38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
gebal-google.md
Loading report…
21 validated findings (1 High, 5 Medium, 12 Low, 3 Informational) across initial and October 14 migration reviews; all pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Gebal · source-only cold review across three packages.
Reproducible review evidence. A review workbench that tracks source scope, model runs and sandboxed checks. Coverage and evidence limits are recorded alongside its observations.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
gebal-google.md
21 validated findings (1 High, 5 Medium, 12 Low, 3 Informational) across initial and October 14 migration reviews; all pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Gebal · source-only cold review across three packages.
Reproducible review evidence. A review workbench that tracks source scope, model runs and sandboxed checks. Coverage and evidence limits are recorded alongside its observations.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
Initial reviewed revision: c435fa3dbfa179aa9083134ba8729c2ac2d34dc0October 12, 2026 smart-contract audit freeze commit; October 14, 2026 follow-up on 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft).
Findings and responses
Project responses updated October 14, 2026. All 17 validated findings (GEBAL-CORE-01 through GEBAL-CORE-12 and GEBAL-TOK-01 through GEBAL-TOK-05) from the October 13, 2026 Gebal × Google (gemini-4-argon) review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 and all 4 observations (GEBAL-MIG-01 through GEBAL-MIG-04) from the October 14, 2026 follow-up review of token/migration-draft (3401450e038a136b17b935eb4ad6107ee0b5320b) are recorded in this report. Frozen production contract findings remain pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active; prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Each observation retains its review date, source revision, model and project decision.
GEBAL-TOK-01 — Unvalidated assets[] in GlazeBuybackAuction.buy allows non-USDG or dummy ERC-20s to satisfy hasRevenue, advance epochId, and reset price/timer without sweeping USDG
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts-token, run 77b36769-3b7f-447d-8bac-8254cd679eef). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Severity: high (confidence: high, evidence: model).
Description: In GlazeBuybackAuction.buy(address[] calldata assets, ...), the contract loops over caller-supplied assets[] and sets hasRevenue = true whenever any assets[i] has balanceOf(address(this)) > 0, without requiring usdg (stored as an immutable at line 41) to be included or swept when usdg.balanceOf(address(this)) > 0. At currentPrice() == 0 (or near 0 at the end of epochDuration), an attacker can pass a worthless or custom ERC-20 with 1 wei balance to satisfy hasRevenue == true, increment epochId (causing legitimate USDG buyers to revert with EpochIdMismatch), reset epochStartedAt = block.timestamp, and reset or ratchet initialPrice while leaving 100% of the USDG balance unsold in GlazeBuybackAuction.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-01 — Unburned Coin held by Fund dilutes pro-rata payouts in direct Fund.redeem calls and can permanently strand treasury backing on final exit
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Severity: medium (confidence: high, evidence: model).
Description: Strategies can use Coin as an AuctionpaymentToken (transferred to Fund in Auction.sol:222) and FullRange.claim transfers Coin LP fees to Fund (FullRange.sol:339). While Periphery._redeemFund (Periphery.sol:327-328) explicitly burns Fund-held Coin before calling Fund.redeem, Fund.redeem() itself (Fund.sol:96-141) does not burn or subtract coin.balanceOf(address(this)) from supplyBeforeBurn = IMine(coin.minter()).effectiveTotalSupply(). Direct callers to Fund.redeem() while coin.balanceOf(fund) > 0 suffer pro-rata dilution, and if the final circulating Coin holder redeems directly via Fund.redeem(), coin.balanceOf(fund) / supplyBeforeBurn of all treasury assets is permanently stranded in Fund.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Description:ResonanceRouter.route() (ResonanceRouter.sol:65) checks if (Resonance(resonance).totalSignalWeight() == 0) return 0; so revenue remains buffered while signal weight is zero. In contrast, BribeRouter.route() (BribeRouter.sol:55-65) omits bribe.totalSignalWeight() == 0 and forwards buffered paymentToken into Bribe.notifyReward whenever amount >= max(REWARD_DURATION, remainingReward). When totalSignalWeight == 0, starting a 7-day stream in Bribe causes elapsed * rewardRate tokens during the zero-weight interval to never be credited to rewardPerSignalStored, permanently locking those tokens in Bribe.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-03 — Auction.buy continues routing bribeBps (up to 20%) to BribeRouter after Resonance.killStrategy, permanently stranding post-kill bribes
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Severity: medium (confidence: high, evidence: model).
Description: When a strategy is retired via Resonance.killStrategy(strategy), isStrategyLive[strategy] becomes false permanently and future addSignalFor calls revert with StrategyAlreadyDead. However, Auction.buy() checks only configuredResonance.bribeBps() without checking configuredResonance.isStrategyLive(address(this)). As the killed strategy sells its remaining USDG balance or 7-day ResonanceRouter stream after signalers exit, up to 20% (bribeBps) of every auction payment continues to be sent to BribeRouter where signal weight can never return, permanently stranding those tokens instead of sending 100% to Fund.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-04 — BribeRouter.route and ResonanceRouter.route forward their full balance without clamping to remaining MAX_LIFETIME_* capacity, permanently bricking routing if exceeded
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Severity: medium (confidence: high, evidence: model).
Description: Both Bribe.notifyReward and Resonance.notifyRevenue enforce a lifetime cumulative funding cap of MAX_LIFETIME_REWARD_AMOUNT / MAX_LIFETIME_REVENUE_AMOUNT (type(uint256).max / 1e36 =~ 1.1579e41 raw units). Because BribeRouter.route() and ResonanceRouter.route() always pass their entire balanceOf(address(this)) without clamping to maximum - notified, any token balance exceeding the remaining cap causes route() to permanently revert with RewardLifetimeCapExceeded / RevenueLifetimeCapExceeded, stranding all remaining lifetime capacity.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-05 — Permissionless Bribe.notifyReward only checks amount >= remainingReward, allowing mid-stream rewardRate dilution and BribeRouter threshold blocking
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Severity: medium (confidence: high, evidence: model).
Description:Bribe.notifyReward(rewardToken, amount) is permissionless and checks amount >= remainingReward(rewardToken) before stretching budget = amount + remaining + _rewardRemainder across a new 7-day REWARD_DURATION without requiring rate >= rewardRate[rewardToken]. Near the tail of an active stream, a caller can supply amount == remainingReward to stretch 2 * remainingReward over a fresh 7 days, slashing the active rewardRate by up to 504x. Conversely, supplying a large amount directly to Bribe.notifyReward raises remainingReward above BribeRouter balance, blocking BribeRouter.route() until the stream decays.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-06 — Non-atomic standalone FullRange wrapper creation and seeding adopts existing V4 slot0 price in quoteSeed, enabling sibling-wrapper price front-running
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: In FullRange, create() registers a wrapper for (currency0, currency1, swapFee) without initializing the underlying Uniswap V4 pool, and multiple wrappers can share the same V4 PoolId. When initializeAndSeed() is later called on a wrapper, quoteSeed() checks poolManager.getSlot0(id): if sqrtPriceX96 != 0, it silently adopts the existing V4 pool price instead of FullRangeMath.seedPrice(amount0Max, amount1Max). A standalone caller who invokes FullRange.create() and FullRange.initializeAndSeed() in separate transactions with permissive amount0Min / amount1Min bounds can have their shared V4 PoolId initialized first by a sibling wrapper at a skewed price.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-07 — Auction.buy omits revenueReceiver != address(this) check (unlike GlazeBuybackAuction.buy and Periphery.buy), allowing self-transfer epoch reset at price == 0
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: In Auction.buy(), revenueReceiver is checked only against address(0), whereas GlazeBuybackAuction.buy and Periphery.buy also reject revenueReceiver == address(this). When currentPrice() == 0, a caller can invoke auction.buy(address(auction), epochId, block.timestamp, 0) directly, transferring USDG from Auction back to Auction itself while incrementing epochId, resetting epochStartedAt = block.timestamp, and resetting initialPrice = minimumPrice.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-08 — Permissionless Resonance.distributeRevenue(strategy) discards sub-unit (activeBalance * revenueDelta) % 1e36 remainders on every call
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: In Resonance._updateRevenue(strategy), strategyRevenue[strategy] += Math.mulDiv(activeBalance, revenueDelta, REWARD_PRECISION) floors to the nearest raw unit of 6-decimal USDG and unconditionally sets strategyRevenuePerSignalPaid[strategy] = currentRevenuePerSignal. Because Resonance.distributeRevenue(strategy) is permissionless, frequent calls when activeBalance * revenueDelta < 1e36 advance strategyRevenuePerSignalPaid[strategy] while crediting 0 USDG, permanently locking the truncated sub-unit USDG in Resonance.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-09 — Asymmetric-decimal sub-unit fee truncation in FullRange.collect via OR-based readiness check
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: In FullRange._hasCollectibleFees, a position is considered collectible whenever either currency0 OR currency1 has accrued >= 1 raw unit of fees. However, calling _modifyLiquidity(pool, 0, address(0)) in collect(pool) checkpoints both currencies simultaneously in Uniswap V4 PoolManager, discarding fractional sub-unit fee deltas in both currencies. When 18-decimal Coin is paired with a low-decimal baseToken (e.g., 6-decimal USDG/USDC), frequent collect() calls triggered whenever Coin accrues >= 1 wei of fee reset the low-decimal token fee growth baseline before it reaches 1 raw unit.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-10 — OperationsPeriphery.run ABI-encodes full LaunchRecord (with 6 dynamic arrays) on every subcall instead of LaunchComponents
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: In OperationsPeriphery.run, the contract loads the full Launchpad.LaunchRecord (containing 6 dynamic arrays of length 3 + additionalStrategies.length) and passes it by value to external subcall this.perform{gas: CALL_GAS}(record, ...) up to 50 times, even though perform() only reads 5 scalar addresses available in Launchpad.LaunchComponents. Because Solidity allocates memory and ABI-encodes record after the gasleft() check and before the CALL opcode, launches with many additionalStrategies can exceed the 60,000 gas headroom buffer.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-11 — Missing balance-delta check in Bribe.notifyReward and two-pass balance snapshot in Fund.redeem for non-standard/alias tokens
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:Bribe.notifyReward pulls amount via safeTransferFrom and credits the nominal amount to budget without checking balanceAfter - balanceBefore, which would cause accounting insolvency if a fee-on-transfer token is registered as a rewardToken or Strategy paymentToken. Additionally, Fund.redeem snapshots balances and computes payouts[] for all tokens[i] in a first pass before executing safeTransfer in a second pass, which would allow 2x pro-rata extraction if Fund ever held a dual-entry-point / shared-ledger alias token (tokenA < tokenB).
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-CORE-12 — Missing address(poolManager) fee-recipient check in FullRange/FullRangeERC20 and unconditional forceApprove(..., 0) in Launchpad/Periphery
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts, run e8813b27-a7c9-4d26-8166-2bee6a9b2c49). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:FullRange._checkRecipient rejects address(poolManager) for LP share minting and liquidity withdrawals, but FullRangeERC20.setCreatorRecipients and FullRange.setProtocolFeeRecipient only reject address(0). If a fee recipient is set to address(poolManager), FullRange.claim burns ERC-6909 claims and calls poolManager.take(..., address(poolManager), amount), permanently stranding the fees inside PoolManager. Additionally, Launchpad._seedPool and Periphery.buy call forceApprove(spender, 0) unconditionally even when allowance is already 0.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-TOK-02 — GlazeBuybackAuction.buy allows sweeping GLAZE (paymentToken) held by the auction to revenueReceiver instead of retiring it to DEAD
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts-token, run 77b36769-3b7f-447d-8bac-8254cd679eef). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:GlazeBuybackAuction is designed to sell accumulated revenue assets for GLAZE that is retired to DEAD (0xdead). However, buy() accepts an arbitrary caller-supplied assets[] array and does not forbid assets[i] == address(paymentToken). Any GLAZE accidentally transferred or donated to the GlazeBuybackAuction contract itself can be included by a buyer in assets[] during buy() and transferred to revenueReceiver rather than retired to DEAD.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-TOK-03 — GlazeRevenueSplitter does not disable renounceOwnership and atomically couples teamRecipient and auction transfers in split()
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts-token, run 77b36769-3b7f-447d-8bac-8254cd679eef). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:GlazeRevenueSplitter inherits Ownable2Step without overriding renounceOwnership(), and split() executes usdg.safeTransfer(recipient, toEach) and usdg.safeTransfer(address(auction), toEach) atomically in a single call. If teamRecipient is blocklisted by USDG and ownership was renounced (or if immutable auction is blocklisted by USDG), split() reverts permanently and freezes both halves of the split.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-TOK-04 — GlazeOFT inherits single-step Ownable and grants LayerZero V2 OApp peer/delegate configuration authority over cross-chain minting
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts-token, run 77b36769-3b7f-447d-8bac-8254cd679eef). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:GlazeOFT inherits single-step OpenZeppelin Ownable (via LayerZero V2 OFT) rather than Ownable2Step, meaning transferOwnership immediately replaces the owner and renounceOwnership remains callable. In LayerZero V2 OFT, the owner/delegate controls setPeer and ULN DVN/Executor configuration, which can authorize cross-chain messages that invoke _credit to mint uncapped GLAZE on the local chain.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-TOK-05 — GlazeLPFeeReceiver.forwardETH forwards all remaining gas via low-level call to recipient
Review: Gebal × Gemini 4 Argon · October 13 audit (packages/contracts-token, run 77b36769-3b7f-447d-8bac-8254cd679eef). Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: In GlazeLPFeeReceiver.forwardETH(), native ETH is forwarded via destination.call{value: amount}(""). While protected by nonReentrant against reentering GlazeLPFeeReceiver, if the owner sets recipient to a smart contract with an expensive or reverting receive/fallback function, permissionless callers of forwardETH() can be griefed or native ETH forwarding can be blocked until the owner rotates recipient.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
GEBAL-MIG-01 — Unenforced on-chain treasury exclusion and missing zero-multisig / retirement-sum assertions in reconcile.mjs
Review: Gebal × Gemini 4 Argon · October 14 follow-up (token/migration-draft, run cf96e0f2-795c-4685-b10d-21f9105b7688). Reviewed source:3401450e038a136b17b935eb4ad6107ee0b5320b. Model:gemini-4-argon.
Severity: medium (confidence: high, evidence: model).
Description:GlazeMigration.migrate(uint256) allows any holder of Robinhood OLD_GLAZE—including the treasury multisig (0x19d73c1B60519C300BB609BB3FD1d30510F3b7DA)—to exchange OLD_GLAZE 1:1 for newGlaze, while reconcile.mjs subtracts the entire multisig balance on Base and Robinhood when computing reserve = totalSupply - treasury - retired. Because transferring OLD_GLAZE from the multisig to DEAD shifts balance from treasury to retired without changing reserve, reconcile.mjs passes all assertions even when finalizedCalculation.excludedMultisigRaw is non-zero, and its post-finalized log scan (lines 123-152) records Transfer(multisig, dead) events without asserting that their sum equals the decrease in multisigBalanceRaw or the increase in retiredBalanceRaw.
Disposition: ACKNOWLEDGED.
Response: Verified in the finalized reconciliation capture (token/migration-draft/reconciliation-2026-10-14T19-32-39-183Z-cbf281c9a5ed4bbc.json) that excludedMultisigRaw == "0" (multisigBalanceRaw == "0" on both Base and Robinhood at finalized and latest heads, with all 786,401,741.21801 Robinhood treasury OLD_GLAZE retired to DEAD in block 88,599,923). reconcile.mjs will be re-run immediately before funding GlazeMigration.
GEBAL-MIG-02 — LayerZero V2 OFT 6-shared-decimal truncation strands sub-1e12 Base dust and permanently locks corresponding newGlaze reserve
Review: Gebal × Gemini 4 Argon · October 14 follow-up (token/migration-draft, run cf96e0f2-795c-4685-b10d-21f9105b7688). Reviewed source:3401450e038a136b17b935eb4ad6107ee0b5320b. Model:gemini-4-argon.
Description:GlazeMigration is deployed exclusively on Robinhood Chain (chainId == 4663) and has no owner or reserve-sweep mechanism, while reconcile.mjs funds reserve = 213598107624237620499693000 raw 18-decimal units across both Base and Robinhood. Because OLD_GLAZE on Base uses LayerZero V2 OFT 6 shared decimals (10^12 raw units = 0.000001 GLAZE), any holder balance on Base with a non-zero remainder modulo 10^12 cannot be bridged to Robinhood Chain; those sub-0.000001 GLAZE remainders on Base and their matching newGlaze units inside GlazeMigration are permanently locked.
Disposition: ACCEPTED_RISK.
Response: Documented in token/migration-draft/README.md:86-88 and reconcile.mjs:172. Including full 18-decimal dust in reserveRaw conservatively over-collateralizes the Robinhood migrator so no bridgeable claim can ever fail for lack of newGlaze, while omitting an admin sweep function preserves trustless reserve custody.
GEBAL-MIG-03 — Caller-bound migration (msg.sender) excludes smart contract holders without arbitrary execution on Robinhood Chain
Review: Gebal × Gemini 4 Argon · October 14 follow-up (token/migration-draft, run cf96e0f2-795c-4685-b10d-21f9105b7688). Reviewed source:3401450e038a136b17b935eb4ad6107ee0b5320b. Model:gemini-4-argon.
Description:GlazeMigration.migrate(uint256) pulls OLD_GLAZE from msg.sender and transfers newGlaze to msg.sender without a migrateFor or cross-chain receiver flow. Any OLD_GLAZE held by a smart contract on Robinhood that cannot execute OLD_GLAZE.approve + GlazeMigration.migrate, or held by a Base smart-contract wallet that bridges to an address on Robinhood where it cannot execute transactions, cannot be migrated; likewise, bridging or transferring OLD_GLAZE directly to address(glazeMigration) permanently strands the tokens.
Disposition: ACCEPTED_RISK.
Response: Intentional design (token/migration-draft/README.md:77-85) to eliminate third-party approval front-running and recipient redirection risks. The migration UI will require Base holders to bridge to a wallet they control on Robinhood Chain (4663) and block address(glazeMigration) as a recipient.
GEBAL-MIG-04 — Replacement token (newGlaze) implementation is unpinned in scope and must satisfy strict fee-free 1:1 transfer semantics
Review: Gebal × Gemini 4 Argon · October 14 follow-up (token/migration-draft, run cf96e0f2-795c-4685-b10d-21f9105b7688). Reviewed source:3401450e038a136b17b935eb4ad6107ee0b5320b. Model:gemini-4-argon.
Description:GlazeMigration accepts IERC20 newGlaze_ in its constructor and verifies only address(newGlaze_) != address(OLD_GLAZE), address(newGlaze_).code.length != 0, and decimals() == 18, then requires newGlaze.balanceOf(msg.sender) - balanceBefore == amount on every migrate() call. Any transfer fee, rebase, pause, blacklist, or balance-mutating hook in the eventual replacement token would cause migrate() to revert with InexactPayout (or transfer failure) and lock the funded newGlaze reserve.
Disposition: ACKNOWLEDGED.
Response: Tracked in token/migration-draft/README.md:60-62, 92-95. Once the pons launch deploys newGlaze, its address, non-upgradeable fee-free ERC-20 bytecode, 18 decimals, and 1B supply will be verified and tested on a Robinhood fork prior to deploying and funding GlazeMigration.
Review summary and follow-ups
Gebal × Google
This file collects the recorded reviews for this harness and company. Each section identifies the reviewed source and model; partial reviews and coverage limits are preserved.
Current project response
Project responses updated October 14, 2026. All 17 validated findings (GEBAL-CORE-01 through GEBAL-CORE-12 and GEBAL-TOK-01 through GEBAL-TOK-05) from the October 13, 2026 review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 and all 4 observations (GEBAL-MIG-01 through GEBAL-MIG-04) from the October 14, 2026 follow-up review of token/migration-draft (3401450e038a136b17b935eb4ad6107ee0b5320b) are recorded in this report. Frozen production contract findings remain pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active; prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Recorded outcome: COMPLETE (sourceOnly: true cold-review runs across both packages).
Coverage: Two Gebal CLI runs (e8813b27-a7c9-4d26-8166-2bee6a9b2c49 for packages/contracts with 34 source files and 77b36769-3b7f-447d-8bac-8254cd679eef for packages/contracts-token with 4 source files), each validated by gebal import-review, gebal report, and gebal check (ok: true, 0 schema/invariant errors). Recorded in docs/audits/gebal-gemini-4-argon.md.
Findings summary: 17 validated findings (1 High, 5 Medium, 10 Low, 1 Informational): 12 in packages/contracts (GEBAL-CORE-01..GEBAL-CORE-12) and 5 in packages/contracts-token (GEBAL-TOK-01..GEBAL-TOK-05).
Owner review: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Gebal × Gemini 4 Argon · October 14 follow-up (token/migration-draft)
Recorded outcome: COMPLETE (sourceOnly: true cold-review run cf96e0f2-795c-4685-b10d-21f9105b7688, snapshotHash: deca48b1b7b024c317adc408c2677c7ccc6fe23c29369e133a05d5164cf078c0, contextHash: 032fd8d593008eadc6d250391c5aa60f3da6ab1957115a9a6f22d3d4fa856729).
Coverage: 7 authorized files in token/migration-draft validated via gebal import-review, gebal report, and gebal check (ok: true, intake evidence 239de625c79a4f9358e3c21cb1bb40a8710bc49d3c97636e0a6f492960740485, review artifact eb7f35efe0a78198f09836e4c476f0491e8ed2ca9d7e40fc0daf9c19f638e841). Recorded in docs/audits/gebal-gemini-4-argon.md (Section 3.3).
Findings summary: 4 observations (GEBAL-MIG-01..GEBAL-MIG-04: 1 Medium, 2 Low, 1 Informational) covering off-chain treasury retirement assertions in reconcile.mjs, LayerZero V2 OFT 6-shared-decimal Base bridge dust (< 1e-6 GLAZE), msg.sender-bound migration semantics for smart contract holders, and replacement token (newGlaze) pre-funding verification. Zero exploitable flaws in GlazeMigration.sol's 1:1 swap and atomic rollback logic (PROP-MIG-01..PROP-MIG-03 hold).
Owner review: Finalized on-chain state (reconciliation-2026-10-14T19-32-39-183Z-cbf281c9a5ed4bbc.json) confirms excludedMultisigRaw == "0"; remaining operational items are tracked in the pre-funding migration checklist.
Original executable evidence and full report (docs/audits/gebal-gemini-4-argon.md) are retained in the repository. This is a source-specific public summary, not a complete-coverage certificate or professional audit by the harness author.
