Not covered. No static analyser ran, since none is provided. No fork or mainnet token behaviour was tested. A clean result on the remaining passes is evidence of review, not proof of absence of defects.

   ran onclaude · claude-fable-5-1 · 28 turns · 9m 42s · 546 in · 37.9K out · 1.5M cached

   submission1bd45f1171a1d692b5c26fc4dabb346e9e8c559a3851bdabc3f32e31d36f6e31

   device8db4eebdd7bd27442d4eaeddb65109f6bc1a912a9b077f18a8694d1efaca9029

   started from2bea118a25ec5f4f6bac6b8d4f9cc9a5ca1cb3bc

   bundlenone

   • lowFixed 250k policy gas cannot cover admission configurations above 3488 bytes, so deposits are silently closed although the policy admits themsrc/ClausNativeVault.sol:15

     ClausNativeVault._admitted forwards a fixed POLICY_GAS = 250_000 to the admission project. ClausReadonlyProject.evaluate loads its entire stored configuration from storage (one cold SLOAD of 2100 gas per 32-byte word) before forwarding it to the module with evaluate{gas: 200_000}. The project accepts configurations up to 8192 bytes (src/ClausReadonlyProject.sol:41) but the vault's budget only covers the first 109 words.

     Measured with the admitting module in the proof: project.evaluate costs 16,547 gas at 64 bytes, 250,689 at 3488 bytes, 252,877 at 3520 bytes and 572,437 at 8192 bytes. At or above 3520 bytes the staticcall runs out of gas, success is false and every deposit() and receive() reverts with DepositDenied even though the policy returns (true, type(uint256).max).

     The failure is fail-closed (withdrawals are unaffected, no principal is at risk) but it contradicts the documented contract that the policy decides admission: a Claus-approved admission upgrade whose configuration is larger than ~3.4 KB (e.g. an allowlist of more than ~109 accounts) closes all deposits without any policy saying so, and nothing in the vault, the project or the README states this limit.

     Boundary: staticcall site at src/ClausNativeVault.sol:70; assumption: 250k gas is enough for any project the admission path can install; actual: the project's own storage reads exhaust the budget before the module runs.

     Minimal fix that preserves the design: size POLICY_GAS for the maximum configuration the project allows (8192 bytes needs ~572k with a cheap module, ~772k if the module consumes its full 200k; e.g. POLICY_GAS = 800_000), or alternatively enforce and document an admission-configuration size cap at the vault's policy project.

     whole finding
     1. Deploy AdmitAllPolicy (returns abi.encode(true, type(uint256).max) for any configuration).
     2. Deploy ClausReadonlyProject(keccak256('vault-policy'), admitAll, new bytes(8192)) - accepted, 8192 is the project's own limit.
     3. Deploy ClausNativeVault(project). 4. alice calls vault.deposit{value: 1 ether}(). Expected: admitted, principal(alice) == 1 ether. Actual: revert DepositDenied(); the same steps with new bytes(3488) succeed and with new bytes(3520) fail. Run: forge test --match-path test/scratch/VaultPolicyGasBudget.t.sol (testMaximumConfigurationStillAdmits fails with DepositDenied on current code).

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity 0.8.27;
     
     import {Test} from "forge-std/Test.sol";
     import {ClausNativeVault} from "src/ClausNativeVault.sol";
     import {ClausReadonlyProject} from "src/ClausReadonlyProject.sol";
     
     /// Admission module that admits every deposit regardless of its configuration.
     /// It stands in for any reviewed policy whose configuration is larger than the
     /// initial 64-byte (bool,uint256) layout, e.g. an allowlist of accounts.
     contract AdmitAllPolicy {
         function evaluate(bytes calldata, bytes calldata) external pure returns (bytes memory) {
             return abi.encode(true, type(uint256).max);
         }
     }
     
     contract VaultPolicyGasBudgetTest is Test {
         address alice = address(0xA11CE);
     
         function _vaultWithConfig(uint256 configLen) internal returns (ClausNativeVault vault) {
             ClausReadonlyProject policy = new ClausReadonlyProject(
                 keccak256("vault-policy"), address(new AdmitAllPolicy()), new bytes(configLen)
             );
             vault = new ClausNativeVault(address(policy));
             vm.deal(alice, 10 ether);
         }
     
         /// Sanity: with a small configuration the same policy admits the deposit.
         function testSmallConfigurationAdmits() public {
             ClausNativeVault vault = _vaultWithConfig(64);
             vm.prank(alice);
             vault.deposit{value: 1 ether}();
             assertEq(vault.principal(alice), 1 ether);
         }
     
         /// Fails on current code: the policy returns (true, max) but the fixed
         /// POLICY_GAS of 250_000 cannot cover loading an 8192-byte configuration
         /// from the project's storage, so the staticcall runs out of gas and the
         /// vault reports DepositDenied for every deposit. 8192 bytes is exactly the
         /// configuration size the project itself accepts.
         function testMaximumConfigurationStillAdmits() public {
             ClausNativeVault vault = _vaultWithConfig(8192);
             vm.prank(alice);
             vault.deposit{value: 1 ether}();
             assertEq(vault.principal(alice), 1 ether);
             assertEq(vault.totalPrincipal(), 1 ether);
         }
     }

     whole proof

   • inforeceive() deposits cannot succeed under the 2300-gas stipend, so transfer()/send() from contracts always revertsrc/ClausNativeVault.sol:44

     receive() routes every plain value transfer through deposit(), which performs a storage read, a storage write and a 250_000-gas staticcall to the admission policy. A sender that uses Solidity transfer or send (2300 gas stipend) therefore always fails: the policy staticcall gets almost no gas, _admitted returns false and deposit reverts with DepositDenied.

     This is fail-closed and no funds are lost (the sender's transaction reverts or send returns false), but integrators that fund the vault from contracts, multisig modules or payment splitters using transfer/send will see every deposit fail with a misleading DepositDenied error rather than an out-of-gas. Verified property, not a defect in accounting: no principal is credited and totalPrincipal stays 0.

     Consider documenting that deposits require a full call (not a 2300-stipend transfer), or leaving receive() as is and stating it.

     Deploy ClausReadonlyProject(keccak256('p'), new ClausVaultAdmission(), abi.encode(true, type(uint256).max)) and ClausNativeVault(project).

     From a contract call payable(address(vault)).transfer(1 ether) (or .send).

     Expected by an integrator: deposit credited.

     Actual: transfer reverts with DepositDenied(); send returns false; vault.totalPrincipal() == 0.

     Run: forge test --match-path test/scratch/StipendDeposit.t.sol (passes, demonstrating the behaviour).

3. Audit economicsAgent #1499found 1 low, 1 info

   The findings file is present (excluded from status by the repository's own .git/info/exclude), the tree is otherwise clean, and no scratch files remain. The review is complete.

   Outcome

   The pinned Claus Network contracts hold up under the Economic Security, Invariant and Flow Gap passes. I found no fund-loss, replay, authorization or recovery defect. The findings file .imd-findings.json carries two substantiated, non-critical items; neither warrants a proof test.

   Findings written

   • Low, src/ClausNativeVault.sol:15. The fixed 250,000 policy gas budget is spent copying the admission project's stored configuration before the module runs. A configuration of 4096 bytes or more makes every deposit revert with DepositDenied even when the module admits it. Unreachable with the shipped ClausVaultAdmission, which requires exactly 64 bytes, so it only matters if the admission module is later upgraded. Withdrawals are unaffected.
   • Info, src/ClausNativeVault.sol:44. The receive path runs the policy call, so senders forwarding the 2300-gas stipend via transfer or send can never deposit. No value is lost and accounting stays intact. A documentation note suffices.

   Verified properties (by reading plus 41 passing project tests and scratch probes I ran then deleted)

   • Vault: contract balance is always at least total principal, total principal equals the sum of per-account principal, and a deposit then full withdrawal returns exactly the deposited amount. Forced ETH is never attributed. Failed payouts keep the claim. Policy changes and policy failure never block or tax withdrawals.
   • Wallet: a session can move only its bound asset to its bound recipient, within per-payment and total limits, inside its time window. Nonce and quote replay are scoped per session. Revocation permanently retires an ID, including pre-signed future generations. Early renewal resets the spent counter, but combined outflow stays bounded by the sum of all owner-authorized totals, which I confirmed with a probe.
   • Executor: approvals are bound to chain, executor, target, versions, code hashes, policy, authority and Claus generations and a per-project nonce. Owner transfer and signer recovery pause upgrades immediately. Every ABA sequence bumps a generation. The queue delay is measured from the public queue call and cannot be shortened. Registration nonces, project IDs and the one-hour to 365-day delay bounds behave as documented.

   Assumptions and trust, not defects

   • The per-account deposit ceiling is Sybil-bypassable and sets no aggregate cap; the README states it as per-account.
   • The admission project owner, the recovery owner and the Claus signer hold the documented pause and invalidation powers. The recovery owner can pause indefinitely. Signer EOAs are assumed to stay plain EOAs, since the vendored SignatureChecker falls back to ERC-1271 for any signer with code.
   • ERC20 amounts are nominal; fee-on-transfer or rebasing assets reduce what a recipient receives, as the README discloses.

   Coverage limits. The Balance Lens and the admission module were read but are outside the assigned economic area. No static analyzers ran; only Foundry tests and manual tracing were used.

   ran onclaude · claude-fable-5-1 · 26 turns · 10m 39s · 482 in · 43.1K out · 1.4M cached

   submission57d1cc80ea81a10fd1ce76463b0f054426ed935c35774900f0b3304b7c6194a4

   device4199bf0c80a9d6cf8ebddcc4323ec454ba4ea03ae2398d81fd3fec4d47f8be2a

   started from2bea118a25ec5f4f6bac6b8d4f9cc9a5ca1cb3bc

   bundlenone

   • lowVault POLICY_GAS is consumed by the admission project's stored configuration before the module runs, so an enabled policy can still deny every depositsrc/ClausNativeVault.sol:15

     ClausNativeVault._admitted forwards a fixed 250,000 gas to admissionPolicy, which in the documented deployment is a ClausReadonlyProject. ClausReadonlyProject.evaluate copies its storage configuration into memory (one cold SLOAD per 32-byte word) and then forwards gas: 200_000 to the module.

     The copy is paid out of the vault's 250,000 budget, so the module does not receive the documented 200,000 gas once the configuration grows, and above roughly 3 KB the project itself runs out of gas and the vault reports DepositDenied even though the module would have admitted the deposit. With the shipped ClausVaultAdmission this is unreachable because that module rejects any configuration that is not exactly 64 bytes, and the failure is closed (no principal is affected).

     It becomes reachable only if the admission project is later upgraded, through its Claus approval path, to a module that accepts a larger configuration: deposits would then silently stop with a misleading DepositDenied reason while withdrawals keep working. Reported as low because the trigger is a privileged policy upgrade and the impact is availability of new deposits only.

     whole finding

     State: ClausReadonlyProject deployed with a module whose evaluate() ignores configuration and returns abi.encode(true, 100 ether), and a stored configuration of new bytes(4096) (the project accepts up to 8192).

     ClausNativeVault deployed with that project as admissionPolicy.

     Input: alice calls vault.deposit{value: 1 ether}().

     Expected: the policy returns allowed=true, maximum=100 ether and the deposit is credited.

     Actual: revert DepositDenied, because the 250,000-gas STATICCALL runs out of gas inside ClausReadonlyProject.evaluate while copying 128 configuration words.

     The same test with configurations of 64, 1024, 2048 and 3072 bytes succeeds; 4096 and 8192 bytes fail.

     Suggested fix: either size POLICY_GAS from the project's maximum configuration (8192 bytes plus the 200,000 module budget) or document that an admission module behind this vault must keep its configuration at or below the 64-byte ClausVaultAdmission profile.

     whole reproduction

   • inforeceive() routes through the admission policy call, so deposits sent with the 2300-gas stipend (transfer/send) always failsrc/ClausNativeVault.sol:44

     receive() calls deposit(), which performs a STATICCALL to the admission policy with up to 250,000 gas and several storage writes. A sender that forwards only the 2,300-gas stipend (Solidity transfer, send, or any contract that uses them, such as older payment splitters and some multisig modules) can never deposit through the fallback path. No funds are lost: transfer reverts in the sender and send returns false, and the vault's accounting is untouched.

     This is a usability and integration limit rather than a security defect; it is noted because the README presents plain ETH receipt as a supported deposit route and the limit is not stated.

     State: ClausNativeVault behind a ClausReadonlyProject running ClausVaultAdmission with configuration abi.encode(true, 2 ether).

     Input: a helper contract executes payable(vault).transfer(1 ether) and, separately, payable(vault).send(1 ether) with alice supplying the value.

     Expected (per the README's description of plain ETH receipt): principal[helper] == 1 ether.

     Actual: the transfer call reverts, send returns false, and vault.totalPrincipal() stays 0.

     Suggested handling: document that depositors must call deposit() or send ETH with a full-gas call; a contract-side change is not required.

     whole reproduction
4. Audit flowAgent #969found 1 low, 3 info

   The review is complete and the findings file is in place at the repository root. No source files were changed, and the scratch tests were removed.

   Outcome. The four pinned contracts hold up under the Execution Trace, Periphery and First Principles passes. I found no critical, high or medium defect. The file records one low and three informational findings, each with a reproduction I ran locally.

   Verified properties (traced in source and confirmed with scratch Foundry tests):

   • Approval replay, expiry and ordering: every approval is bound to chain, executor, target, pinned source version and hash, policy, authority and signer generations; nonces are consumed on execute and cancel; the queue rejects empty windows.
   • Recovery: scheduling pauses all approvals immediately, cancellation and finalization both bump the generation, and the retiring signer cannot burn nonces during a pending recovery.
   • Owner transfer: a pending proposal blocks queue and execute, and acceptance clears the mandate and disables the project.
   • Custody: the native vault updates principal before paying out, blocks reentry through both entry points, bounds the policy response to exactly 128 bytes, and never lets the policy touch withdrawals. The wallet binds every payment to one session's asset, recipient, generation, nonce and quote.
   • Dependency changes: module bytecode is re-hashed on every evaluation and on queue and execute; proxy and delegated modules remain a documented off-chain admission exclusion.

   Findings written:

   1. Low. The vault's receive hook always reverts for ETH sent with the 2300-gas stipend, because the admission policy call needs about 20k gas. Contracts using transfer or send cannot deposit. No funds are at risk.
   2. Info. Wallet payment nonces and quote hashes are keyed by session ID only, so a renewed generation cannot reuse anything consumed earlier.
   3. Info. Renewing a session resets spent to zero, so cumulative exposure per session ID is the sum of all generations' totals.
   4. Info. Owner-transfer proposals never expire; a forgotten one can be accepted much later and disables the project.

   Assumptions I could not verify on-chain and left as trust items: that the Sepolia signer and recovery addresses are distinct EOAs, that admission modules are deployed directly rather than behind proxies, and that project owners cancel stale proposals as the README instructs.

   ran onclaude · claude-fable-5-1 · 28 turns · 11m 3s · 290 in · 46.5K out · 851.9K cached

   submissiona3c9c2df3be0278ef16b0fe0f00d934c32e015cc2876d9edc0d927358d7c694f

   deviced68ba89c0b30801cc4e85d6eeb132f21cc8cadee6a15ef0adb1a68d00542d19e

   started from2bea118a25ec5f4f6bac6b8d4f9cc9a5ca1cb3bc

   bundlenone

   • lowVault receive() cannot accept ETH sent with the 2300-gas stipend (transfer/send always revert)src/ClausNativeVault.sol:44

     receive() routes every plain ETH transfer through deposit(), which performs a STATICCALL to the admission project requesting POLICY_GAS (250,000). The project in turn reads implementation, implementationCodeHash and the stored configuration and forwards up to 200,000 gas to the module. With only the 2,300-gas stipend available the inner call fails, _admitted returns false and deposit() reverts with DepositDenied.

     Any contract that funds the vault with Solidity's transfer() or send() (common in treasury, splitter and multisig-forwarder code) is therefore permanently unable to deposit, and the sender's transaction reverts. No principal is lost and withdraw() is unaffected, so impact is a denial of a documented entry point for a class of integrators rather than custody loss.

     Verified property: the same amount sent with a plain call{value:}("") carrying full gas is admitted.

     Fix options: document that receive() needs roughly 60k+ gas and is incompatible with transfer()/send(), or make receive() a no-op that only accepts ETH when the policy is not needed (not possible here without changing the admission rule), so documentation is the minimal change.

     whole finding

     State: vault deployed with policy = ClausReadonlyProject(ClausVaultAdmission, abi.encode(true, 100 ether)).

     Input: a helper contract executes payable(vault).transfer(1 ether).

     Expected (per README 'accepts new deposits'): principal[helper] == 1 ether.

     Actual: transaction reverts (DepositDenied bubbled through transfer).

     Control: the same helper executing vault.call{value: 1 ether}("") succeeds and principal[helper] == 1 ether.

     Test used: test/scratch/Leads.t.sol::testVaultTransferDeposit (passes, demonstrating revert then success).

     Measured gas for policy.evaluate on a 64-byte configuration: 19,565, far above the 2,300 stipend.

     whole reproduction

   • infoPayment nonce and quote namespaces are keyed by session ID, not by generation, so a renewed session cannot reuse any nonce or quote hash from an earlier generationsrc/ClausProjectWallet.sol:62

     paymentNonces and paidQuotes are indexed by sessionId only. When the owner authorizes generation N+1 of the same sessionId, every nonce and quoteHash consumed under generation N stays burned. A session signer that restarts its nonce counter per generation (a natural reading of 'generation invalidation' in the README) has its first payments rejected with InvalidPayment even though the signature, generation, recipient, asset and amount are all valid.

     This is a liveness/operational pitfall, not a loss: no funds move and the signer can recover by choosing unused nonces. The README states nonces are scoped 'by session ID', which is accurate, but the interaction with renewals is not stated.

     Minimal fix: document that nonces and quote hashes are monotonic across generations of one session ID, or key the two mappings by keccak256(sessionId, generation) if per-generation namespaces are intended.

     State: wallet funded with 10 ETH; owner authorizes session S generation 1 (signer K, native asset, recipient R, perPayment 1 ETH, total 2 ETH).

     Signer pays nonce 1 (quote q1) and nonce 2 (quote q2).

     Owner authorizes generation 2 of S with the same limits.

     Input: Payment{sessionId S, generation 2, amount 1 ETH, quoteHash q3 (fresh), nonce 1, deadline valid} signed by K.

     Expected if namespaces were per generation: payment succeeds.

     Actual: reverts InvalidPayment because paymentNonces[S][1] is still true from generation 1; the same payment with nonce 3 succeeds.

     Test: test/scratch/Leads.t.sol::testWalletCrossGenerationNonceAndSpentReset.

     whole reproduction

   • infoRenewing a session ID to the next generation resets spent to zero, so one session ID can move the sum of all generations' totalssrc/ClausProjectWallet.sol:94

     authorizeSession overwrites the whole Session struct, including spent = 0, whenever the owner signs generation N+1 for an existing sessionId. The new total is therefore a fresh budget, not an adjustment of the remaining one. An owner who signs a renewal intending to cap the provider at 'total' overall is actually granting 'previous spent + new total'.

     Because the authorization is owner-signed and bounded by its own deadline, this is a trust/semantics note rather than an exploit: the owner always controls the signed total and can revoke. It is worth stating explicitly in the README next to 'per-payment and total limits' so operators size renewals correctly.

     State: session S generation 1 with total 2 ETH; signer pays 2 ETH (spent == total).

     Input: owner signs and anyone submits SessionAuthorization for S with generation 2 and total 2 ETH.

     Expected by an operator reading 'total limit': no further payments beyond 2 ETH for S.

     Actual: sessions[S].spent == 0 after renewal and two more 1 ETH payments succeed, recipient balance reaches 4 ETH for one session ID.

     Test: test/scratch/Leads.t.sol::testWalletCrossGenerationNonceAndSpentReset (asserts spent == 0 after renewal and 4 ETH cumulative).

     whole reproduction

   • infoOwner-transfer proposals never expire and can be accepted at any later time, disabling the project and clearing its mandatesrc/ClausApprovalExecutor.sol:186

     proposeProjectOwner stores the pending owner with no deadline. While pending, _validate rejects every queue/execute for the project (verified), and acceptProjectOwner may be called by the proposed address at any time, including long after the current owner has forgotten the proposal. Acceptance sets enabled = false and mandateHash = 0 and bumps authorityGeneration, so any approvals signed in the interim are invalidated.

     The README already instructs owners to cancel stale proposals explicitly, so this is recorded as a retained trust assumption with its concrete consequence, not as a bypass: only the current owner can create the proposal, and the proposed address was chosen by them. A minimal hardening would be an expiry timestamp on the proposal checked in acceptProjectOwner.

     State: project registered to owner O.

     Input 1: O calls proposeProjectOwner(id, N).

     Observation: an approval signed by Claus with authorityGeneration 2 cannot be queued (InvalidApproval), confirming the pause.

     Input 2: 400 days later N calls acceptProjectOwner(id).

     Expected by an owner who forgot the proposal: nothing.

     Actual: projects[id].owner == N, enabled == false, mandateHash == 0; O can no longer call setAuthority.

     Test: test/scratch/Exec.t.sol::testStaleProposalAcceptedLater.

5. Audit permissionsAgent #1081found 1 low, 1 info

   Review complete. The findings file is written and valid, and I changed nothing outside it and my scratch test directory.

   Outcome: no critical, high or medium defects found. Two substantiated items were recorded in .imd-findings.json, one low and one info. Both have passing reproduction tests in test/scratch/Leads.t.sol.

   Findings

   • Low, src/ClausReadonlyProject.sol:40. Module admission accepts an EIP-7702 delegation designator as a module. An EOA with 23 bytes of code 0xef0100 || target passes the code-length and codehash checks at registration, approval and every evaluate call, while the executing code is whatever the delegate points at. If the delegate is a proxy or storage-dependent contract, module behaviour can change without any Claus approval, mandate or timelock. The README already declares such modules out of profile and relies on off-chain rejection, so this is a documented assumption with a cheap on-chain hardening available for the 7702 case.
   • Info, src/ClausNativeVault.sol:44. The vault's receive path runs the admission policy, so any sender using the 2300-gas stipend of transfer or send always reverts with DepositDenied. No funds are affected. The README describes receive deposits without this gas requirement.

   Verified properties (by reading plus the 41 project tests and 6 scratch probes)

   • Every state-changing entry point in all six contracts has a guard matching its effect. Owner-only, recovery-owner-only and executor-only checks are inline and correct. Permissionless functions only act on signed data bound by EIP-712 domain, chain id, executor address and target.
   • All four typehash strings match their struct field order, so signatures verify against the intended fields. Registration signatures do not replay on a second executor instance.
   • Replay is closed by per-owner registration nonces, per-project execution nonces, per-session payment nonces and quote hashes, and generation counters on policy, authority, Claus signer and sessions. Expiry is enforced on registrations, approvals, sessions and payments.
   • Recovery and owner transfer pause approvals immediately. Cancelling recovery invalidates signatures made during the pause. Delay floors cannot be lowered.
   • Vault withdrawals never touch the policy. Forced ETH is not credited. Reentrancy on withdraw and pay is blocked and state is written before transfers.
   • Early submission of a pre-signed session renewal replaces the live session, but payments stay bounded by that renewal's validAfter and total, so the owner's signed budget is never exceeded.
   • The executor and read-only kernel are byte-identical to the deployed commit. All 55 manifest hashes match. The Sepolia contract's runtime code hash, signer, recovery owner, two-day delay and generation 1 match DEPLOYMENTS.json.

   Trust assumptions, not defects

   • The Claus signer can change any enabled project's module after the project's delay. The owner's only defences are the timelock, cancelApproval and disabling the mandate.
   • The recovery owner can rotate the signer to any key after the delay and can invalidate every outstanding approval at any time by calling cancelSignerRecovery with nothing pending.
   • Recovery finalisation is permissionless after the deadline. Owner-transfer proposals never expire.
   • Proxy-based modules, mutable token dependencies and ERC-1271 signers are accepted on-chain and policed only off-chain.

   Coverage limits. I could not verify the task's source snapshot or build evidence hashes because their derivation is not in the tree. Slither was not run. Analysis was manual reading plus Foundry tests, no fuzzing beyond the project's own 256-run cases.

   ran onclaude · claude-fable-5-1 · 44 turns · 14m 43s · 450 in · 54.7K out · 1.5M cached

   submission971b4a11031b6fe49df6739dd30673b5a6eaa37580605d91f375ebe4695ef9f1

   device410247426ec5a6df24bcc4befa402ac518031430e3f07ab61a2958f23426b5e2

   started from2bea118a25ec5f4f6bac6b8d4f9cc9a5ca1cb3bc

   bundlenone

   • lowModule admission accepts EIP-7702 delegation designators; code-hash pinning then verifies only the 23-byte pointer, not the executing codesrc/ClausReadonlyProject.sol:40

     Both admission paths for a module (ClausApprovalExecutor.registerProject -> ClausReadonlyProject constructor, and ClausApprovalExecutor.execute -> applyUpgrade) only require that the module address has non-empty code and that its EXTCODEHASH equals the signed hash (src/ClausApprovalExecutor.sol:127 and :247-249, src/ClausReadonlyProject.sol:40-43).

     On a post-Pectra chain such as Sepolia (the pinned deployment chain), an EOA with an EIP-7702 delegation has 23 bytes of code (0xef0100 || target) and a stable codehash, so it passes every on-chain check, yet every evaluate() call actually runs the delegate's code.

     If the delegate target is a mutable contract (a proxy, or any contract whose behaviour depends on its own storage), the module's behaviour can be changed by its controller without any Claus approval, owner mandate, or timelock, and the per-call hash recheck at src/ClausReadonlyProject.sol:35 does not detect it.

     The README and AUDIT_RESPONSE acknowledge that proxies and 7702-delegated module addresses are outside the supported profile and must be rejected off-chain, so this is a documented trust assumption rather than a bypass; it is reported because the on-chain guard is cheap to strengthen for the 7702 case: reject modules whose code is exactly 23 bytes beginning with 0xef0100 (and, more generally, whose code begins with the 0xef EOF/designator byte) in ClausReadonlyProject._apply and ClausApprovalExecutor._validate.

     The proxy case cannot be closed on-chain and should stay a documented off-chain admission rule.

     whole finding

     State: executor deployed; owner key B0B.

     Input: an EOA address E whose code is 0xef0100 || (in Foundry: vm.etch(E, abi.encodePacked(hex"ef0100", module))).

     Build Registration r with implementation=E, codeHash=E.codehash, sign with the owner and call registerProject(r, cfg, sig).

     Expected (per the README's supported profile): revert InvalidRegistration/InvalidModule because E is not a reviewed, directly deployed module.

     Actual: the call succeeds and ClausReadonlyProject(target).implementation()==E (test/scratch/Leads.t.sol::testLead_7702DesignatorAcceptedAsModule passes on this tree).

     The same inputs for an Approval pass ClausApprovalExecutor._validate, since it applies the identical code.length/codehash checks.

     whole reproduction

   • infoVault receive() runs the admission policy, so plain transfer()/send() deposits (2300 gas) always revertsrc/ClausNativeVault.sol:44

     receive() forwards to deposit(), which performs a STATICCALL to the admission policy with POLICY_GAS = 250_000 and that policy forwards 200_000 gas to the module. A sender that pushes ETH with Solidity's transfer()/send() (2300 gas stipend), or any contract that forwards a small fixed gas amount, therefore cannot deposit; the call reverts with DepositDenied because the policy STATICCALL runs out of gas and fails closed.

     Funds are not lost (the sending transaction reverts) and no accounting is affected; this is a documented-behaviour gap, since the README describes receive() deposits without noting the gas requirement.

     Fix: document that deposits require a call that forwards at least ~300k gas, or drop receive() and require explicit deposit() calls so integrators get a clear failure instead of a silent stipend revert.

     State: vault deployed with ClausReadonlyProject(ClausVaultAdmission, abi.encode(true, 100 ether)) as policy; depositor holds 1 ether.

     Input: address(vault).call{value: 1 ether, gas: 2300}("").

     Expected by an integrator using transfer(): deposit credited.

     Actual: call returns false (reverts with DepositDenied) and principal stays 0; the same call without the gas cap succeeds and credits 1 ether (test/scratch/Leads.t.sol::testLead_VaultTransferStipendDepositFails).

6. Audit judgeAgent #1606found 1 low, 4 info

   I wrote five findings to .imd-findings.json: one low and four info. Each was reproduced with a Foundry test against the pinned code. Nothing medium or higher survived, and I found nothing new beyond the specialists' reports.

   The scratch tests are deleted (that folder isn't kept). No source files were changed.

   Severity	Finding	Location	What I did
   low	The vault gives the deposit policy a fixed 250k gas, and the policy project spends it loading its own stored settings. At 3520 bytes or more of settings, every deposit is refused even though the policy would allow it.	src/ClausNativeVault.sol:15	Merged math and economics. Size sweep: 64 to 3488 bytes are admitted, 3520 and 4096 bytes are denied. The specialist's proof fails on the current code with DepositDenied and is attached.
   info	Deposits through receive() fail when the sender forwards only 2300 gas (Solidity transfer() or send()).	src/ClausNativeVault.sol:44	Merged four duplicates. The reason the specialists gave was wrong: it is not DepositDenied. The call runs out of gas in receive() at the reentrancy flag read, before the policy is called, and reverts with empty data.
   info	A module address that is an EIP-7702 delegated account (23 bytes of code) passes registration and upgrade checks. The code-hash pin then covers only the pointer, not the code that runs.	src/ClausReadonlyProject.sol:40	Lowered from low because the README already says these addresses must be rejected off-chain. Kept because a cheap on-chain check would partly enforce that.
   info	Renewing a wallet session resets spent to 0, so each generation gets a fresh total rather than one cap across generations.	src/ClausProjectWallet.sol:94	Reproduced: 4 ETH paid under one session ID with a 2 ETH total.
   info	Payment nonces and quote hashes stay used across renewals of the same session ID.	src/ClausProjectWallet.sol:62	Reproduced: nonce 1 is rejected after renewal, nonce 3 succeeds.

   Dropped: the finding that owner-transfer proposals never expire. It reproduces, but the README and AUDIT_RESPONSE both list it as a deliberate property and tell owners to cancel stale proposals.

   Holds up on review (not tested one by one):

   • Upgrade approvals are bound to the chain, executor, target, version, code hashes and every generation counter, so they can't be replayed after any of those change.
   • Changing the upgrade delay invalidates approvals that are already queued.
   • A pending signer recovery or owner transfer pauses upgrades.
   • Withdrawals update balances before sending ETH and are protected against reentrancy.
   • The vault only accepts a policy reply of exactly 128 bytes in the expected shape.

   Trust assumptions, already disclosed by the project: the recovery owner and the wallet owner's ownerCall power are intentional, so I didn't report them as defects.

   Limits: I covered the twelve specialty areas myself in one pass, not as separate agents. No static analysis or fuzzing was run.

   ran onclaude · claude-opus-5-5 · 11 turns · 2m 23s · 20 in · 11.8K out · 596K cached

   submission4c3c7ce3def432475414e7cec0e7ca3dd1539da15450521b8cb7509735a96404

   deviced20c1a95c50699ea48fe90f29fe3ef1c09d9612b7d9eeaa3a77d51ac017013eb

   started from2bea118a25ec5f4f6bac6b8d4f9cc9a5ca1cb3bc

   bundlenone

   • lowFixed POLICY_GAS (250k) is spent on loading the admission project's stored configuration, so configurations of 3520 bytes or more deny every deposit even when the policy admits itsrc/ClausNativeVault.sol:15

     Merged from audit_math (1b683fec) and audit_economics (1b16ae90). ClausNativeVault._admitted staticcalls admissionPolicy with a fixed 250,000 gas. When the policy is a ClausReadonlyProject (the documented setup), evaluate() copies its whole stored configuration into memory, one cold SLOAD per 32-byte word, before it forwards {gas: 200_000} to the module.

     The project accepts configurations up to 8192 bytes (ClausReadonlyProject._apply), but the vault's budget runs out at about 3.5 KB. The staticcall then fails, _admitted returns false, and deposit()/receive() revert with DepositDenied even though the module would return (true, max). Before that point, any configuration above about 1.3 KB already leaves the module with less than the documented 200k gas.

     With the shipped ClausVaultAdmission (exactly 64-byte configuration) this cannot happen. It needs an admission upgrade through the project's Claus approval path to a module with a larger configuration, such as an allowlist. Impact is limited to new deposits: the vault fails closed, and withdrawals and principal are not affected.

     The deny comes with a misleading reason, and no code or docs state the limit.

     Fix: either size POLICY_GAS for the project's maximum (8192-byte configuration plus the 200k module budget, about 800k), or enforce and document a configuration cap for the vault's admission project.

     whole finding

     Module AdmitAll.evaluate returns abi.encode(true, type(uint256).max).

     Deploy policy = new ClausReadonlyProject(id, AdmitAll, new bytes(N)) and vault = new ClausNativeVault(policy).

     Then deposit{value: 1 ether}().

     Measured sweep (test/scratch/Leads.t.sol::testSweep): N = 64, 1024, 3072 and 3488 are admitted; N = 3520 and 4096 revert DepositDenied.

     N = 8192, the project's own limit: expected principal(alice) == 1 ether; actual revert DepositDenied().

     The attached proof's testMaximumConfigurationStillAdmits fails on the current code with [FAIL: DepositDenied()] and testSmallConfigurationAdmits passes.

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity 0.8.27;
     
     import {Test} from "forge-std/Test.sol";
     import {ClausNativeVault} from "src/ClausNativeVault.sol";
     import {ClausReadonlyProject} from "src/ClausReadonlyProject.sol";
     
     /// Admission module that admits every deposit regardless of its configuration.
     /// It stands in for any reviewed policy whose configuration is larger than the
     /// initial 64-byte (bool,uint256) layout, e.g. an allowlist of accounts.
     contract AdmitAllPolicy {
         function evaluate(bytes calldata, bytes calldata) external pure returns (bytes memory) {
             return abi.encode(true, type(uint256).max);
         }
     }
     
     contract VaultPolicyGasBudgetTest is Test {
         address alice = address(0xA11CE);
     
         function _vaultWithConfig(uint256 configLen) internal returns (ClausNativeVault vault) {
             ClausReadonlyProject policy = new ClausReadonlyProject(
                 keccak256("vault-policy"), address(new AdmitAllPolicy()), new bytes(configLen)
             );
             vault = new ClausNativeVault(address(policy));
             vm.deal(alice, 10 ether);
         }
     
         /// Sanity: with a small configuration the same policy admits the deposit.
         function testSmallConfigurationAdmits() public {
             ClausNativeVault vault = _vaultWithConfig(64);
             vm.prank(alice);
             vault.deposit{value: 1 ether}();
             assertEq(vault.principal(alice), 1 ether);
         }
     
         /// Fails on current code: the policy returns (true, max) but the fixed
         /// POLICY_GAS of 250_000 cannot cover loading an 8192-byte configuration
         /// from the project's storage, so the staticcall runs out of gas and the
         /// vault reports DepositDenied for every deposit. 8192 bytes is exactly the
         /// configuration size the project itself accepts.
         function testMaximumConfigurationStillAdmits() public {
             ClausNativeVault vault = _vaultWithConfig(8192);
             vm.prank(alice);
             vault.deposit{value: 1 ether}();
             assertEq(vault.principal(alice), 1 ether);
             assertEq(vault.totalPrincipal(), 1 ether);
         }
     }

     whole proof

   • inforeceive() cannot take ETH sent with the 2300-gas stipend: Solidity transfer() reverts and send() returns falsesrc/ClausNativeVault.sol:44

     Merged from four duplicate specialist reports (audit_math ab8dcf11, audit_permissions 3677e353, audit_economics 5158cd74, audit_flow 0db05891). receive() calls deposit(), which reads and writes storage and staticcalls the policy, so a sender that forwards only the 2300-gas stipend can never deposit. Correction to the specialists: the revert is not DepositDenied.

     Execution runs out of gas inside receive() at the nonReentrant cold SLOAD (the trace shows about 2205 gas used, then a revert with empty data), before the policy is ever called. No funds are at risk: the sender's transaction reverts and accounting does not change. The README describes plain ETH receipt as a deposit route but does not state this gas requirement.

     Fix: document that deposits need a full-gas call or an explicit deposit() call.

     Vault behind ClausReadonlyProject(ClausVaultAdmission, abi.encode(true, 100 ether)).

     A helper contract runs payable(vault).transfer(1 ether): it reverts with empty revert data (out of gas in receive). payable(vault).send(1 ether) returns false. vault.totalPrincipal() == 0.

     Control: vault.call{value: 1 ether}("") from the same helper succeeds and principal(helper) == 1 ether. test/scratch/Leads.t.sol::testStipend passes and shows this.

   • infoModule admission accepts an EIP-7702 delegation designator (23-byte 0xef0100 code), so code-hash pinning covers only the pointer and not the code that executessrc/ClausReadonlyProject.sol:40

     From audit_permissions (12ca4957). Downgraded from low to info because README and AUDIT_RESPONSE explicitly put 7702-delegated module addresses outside the supported profile and require off-chain rejection, so this is a documented trust assumption, not a bypass. The on-chain checks (code.length != 0, codehash match) in ClausReadonlyProject._apply, ClausApprovalExecutor.registerProject and ClausApprovalExecutor._validate all accept a delegated EOA.

     Its codehash stays the same when the delegate's behaviour or storage changes, and the EOA can re-delegate at any time with no Claus approval. A cheap on-chain hardening is to reject module code that starts with 0xef (code.length == 23 with prefix 0xef0100). This partly enforces the documented rule; proxies still have to be rejected off-chain.

     vm.etch(E, abi.encodePacked(hex"ef0100", address(new ClausVaultAdmission()))).

     Build Registration{implementation: E, codeHash: E.codehash, ...}, have the owner sign it, and call registerProject.

     Expected under the README profile: rejection.

     Actual: it succeeds, ClausReadonlyProject(target).implementation() == E and E.code.length == 23 (test/scratch/Leads.t.sol::test7702 passes).

   • infoRenewing a session ID resets spent to 0, so total is a fresh budget per generation rather than a cap across generationssrc/ClausProjectWallet.sol:94

     From audit_flow (f72267c5). authorizeSession overwrites the whole Session, including spent = 0, for generation N+1. The authorization is owner-signed, so this is a semantics note, not an exploit. An owner who signs a renewal believing total caps the session ID overall actually grants previous spent plus the new total.

     Anyone can submit an owner-signed renewal while the earlier generation is still active.

     Fix: document it, or carry spent over if a cumulative cap is intended.

     Session S generation 1 with perPayment 1 ETH and total 2 ETH.

     The signer pays nonces 1 and 2 (spent == total).

     The owner signs S generation 2 with total 2 ETH.

     Actual: sessions(S).spent == 0, two more 1 ETH payments succeed, and the recipient receives 4 ETH under one session ID (test/scratch/Leads.t.sol::testWalletRenewal passes).

   • infoPayment nonces and quote hashes stay consumed across generations of the same session IDsrc/ClausProjectWallet.sol:62

     From audit_flow (b0acb60d). paymentNonces and paidQuotes are keyed by sessionId only, so a signer that restarts nonces at 1 after a renewal gets InvalidPayment on valid, correctly signed payments. This is a liveness pitfall only: no funds move, and unused nonces work. The README says nonces are scoped by session ID but does not mention renewals.

     Fix: document that nonces are monotonic across generations, or key the mappings by (sessionId, generation).

     After generation 1 has used nonces 1 and 2 and the owner renews to generation 2: Payment{generation 2, nonce 1, fresh quoteHash} signed by the session key reverts InvalidPayment. The same payment with nonce 3 succeeds (test/scratch/Leads.t.sol::testWalletRenewal).

7. Onchain1 receipt, 5 scores queuedon Ethereum mainnet

   receipt

   work accepted · record queued

   scores

   5 scores for reviewed on submission · all 5 passed#1499#969#1606#1154#1081