Cyfrin · October 2026
Cyfrin audit
Manual review of the current 26 protocol contracts, October 12–23, 2026. All 11 findings were resolved and verified by Cyfrin.
Page 1 of 25: Cover
Original report layout. Switch to Text view for selectable text and easier reading on smaller screens.
Findings and responses
All 11 findings were resolved before this report was issued. Each response below quotes Cyfrin's own verification note from the report and links the fix commit the report cites. Findings refer to the reviewed revision on this report, not every later contract change.
L-1 — Decimals-blind 1e6 raw-unit Auction price floor with linear decay sells low-value lots of low-decimal payment tokens only at zero price
Severity: Low.
Disposition: Resolved.
Fix: 5edced1d.
Verification: Cyfrin: Verified. ABSOLUTE_MINIMUM_PRICE is now 10 raw units, so a 0-decimal Auction at the lowest price quotes 1 raw unit at its last nonzero second and the next start still rises under MIN_PRICE_MULTIPLIER (10 -> 11).
L-2 — FullRangeDeployment::verify does not authenticate constructor state
Severity: Low.
Disposition: Resolved.
Fix: ea85d391.
Verification: Cyfrin: Verified. Fix follows recommendation.
L-3 — FullRange::initializeAndSeed token minima do not protect seed share output
Severity: Low.
Disposition: Resolved.
Fix: 77f61f4e.
Verification: Cyfrin: Verified. Minimum share validation has been added.
I-1 — Launchpad::setProtocolFeeBps lets the owner raise the protocol fee to 200 bps, four times the maximum disclosed in SECURITY_NOTES.md
Severity: Informational.
Disposition: Resolved.
Fix: 8d922b83.
Verification: Cyfrin: Verified. SECURITY_NOTES.md and docs/audit-todo.md now describe the 1–200 bps global protocol fee and the separate 1–200 bps per-Mine creator fee.
I-2 — Economics and architecture docs describe the old V2 launch flow, an old launch signature and a 10% Bribe default
Severity: Informational.
Disposition: Resolved.
Fix: 775bc9fd.
Verification: Cyfrin: Verified. economics.md now describes the current LaunchConfig and FullRange seeding with no V2 genesis flow, the Bribe share is the explicit bribeBps in both modes, revenue-model.md labels the 10% example as illustrative, and architecture.md shows Launchpad.launch(config).
I-3 — Mine::PREVIOUS_MINER_BPS NatSpec suggests the revenue destination receives everything after the miner share
Severity: Informational.
Disposition: Resolved.
Fix: fdd1af7b.
Verification: Cyfrin: Verified. Implemented recommended mitigation.
I-4 — Launchpad::CoinLaunchedFullRange omits the Mine, Resonance, ResonanceRouter and SignalCoin addresses
Severity: Informational.
Disposition: Resolved.
Fix: d7f886cf.
Verification: Cyfrin: Verified. The launch README now points to getLaunch for the Mine, Resonance, ResonanceRouter and SignalCoin addresses.
I-5 — Auction constructor reports InitialPriceOutOfRange when minimumPrice is the invalid value
Severity: Informational.
Disposition: Resolved.
Fix: 59f34156.
Verification: Cyfrin: Verified. minimumPrice is now range-checked before initialPrice is compared against it.
I-6 — Launchpad::_seedPool reverts with FullRange.Slippage when its own minimumGenesisShares check fails
Severity: Informational.
Disposition: Resolved.
Fix: 3fe68b95.
Verification: Cyfrin: Verified. Implemented recommended mitigation.
I-7 — creators-launching.md misstates Mine::_allocatePayment’s disabled creator fee routing
Severity: Informational.
Disposition: Resolved.
Fix: 6b1e5b58.
Verification: Cyfrin: Verified, updates to documentation have been made.