QUORUM

Implemented the contracts, local connector, seven ABI exports, and deployment/security documentation.

Verified:

• forge build
• Seeded forge test: 55 passed
• forge fmt --check
• Connector tests: 16 passed

Documented the 128-seat cap, admission configuration, Safe handover, and remaining independent review and real-model rehearsal requirements. No transactions were broadcast.

Added adversarial tests covering all requested areas, plus custody and treasury invariant suites.

• forge build passed.
• Seeded forge test: 110 passed, 0 failed, 0 skipped.
• New invariants exercised 32,768 calls.

All delivered changes are under test/. Live mainnet verification remains outside this offline suite.

Created launch.json for QUORUM/QRM with six application contracts in dependency order and the required pool settings.

Constructor arguments match the compiled ABIs. forge build succeeded; all 110 tests passed with the supplied fuzz seed.

Only launch.json is changed for submission.

Review complete. The findings file is written and validated, and the working tree holds no source changes (only the findings file and the scratch test directory, both ignored by git).

Outcome. The arithmetic in this project holds up under the Math Precision, Boundary and Numerical Gap checklists. I found one low-severity seam and one informational property, both reproduced in a scratch test. No critical, high or medium defects in my area.

What I verified in depth

• Attendance window math in QuorumBoard: the 25-bit mask shift, the >>1 & 0xffffff extraction, and the 24/25-hour cutoffs give exactly the previous 24 completed hours. Rotation and re-deposit reset it, and the per-seat credited-hour marker blocks double credit across rotations.
• Quorum and pass rules: (e+4)/5 and (e+2)/3 are exact ceilings, floor of 5 applied, handover 2/3-of-electorate and Major 2/3-of-cast both exact. Swept all electorates 0 to 128.
• Stake formula: K equals the workflow's floor of 7.5% of supply over N, with the zero case rejected and the value frozen once.
• Budget accounting: spent never exceeds cap, exact balance-delta checks on token spends, no unguarded subtractions anywhere in the tree.
• Downcasts and shifts: every uint64 and uint32 narrowing is bounded by timestamps, block numbers, or the 128-seat cap.
• Boundary and gas: 128-seat snapshot and full proposal measured at about 8.2M and 12.4M gas by the existing suite, under the per-transaction cap.
• Manifest cross-checks: the constitution hash in launch.json matches the raw bytes of docs/constitution.md, the Safe hashes match the evidence file, and all seven exported ABIs match the compiled output.

Findings

1. Low. proposeSpend checks the budget's expiry against the current time, but the earliest execution is 72 hours later. A budget expiring inside that window yields a proposal that can pass but never execute, and the one-live-proposal rule then locks the proposer's seat until the 14-day grace period ends. Reproduced: seat blocked for 13 days. Suggested fix is a propose-time check that the budget outlives the earliest executable instant.
2. Info. With a 12-seat electorate a Major passes on one Yes plus four Abstains. This matches the approved rules in workflow.md, so it is recorded as a trust note rather than a defect.

Coverage. All 32 listed entry points have a row, 31 hold and one carries finding 1, plus three invariant rows for the manifest and ABI checks. Static-analysis leads on reentrancy and strict equality were traced and rejected with reasons in the coverage rows. The full existing suite of 110 tests passes.

The review is complete and .imd-findings.json is written with an empty findings list and a full coverage record. No files other than that one were changed.

Outcome: no substantiated defects in the Execution Trace, Periphery or First Principles areas. I traced every state-changing entry point from guard to final state, including the Safe 1.5.0 module and guard callbacks, and could not construct a failing input or state for any of them.

What I checked and how:

• Execution flow. Proposal creation, voting, timelock and execution for Ordinary, Major and Handover kinds. Budget caps are re-checked and consumed before the transfer, with exact Safe debit and recipient credit. The three-call handover sequence is consistent with the vendored Safe, which reads the module guard before execution and reuses it after. A Major action cannot forge the module callbacks because the authorized hash would have to contain its own calldata.
• Periphery. The reentrancy lock, token call helper and signature library behave as their callers assume. The attendance mask arithmetic was checked by hand at the 0, 1, 24 and 25 hour gaps and matches the 24-completed-hour rule.
• First principles. Coupled storage stays in sync across authorize, revoke, deposit, exit and withdraw. Refunds always go to the original depositor. Frozen electorates survive dormancy, exit requests and key rotation, while withdrawn or re-deposited seats cannot reuse them.
• Manifest and evidence. launch.json uses only schema keys, constructor arguments match the ABI order for all six contracts, and the constitution argument equals the keccak of docs/constitution.md. I fetched the mainnet Safe and singleton from a public RPC. Both runtime hashes, the 1.5.0 version, the sole founder owner and threshold one match the manifest and evidence file.
• Static analysis leads. The reentrancy, strict-equality and uninitialized-state lines were each traced and are false positives or intentional exact checks.

Two behaviours I considered and did not report as defects, since both are documented and tested: key rotation clears effective attendance so the seat is dormant for at least 18 hours, and a forwarded receipt can make a piggybacked vote or post revert until the agent retries without it.

The existing suite of 110 tests passes. The one thing not verified here is the canonical NFT contract and admission dataset, which the owner sets after launch and which no file in the tree names.

The review is complete. Findings are in .imd-findings.json at the repository root; no project files were changed, and git status is clean apart from that file.

Result: no critical, high or medium defects in the economics, invariant or flow-gap areas. The full suite (110 tests) passes on this tree.

Findings written

• Low: global proposal nonce race. A Proposal post commits to proposalCount + 1. Any other seat's proposal landing between the post and the propose call makes the post unusable and strands any Work registered against that nonce. Reproduced with a scratch Foundry test. Griefing is bounded, since each griefer seat is then blocked by its own live proposal, and no funds are at risk.
• Info: $owner resolution. All Safe and treasury roles are $owner. If the service resolved it to the founder EOA rather than the paying Safe, constructors would accept it and handover would be permanently unreachable. I verified on mainnet today that the Safe's proxy and singleton code hashes, version, owner, threshold and empty module list all match the manifest, and that the fallback handler the docs say must be cleared is still set.
• Info: 128-seat cap versus admission count N. A disclosed design bound, listed with a concrete failing input for the requester to confirm before admission.

What held under tracing. Stake custody (vault balance equals deposits times K, refund always to the original depositor, no governance or owner path out), budget cap consumption and exact-delta checks on ordinary spends, frozen electorates with voted stake locked by the 7-day exit, quorum and supermajority math, handover gating, and the post-handover Safe binding. The manifest's keys, names, argument counts, constitution hash and pool fields all check out.

Coverage. All 32 entry points have rows, plus three invariant rows and one for the manifest. Participation receipt internals were traced but belong to another reviewer's depth. Static-analysis leads on reentrancy and strict equality are the intended exactness checks and were not promoted.

The review is complete. .imd-findings.json holds 5 findings and 34 coverage rows, all entry-point names exact, all snippets verified against the tree, no source files changed, and scratch tests removed.

Outcome: the permission model holds. I traced every state-changing entry point against the Access Control, Trust Gap and Asymmetry guides and found no critical, high or medium defect. The Safe binding (owner, sole module, both guards, fallback, code hashes), the handover gates, the budget path, the stake custody and the one-seat-one-vote rules all behave as the brief requires. No finding needed a proof test.

Findings written, by severity:

• Low, agent-key squatting. QuorumSeats.authorize reserves an agent address globally on first use. Any canonical NFT holder with no stake can register someone else's intended key and the victim's authorize reverts with KeyAlreadyUsed. Griefing only.
• Low, irreversible exit by the agent key. A STAKE-scoped agent or the current NFT holder can call requestExit, and there is no cancel. The owner loses the seat for at least 7 days plus a full re-enrollment, even after revoking the key. Refund still goes to the depositor.
• Info, self-acceptance of work. The proposer's own seat satisfies the work-acceptance gate, so the acceptance is not independent. Allowed by the brief's literal wording.
• Info, live Safe state. I read mainnet directly: the launch Safe's proxy and singleton code hashes, owner, threshold and version match launch.json, and the constitution hash equals keccak256 of docs/constitution.md. The Safe still has a CompatibilityFallbackHandler installed, so founderAccept reverts with FallbackForbidden until the founder clears it. The manifest notes already state this prerequisite.
• Info, unguarded snapshot. Anyone can call QuorumAssembly.snapshot(). Governance uses its returned id, so no electorate can be confused. Only indexers see spurious events.

Coverage: 31 entry-point rows plus three invariant rows. Twenty-seven holds, four finding, none unreached. Everything in my assigned area was reached. What I could not verify is whether the vendored Safe 1.5.0 bytecode is identical to the live singleton, since compiler settings change the hash; the live VERSION() returns 1.5.0 and the policy checks that string.

Review complete. The findings file is written and validated, and every reproduction ran against this tree.

Outcome: no critical, high or medium defects. Six findings are recorded in .imd-findings.json: four low and two informational, each with a reproduction that executed on the current code. Coverage answers all 31 entry points plus three invariants.

Specialist findings, settled

• Kept as low (4): global first-come agent-key squatting in authorize(); irreversible requestExit() by a STAKE-scoped agent with no cancel path; proposeSpend accepting a budget that expires inside the vote plus timelock, leaving a passed but unexecutable spend that locks the proposer's seat for the grace period; and the Proposal-post race on the global proposal nonce. I merged my own observation that a Major proposed before handover hits the same unexecutable-but-live root cause into the third finding.
• Kept as info (2): the proposer's own seat satisfying work acceptance, and the deployment preconditions outside the code. For the second I merged the two specialists' notes and re-read mainnet myself: the Safe's proxy and singleton codehashes match the manifest, the founder is the sole owner, no modules are enabled, and the fallback handler is still set, so founderAccept reverts until the founder clears it.
• Dropped (3): the public snapshot() note has no effect on any proposal's electorate. The 128-seat cap is a documented design bound in the README. A Major passing with one Yes plus abstentions is exactly the approved rule in the workflow.

My own pass found nothing further. I traced the Safe 1.5 guard and module callbacks, the handover install sequence, budget accounting with exact balance deltas, the 25-bit attendance mask and 24-hour window, electorate freezing across exit, transfer and re-deposit, and stake isolation. The slither and aderyn leads are all benign under the reentrancy lock, fixed token and Safe-only call paths.

Manifest and build checks all passed: constructor arguments match declaration order and resolve to the Safe, the constitution hash equals keccak256 of docs/constitution.md, the seven ABI exports equal the compiled ABIs, and QuorumGovernance runtime is 24,393 bytes, 183 bytes under the limit.

One limitation to note: this container caps processes at 1.5 GB, so the full via-IR test suite cannot compile in one job. I ran the five scratch reproductions and the Safe and handover adversarial file in isolation, all passing. The remaining suite files were not executed here.

Implemented the bilingual frontend and 1.77 MB static export.

Passed build/typecheck, 12 unit tests, 19 browser checks, 16 design checks and 23 accessibility scans. Evidence is in docs/frontend/VALIDATION.md; design documentation is in docs/DESIGN.md within the allowed scope.

Commit creation was blocked: git add returned .git/index.lock: Read-only file system. Deliverable files remain in web/, dist/ and docs/.

Recorded 1 high and 3 medium findings in .imd-findings.json. The high finding warrants revision before publication. Website files remain unchanged.

• High — bug: A long supported seat ID widens discussion to 622px at both 320px and 390px. Allow metadata to wrap while preserving the full identifier.
• Medium — bug: Failed or pending RPC reads display “Admission is not configured.” Distinguish unknown, loading, failed, and confirmed configuration states.
• Medium — fidelity: Chinese forms show English validation messages. Localize shared validation and recovery text.
• Medium — bug: Selecting release B retains release A’s “Matches approved site hash” verdict. Bind comparison results to the selected release and hash.

Each finding includes exact source lines, copied snippets, reproduction inputs, measurements, and the required change.

The requirement checklist below covers frontend delivery and presentation; it does not constitute a new Solidity audit.

Fixed all four findings and rebuilt the export and deployment manifest. Wrote .imd-responses.json and validation evidence.

Passed: 18 unit tests, 5 regression groups, 18 Chromium groups, 23 accessibility scans and 16 design checks.

Limitations: WebKit was unavailable. Git’s read-only index prevented committing; changes remain in the working tree. Submission size is approximately 5.45 MB, below 8 MiB.

All four previous findings are fixed. No reproducible new defects remain. .imd-findings.json contains {"findings":[]}. Website files were unchanged.

Validation passed: clean build/typecheck, byte-identical rebuilt export, 18 unit tests, five regression groups in each browser, 18 broader Chromium interaction groups, the WebKit feedback flow, and 23 accessibility scans with zero reported violations. All seven pinned ABIs and all 25 asset hashes verified. A live read confirmed chain 1 and nonempty code at all seven addresses. Transaction tests used fixtures; no live transaction was sent.

QUORUM is an assembly console carried by a restrained dark terminal palette, geometric identity and visible participation controls.

The checklist groups related explicit requirements. Contract and connector entries refer to preserved implementation and existing evidence; this round does not constitute a new contract security audit.