Security & audits
Evidence-based review coverage and the protections actually present in the deployed protocol.
No completed third-party audit report verified
The repositories inspected on October 11, 2026 did not contain a completed independent audit report identifying an auditor, reviewed commit, deployment coverage, and remediation status. Do not describe the protocol as independently audited on the strength of tests, internal reviews, or audit-fix PR titles.
Review coverage
Public development history contains review-driven fixes and tests. Those are useful evidence of engineering work, but do not substitute for an independent audit report. This documentation audit did not establish whether an engagement exists outside the reviewed repositories. It does not certify the deployed protocol or the v2 strategies.
When a report is published, link its artifact, auditor, exact code revision, covered contracts, and remediation status. Coverage of v1 does not automatically cover a different v2 build.
Immutable core and configurable dependencies
The code model is documented in Immutable versus upgradeable. Fixed AMM bytecode still consumes configurable peers and upgradeable NAV and queue inputs. Performance-fee configuration and treasury EVE minting live in StrategyManager.
Emergency authority
The canonical Emergency authority section documents pause boundaries, strategy recovery, supported-token accounting removal, and Whitelist signer revocation. These controls and the timelock provide operational safeguards; they do not guarantee that an exit settles before a change. Claims and eligible cancellations remain available without fresh NAV.
Fail-closed valuation
A registered strategy NAV revert propagates into total NAV. An invalid feed for a nonzero supported-token balance can also block valuation. Normal mints, burns, and batch pricing may then fail rather than trade at an unverifiable NAV.
This does not mean all protocol functions stop. Claims and eligible cancellations do not require fresh NAV. A paused strategy can still report NAV if its view remains functional.
Ordinary strategy removal requires NAV at most 10 wei and a successful NAV read. ADMIN's force-removal path can remove a strategy despite a failed read or residual assets. It does not recover those assets, and their value is no longer included in the registered basket.
Actual price and execution protections
AMM checks the user's mint minimum, maximum EVE input for both immediate and queued exits, and queued price tolerance. Queued settlement outside tolerance returns EVE rather than crediting ETH. The queue bounds live priced batches to 25.
There is no deployed AMM 5% rolling-price checkpoint guard or checkpoint-reset action. UniCL pool/TWAP checks are strategy-level controls. They do not protect the AMM as a whole against NAV changes.
Pull-based claims
Processing credits ETH to AMM's claimable balance, and reserves it in lockedForClaims.
The user calls claim() separately. This avoids pushing ETH to every recipient during
batch processing, but claim submission still depends on the user's wallet and gas.
Automation boundary
Mimic functions call allowlisted keeper executors. Execution values are re-derived on-chain; off-chain payloads do not supply authoritative NAV or settlement amounts. Availability still depends on tasks, funding, RPC, gas policies, feeds, and contract eligibility.
App and data limitations
The app assumes Ethereum mainnet. Historical account data depends on the Goldsky subgraph, which can lag chain state. Deployment and environment documentation must be maintained with configuration changes. See Operational trust and Failure and recovery scenarios.
See Keepers and automation, Key risks, and Trust & governance.
Last updated on