38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
0xsimao-google.md
Loading report…
19 validated findings (2 High, 7 Medium, 7 Low, 3 Informational) and 11 unverified leads across initial and October 14 migration reviews; pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with 0xSimao AI · 6-stage pipeline + Foundry PoCs.
Accounting and value flows. Maps assets, balances and accounting rules before applying specialist review lenses. Designed to examine where value moves and whether the bookkeeping follows.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
0xsimao-google.md
19 validated findings (2 High, 7 Medium, 7 Low, 3 Informational) and 11 unverified leads across initial and October 14 migration reviews; pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with 0xSimao AI · 6-stage pipeline + Foundry PoCs.
Accounting and value flows. Maps assets, balances and accounting rules before applying specialist review lenses. Designed to examine where value moves and whether the bookkeeping follows.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
Initial reviewed revision: c435fa3dbfa179aa9083134ba8729c2ac2d34dc0October 12, 2026 smart-contract audit freeze commit; October 14, 2026 follow-up on 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft).
Findings and responses
Project responses updated October 14, 2026. All 12 validated findings (H-1, H-2, M-1 through M-7, and L-1 through L-3) and 9 unverified leads from the October 13, 2026 0xSimao × Google (gemini-4-argon) review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0, plus 4 Low findings (L-4 through L-7), 3 Informational observations (I-1 through I-3), and 2 unverified leads (Lead 10, Lead 11) from the October 14, 2026 follow-up review of token/migration-draft (3401450e038a136b17b935eb4ad6107ee0b5320b), are recorded in this report. Frozen production contract findings remain pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active; prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Each observation retains its review date, source revision, model and project decision.
H-1 — GlazeBuybackAuction::buy decays to zero while empty and accepts unvalidated asset lists, allowing 0-GLAZE extraction of buyback USDG and zero-cost epoch resets
Description:GlazeBuybackAuction::buy starts its Dutch auction decay clock at deployment (epochStartedAt = block.timestamp) while holding zero USDG and never resets it when GlazeRevenueSplitter::split() delivers USDG. Once epochDuration elapses, currentPrice() reaches 0 and any caller can extract 100% of newly split USDG while retiring 0 GLAZE. In addition, buy() accepts a caller-supplied assets array without requiring usdg to be included when usdg.balanceOf(address(this)) > 0: a caller can pass a dust or worthless ERC-20 to satisfy hasRevenue, reset epochStartedAt = block.timestamp, increment epochId (causing EpochIdMismatch for legitimate buyers), and ratchet initialPrice while leaving USDG unsold.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
H-2 — Fund::redeem computes supplyBeforeBurn without burning Fund-held Coin, diluting direct redeemers and stranding treasury backing on the last user out
Description: When Fund holds unburned Coin (either from Strategy 1 Auction payments where paymentToken == coin or after FullRange::claim transfers Coin LP swap fees to Fund), Fund::redeem computes supplyBeforeBurn = IMine(coin.minter()).effectiveTotalSupply() without first burning coin.balanceOf(address(this)). Direct callers to Fund::redeem receive a diluted share of all treasury tokens, and if the last circulating Coin holder redeems directly via Fund::redeem, coin.balanceOf(address(fund)) / supplyBeforeBurn of every treasury asset is permanently stranded in Fund with zero external Coin left to redeem it.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
M-1 — Auction::_settlePayment continues routing bribeBps to BribeRouter after a Strategy is killed and signalers exit, permanently stranding up to 20% of auction proceeds
Description: When FundController retires a strategy via Resonance::killStrategy(strategy), isStrategyLive[strategy] is set to false and addSignalFor permanently reverts with StrategyAlreadyDead. However, Auction::buy checks only configuredResonance.bribeBps() without checking configuredResonance.isStrategyLive(address(this)). As the killed strategy sells its remaining USDG balance or active 7-day ResonanceRouter stream after signalers exit, up to 20% (bribeBps) of every auction payment continues to be sent to the dead strategy's BribeRouter where signal weight can never return, permanently stranding those funds instead of routing 100% to Fund.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
M-2 — Bribe::notifyReward is permissionless and uses unscaled integer rates with raw-unit thresholds, enabling 7-day stream rate slashing, BribeRouter::route blocking, and cross-cohort remainder capture
Description:Bribe::notifyReward(rewardToken, amount) is permissionless and checks amount >= remainingReward(rewardToken) before stretching budget = amount + remaining + _rewardRemainder across a fresh 7-day REWARD_DURATION without enforcing newRate >= rewardRate[rewardToken]. In the second half of an active stream, an attacker can pass amount == remainingReward to slash rewardRate by up to 504x (99.8%). Conversely, a direct top-up raises remainingReward above BribeRouter's buffered balance and blocks BribeRouter::route(). In addition, sub-rate truncation remainders (budget % 604,800) accumulate in _rewardRemainder[rewardToken] and are paid out to future staker cohorts.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
M-3 — BribeRouter::route omits bribe.totalSignalWeight() == 0 guard and lifetime-cap clamping, enabling zero-signal reward stranding and permanent cap DoS
Description: Unlike ResonanceRouter::route (which checks if (Resonance(resonance).totalSignalWeight() == 0) return 0;), BribeRouter::route does not check bribe.totalSignalWeight() == 0 before calling Bribe::notifyReward. Calling BribeRouter::route (or Periphery::buy) while a strategy has zero signal weight starts a 7-day stream whose elapsed emissions are permanently stranded in Bribe. Furthermore, both BribeRouter::route and ResonanceRouter::route forward their full balanceOf(address(this)) without clamping to the remaining MAX_LIFETIME_* capacity (type(uint256).max / 1e36), permanently bricking route() if the buffered balance ever crosses the cap.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
M-4 — Resonance::distributeRevenue discards sub-unit USDG remainders on every permissionless checkpoint poke, allowing complete erasure of minority strategy revenue
Description: In Resonance::_updateRevenue(strategy), strategyRevenue[strategy] += Math.mulDiv(activeBalance, revenueDelta, REWARD_PRECISION) truncates sub-unit 6-decimal USDG remainders ((activeBalance * revenueDelta) % 1e36) while unconditionally advancing strategyRevenuePerSignalPaid[strategy] = currentRevenuePerSignal. Because Resonance::distributeRevenue(strategy) is permissionless, any caller or frequent signal update that checkpoints a strategy before it accumulates >= 1 raw unit (1e-6 USDG) permanently erases the accrued fractional USDG.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
M-5 — ResonanceRouter::route zero-signal guard can be bypassed at zero cost via same-transaction 1-wei SignalCoin flash-signaling
Description:SignalCoin allows atomic mint -> addSignalFor -> route -> removeSignalFor -> burn within a single transaction with zero cooldown or lockup. A caller holding 1 wei of Coin can temporarily create 1 wei of totalSignalWeight, call ResonanceRouter::route() to start a 7-day USDG stream in Resonance, and immediately withdraw and burn the 1 wei of SignalCoin, stranding USDG emissions while totalSignalWeight == 0.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
M-6 — Auction::buy enforces an unscaled 1e6 raw-unit price floor across 0..18 decimal payment tokens, omits revenueReceiver == address(this) validation, and snapshots global bribeBps on killed strategies
Description:Auction hardcodes MIN_MINIMUM_PRICE = 1e6 raw units regardless of paymentToken.decimals(), representing 1,000,000 whole tokens on a 0-decimal token, 1 token on a 6-decimal token, and 1e-12 tokens on an 18-decimal token. In addition, Auction::buy checks only revenueReceiver == address(0) and does not reject revenueReceiver == address(this) (unlike Periphery::buy and GlazeBuybackAuction::buy), allowing a caller at currentPrice() == 0 to self-transfer USDG back to Auction while incrementing epochId and resetting the decay timer.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
M-7 — FullRange::initializeAndSeed silently adopts an existing PoolManager slot0 price when currentPrice != 0, enabling pool-initialization front-running on standalone wrappers
Description: Multiple FullRange wrappers created for the same (currency0, currency1, swapFee) share the same underlying Uniswap V4 PoolId. When initializeAndSeed calls quoteSeed, it checks poolManager.getSlot0(id) and silently adopts currentPrice whenever currentPrice != 0 instead of requiring an uninitialized pool or enforcing the caller's target ratio. For non-atomic standalone wrapper creation and seeding, an attacker can create a sibling wrapper and initialize the shared V4 pool at an extreme sqrtPriceX96 ahead of the victim's initializeAndSeed transaction.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
L-1 — Resonance::killStrategy validates liveStrategyCount == 1 instead of checking whether totalSignalWeight drops to zero, stranding active USDG streams and sub-threshold strategy bribes
Description:Resonance::killStrategy only prevents killing the final live strategy (liveStrategyCount == 1) without checking whether the remaining live strategies hold any SignalCoin weight. If a killed strategy held 100% of totalSignalWeight, once its signalers exit, totalSignalWeight drops to 0 mid-stream and active ResonanceUSDG emissions are stranded. In addition, any sub-threshold balance (< 604,800 raw units) remaining in the killed strategy's BribeRouter can never be routed or recovered.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
L-2 — FullRange::claim and _credit track realized swap fees by role rather than by recipient address at realization time, allowing retroactive redirection of Fund LP fees
Description:FullRange credits realized swap fees to abstract creator/protocol role buckets (_creatorFees[pool][currency] and _protocolFees[pool][currency]) and resolves recipient addresses only when claim(pool) is called. Furthermore, Launchpad::_completeOwnership transfers FullRangeERC20 ownership to FundController even when receiveSwapFees == false (where Fund was set as the initial fee recipient), allowing the FundController owner to call FullRangeERC20::setCreatorRecipients and redirect unclaimed Fund fees.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
L-3 — Periphery::redeemWithoutFeeCollection leaves Fund's accrued Coin LP swap fees unburned in FullRange, inflating effectiveTotalSupply() and diluting non-fee backing payouts
Description: When receiveSwapFees == false, Fund's share of Coin LP swap fees accumulates inside PoolManager / FullRange until FullRange::collect and FullRange::claim are called. While Periphery::redeem collects, claims, and burns those Coin fees before calling Fund::redeem, Periphery::redeemWithoutFeeCollection skips collect and claim, leaving Fund's earned Coin unburned inside effectiveTotalSupply() and diluting the caller's pro-rata payout of existing treasury backing.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 1 — Bribe::_updateReward permanently strands rewards emitted during intermediate totalSignalWeight == 0 windows
Description: Even when a Bribe stream starts with totalSignalWeight > 0, if all signalers temporarily withdraw their signal from that strategy and later re-enter, _updateReward advances lastUpdateTime across the zero-weight window without crediting rewardPerSignalStored, permanently stranding elapsed * rewardRate in Bribe.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 2 — FullRange::_settleDelta OR-based fee readiness check (_hasCollectibleFees) causes asymmetric sub-unit fee loss on low-decimal base tokens
Description:FullRange::collect is permissionless and executes a zero-liquidity modifyLiquidity call whenever either currency has >= 1 raw unit of fees (_hasCollectibleFees uses ||). In a pool pairing 18-decimal Coin with 6-decimal USDG, tiny swaps generating >= 1 wei of Coin fees and < 1e-6 USDG fees allow collect() to checkpoint both currencies in Uniswap V4 PoolManager, truncating the sub-unit USDG fee growth to 0.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 3 — FullRangeERC20::setCreatorRecipients and FullRange::setProtocolFeeRecipient do not reject address(poolManager)
Description: While FullRange::_checkRecipient rejects recipient == address(poolManager) for initializeAndSeed, deposit, and withdraw, setCreatorRecipients and setProtocolFeeRecipient only reject address(0). Setting a fee recipient to address(poolManager) causes FullRange::claim to burn ERC-6909 claims and take underlying tokens back into PoolManager.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 4 — Mine::mine locks _globalTps() into _slot.tps at replacement time without piecewise halving integration across 30 days boundaries
Description:_accruedEmissions multiplies the full elapsed miner tenure by _slot.tps captured when mine() was called, rather than integrating piecewise across HALVING_PERIOD (30 days) boundaries. If a miner holds the slot across halving epochs without being replaced, they continue accruing Coin at the pre-halving _slot.tps rate until the next mine() or claim().
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 5 — Mine::setRevenueRouter only validates newRouter.code.length != 0, allowing FundController owner to redirect up to 100% of non-miner USDG revenue
Description: While Launchpad caps creatorFeeBps at MAX_CREATOR_FEE_BPS = 200 (2%), FundController::setMineRevenueRouter allows the launch owner (when ownable == true) to replace Mine.revenueRouter with any contract address (code.length != 0), which can divert the entire 18% Resonance + 2% creator USDG share (20% of gross mine() payments) away from ResonanceRouter.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 6 — Periphery::redeem uses try/catch around FullRange::collect and FullRange::claim
Description: If a token issuer blacklists the creator or protocol fee recipient on baseToken, FullRange::claim still succeeds for the Coin leg (because FullRange::claim wraps each currency payout in this.payout), whereas if FullRange::collect reverts or runs out of gas, Periphery::redeem silently swallows the failure and falls back to redeeming without fee collection.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 7 — OperationsPeriphery::run loads and ABI-encodes the full Launchpad.LaunchRecord struct (with 6 dynamic arrays) on every isolated subcall
Description:OperationsPeriphery::run calls launchpad.launches(coin) and passes the full LaunchRecord struct by value into up to 50 external this.perform{gas: CALL_GAS}(record, ...) subcalls, even though perform() only reads 5 scalar addresses available via launchpad.launchComponents(coin). For launches with many additionalStrategies, ABI-encoding overhead happens after the gasleft() < CALL_GAS + 60_000 check.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 8 — OperationsPeriphery::_attempt requires gasleft() >= 560,000, allowing callers to skip late maintenance steps on high-strategy launches
Description: Because run() caps total subcalls at MAX_STEPS = 50 (2 base steps + 2 per strategy) and stops as soon as gasleft() < 560,000, any launch with > 24 total strategies (> 21additionalStrategies) can never have its trailing strategies maintained via OperationsPeriphery::run.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Lead 9 — GlazeOFT inherits single-step Ownable and retains LayerZero V2 OApp peer/delegate configuration power over cross-chain minting
Description: Unlike GlazeLPFeeReceiver (which uses non-renounceable Ownable2Step), GlazeOFT uses single-step OpenZeppelin Ownable via LayerZero V2 OFT, where owner() controls setPeer and endpoint delegate settings capable of authorizing cross-chain _credit mints.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
L-4 — Base OFT 6-shared-decimal truncation guarantees at least 620,499,693,000 wei of unbridgeable Base OLD_GLAZE and permanently locked newGlaze in GlazeMigration
Description:GlazeOFT inherits LayerZero V2 OFT with sharedDecimals() = 6 (decimalConversionRate = 1e12), so OFTCore._removeDust strips any amountLD % 1e12 when bridging from Base (8453) to Robinhood (4663). Because Base retiredBalanceRaw ends in ...379,500,307,000, reserveRaw (213,598,107,624,237,620,499,693,000) ends in 620,499,693,000 wei (0.000000620499693 GLAZE), guaranteeing that at least 620,499,693,000 wei (and up to (1e12 - 1) * N_base_holders wei) of Base holder balances can never be bridged to Robinhood and the matching newGlaze reserve in ownerless GlazeMigration is permanently locked.
Disposition: ACCEPTED_RISK.
Response: Documented in token/migration-draft/README.md:86-88 and reconcile.mjs:172. Funding the full 18-decimal reserveRaw conservatively over-collateralizes the Robinhood migrator so no bridgeable holder can ever be short-paid, while omitting an admin sweep function preserves trustless reserve custody.
L-5 — reconcile.mjs deducts multisigBalanceRaw without asserting zero remaining multisig balance or verifying Transfer(multisig, DEAD) log-sum conservation
Description:reconcile.mjs computes reserve = totalSupply - treasury - retired and asserts finalizedCalculation.reserveRaw === currentCalculation.reserveRaw without asserting multisigBalanceRaw === '0' or verifying that the sum of post-finalized Transfer(multisig, DEAD) logs equals finalized.multisigBalanceRaw - current.multisigBalanceRaw == current.retiredBalanceRaw - finalized.retiredBalanceRaw.
Disposition: ACKNOWLEDGED.
Response: Verified in the finalized reconciliation capture (token/migration-draft/reconciliation-2026-10-14T19-32-39-183Z-cbf281c9a5ed4bbc.json) that multisigBalanceRaw == "0" on both Base and Robinhood at finalized and latest heads (786,401,741.21801OLD_GLAZE retired to DEAD in block 88,599,923). Explicit zero-multisig and log-delta assertions will be included in the pre-funding check.
L-6 — Any OLD_GLAZE holder can permissionlessly halt reconcile.mjs via a 1 wei DEAD transfer or a 1e12 wei in-flight OFT bridge transfer
Description:reconcile.mjs enforces assert.equal(totalSupply, genesis) (line 98) and assert.equal(finalizedCalculation.reserveRaw, currentCalculation.reserveRaw) (line 119). Any holder transferring 1 wei of OLD_GLAZE to DEAD between the finalized and latest heads, or initiating a 1e12 wei LayerZero V2 OFT bridge send while the message is in flight (totalSupply < genesis), causes reconcile.mjs to abort.
Disposition: ACCEPTED_RISK.
Response: Intentional fail-closed behavior (token/migration-draft/README.md:48-50 and reconcile.mjs:170). reconcile.mjs is a read-only operator pre-funding verification tool designed to halt if supply is in flight or if DEAD balances change between finalized and latest heads.
L-7 — Base smart-contract wallet holders following README.md bridging instructions ("bridge to their own address on Robinhood") or bridging to address(migrator) permanently strand their tokens
Description:GlazeMigration::migrate(uint256) pulls OLD_GLAZE from msg.sender and credits newGlaze to msg.sender. If a Base smart-contract wallet (Safe, AA account, treasury contract) bridges OLD_GLAZE to its own address on Robinhood Chain (4663) where that contract is not deployed at the same address, or if a user bridges/transfers OLD_GLAZE directly to address(glazeMigration), the tokens and their matching newGlaze reserve are permanently stranded.
Disposition: ACKNOWLEDGED.
Response: The migration UI will require Base holders to specify and confirm a recipient wallet they control on Robinhood Chain (4663) and will reject address(glazeMigration) as a bridge recipient.
I-1 — Direct OLD_GLAZE.transfer(address(migrator), amount) or excess newGlaze funding is permanently unrecoverable
Description:GlazeMigration has no owner or rescue function; any OLD_GLAZE or excess newGlaze transferred directly to address(migrator) is permanently locked.
Disposition: ACCEPTED_RISK.
Response: Intentional trustless custody design documented in token/migration-draft/README.md:77-79.
I-2 — reconcile.mjs does not assert BigInt(current[index].blockNumber) >= BigInt(finalized[index].blockNumber) before scanning eth_getLogs
Description:reconcile.mjs fetches finalized and latest snapshots in sequential Promise.all calls without asserting BigInt(current[index].blockNumber) >= BigInt(finalized[index].blockNumber).
Disposition: ACKNOWLEDGED.
Response: Noted for pre-funding script hardening.
I-3 — GlazeMigration::constructor does not enforce an on-chain OLD_GLAZE.balanceOf(DEAD) minimum threshold before accepting deployment
Description:GlazeMigration::constructor verifies chain ID 4663, non-zero code length, non-identical addresses, and 18 decimals, while relying on off-chain verification (reconcile.mjs) that the Robinhood multisig's 786,401,741.21801OLD_GLAZE retirement to DEAD is finalized.
Disposition: ACKNOWLEDGED.
Response: Robinhood treasury retirement (786,401,741.21801OLD_GLAZE to DEAD) is already finalized on-chain at Robinhood block 88,599,923 (reconciliation-2026-10-14T19-32-39-183Z-cbf281c9a5ed4bbc.json).
Lead 10 — GlazeMigration::migrate — OLD_GLAZE (GlazeOFT) owner/delegate (0x19d7...b7DA) retains LayerZero V2 OApp setPeer / setDelegate authority on Base and Robinhood
Description:GlazeMigration holds a finite newGlaze reserve (213,598,107.624237620499693 GLAZE) and swaps any OLD_GLAZE 1:1 without an on-chain cap; solvency relies on GlazeOFT's owner/delegate (0x19d7...b7DA) and LayerZero V2 DVN/Executor configuration not authorizing unbacked peer mints during the migration window.
Disposition: ACKNOWLEDGED.
Response: Documented in token/migration-draft/README.md:48-51 and audit-2026-10-14/REPORT.md:78-85.
Lead 11 — GlazeMigration::migrate — Replacement token (newGlaze) implementation is not yet deployed (pons launch pending)
Description: Because migrate() requires newGlaze.balanceOf(msg.sender) - balanceBefore == amount, any transfer tax, rebase, pause, blocklist, or max-wallet restriction in the eventual pons token would revert migrate() and lock newGlaze reserves inside GlazeMigration.
Disposition: ACKNOWLEDGED.
Response: Tracked in token/migration-draft/README.md:60-62, 92-95; newGlaze bytecode and transfer semantics will be verified on a Robinhood fork before deploying and funding GlazeMigration.
Review summary and follow-ups
0xSimao × Google
This file collects the recorded reviews for this harness and company. Each section identifies the reviewed source and model; partial reviews and coverage limits are preserved.
Current project response
Project responses updated October 14, 2026. All 12 validated findings ([H-1], [H-2], [M-1] through [M-7], and [L-1] through [L-3]) and 9 unverified leads from the October 13, 2026 review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0, plus 4 Low findings ([L-4] through [L-7]), 3 Informational observations ([I-1] through [I-3]), and 2 unverified leads from the October 14, 2026 follow-up review of token/migration-draft (3401450e038a136b17b935eb4ad6107ee0b5320b), are recorded in this report. Frozen production contract findings remain pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active; prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Coverage: 38 Solidity source files across packages/contracts/src (34 files) and packages/contracts-token/src (4 files). 6-step pipeline executed: Architecture & Money-Map analysis, Static Analysis & Threat Matrix, 12 Parallel Security Review Lenses, Critic Verification, Foundry PoC verification (test/audit/AuditPoC_0xSimao_Gemini4Argon.t.sol and test/audit/AuditPoC_GlazeBuyback_0xSimao_Gemini4Argon.t.sol), and Final Report compilation (docs/audits/0xsimao-gemini-4-argon.md).
Findings summary: 12 validated findings (2 High, 7 Medium, 3 Low) and 9 unverified leads recorded for human review.
Owner review: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
0xSimao × Gemini 4 Argon · October 14 follow-up (token/migration-draft)
Reviewed source: 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft/src/GlazeMigration.sol SHA-256 dfc8137f95ca2424f3444e54b412d931065aa653e2f2fae9af168f6c75c9157e and token/migration-draft/reconcile.mjs). Status captured 2026-10-14.
Recorded outcome: COMPLETE.
Coverage:GlazeMigration.sol and reconcile.mjs evaluated across all 12 attack lenses (share-exchange-rate, temporal-cohort, liquidation-solvency, cross-chain-state, rounding-precision, ordering-mev, dos-griefing, access-trust, integration-assumptions, edge-states, flow-completeness, last-user-out + saturation sweep) and 4-gate severity judging (docs/audits/0xsimao-gemini-4-argon.md).
Findings summary: 0 High/Medium findings in GlazeMigration.sol; 4 Low findings ([L-4]..[L-7]), 3 Informational observations ([I-1]..[I-3]), and 2 unverified leads (Lead 10, Lead 11) covering Base OFT 6-shared-decimal dust (>= 620,499,693,000 wei), reconcile.mjs zero-multisig / log-sum assertions and strict equality halting during third-party burns or in-flight bridge transfers, and Base smart-contract wallet bridging semantics.
Owner review: Finalized on-chain state (reconciliation-2026-10-14T19-32-39-183Z-cbf281c9a5ed4bbc.json) confirms multisigBalanceRaw == "0" on both chains; remaining operational and UI safeguards are tracked in the pre-funding migration checklist.
Original executable evidence and full report (docs/audits/0xsimao-gemini-4-argon.md) are retained in the repository. This is a source-specific public summary, not a complete-coverage certificate or professional audit by the harness author.
