Review history for OpenKritt × Anthropic; each dated run records its source-specific coverage and limits.
openkritt-anthropic.md
Loading report…
Original review plus 2 dated follow-up sections, with findings, accepted risks, fixes, deferred work and coverage limits in this file.
Initial review: GlazeCorp reviewed using Anthropic claude-fable-5-1; claude-opus-5-5 supplement at max reasoning effort with OpenKritt (pinned at 43e1d19a).
Focused tasks and finding validation. Breaks a review into smaller tasks, combines the results and supports validation and deduplication. Each run records which stages actually completed.
Anthropic claude-fable-5-1; claude-opus-5-5 supplement supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 2 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
Initial reviewed revision: e140b6724247425d2fa506d9bb31832d54be71c7Initial reviewed source. Each dated follow-up section records its own source revision, actual coverage, model identity and settings; later fixes are identified separately.
Review history for OpenKritt × Anthropic; each dated run records its source-specific coverage and limits.
openkritt-anthropic.md
Original review plus 2 dated follow-up sections, with findings, accepted risks, fixes, deferred work and coverage limits in this file.
Initial review: GlazeCorp reviewed using Anthropic claude-fable-5-1; claude-opus-5-5 supplement at max reasoning effort with OpenKritt (pinned at 43e1d19a).
Focused tasks and finding validation. Breaks a review into smaller tasks, combines the results and supports validation and deduplication. Each run records which stages actually completed.
Anthropic claude-fable-5-1; claude-opus-5-5 supplement supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 2 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
Initial reviewed revision: e140b6724247425d2fa506d9bb31832d54be71c7Initial reviewed source. Each dated follow-up section records its own source revision, actual coverage, model identity and settings; later fixes are identified separately.
Findings and responses
Project responses updated October 9, 2026. Latest inventory: 133 observations including duplicates; 125 accepted, two locally remediated Periphery observations, six deferred in whole or part, zero undecided contract portions. The Periphery fix passed 43 contract and 21 SDK tests; the owner waived its additional independent re-audit, which was not run. Acceptance is not remediation; deferred work stays open.
Project responses updated October 5, 2026. Original reviewer labels are preserved. Accepted risks are not fixes; local verification is separate from independent re-audit. Findings refer to the source revision on this report, not every later contract change.
This index includes reported findings, leads and rejected observations from the recorded passes. Repeated or overlapping entries are retained with their source IDs; they must not be counted as separate confirmed vulnerabilities.
R002-KRITT-FABLE-001 — Zero-weight streams are lost; BribeRouter.route has no weight guard; a killed Strategy's Bribe share has no possible recipient
Severity: Low.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-008 — Direct Bribe routing can start a stream with no signal weight.
Disposition: Accepted zero-weight Bribe funding risk; no contract change.
Response: The owner conditionally accepted this finding if Curve MultiRewards retains the same zero-stake behavior, preferring minimal deviation from the upstream accounting. A read-only comparison confirms that condition. This is project risk acceptance, not a fix or an upstream security endorsement.
Remaining work / limits: Keep the loss of elapsed unallocated rewards and permissionless-admission difference explicit in reward documentation. Preserve the upstream comparison, original audit observations and evidence limits. No contract changes, tests, deployed-behavior verification, broader safety conclusion, or freeze closure are claimed.
Project review: R002-FINAL-009 — A Bribe stream can lose its final signal after a valid start.
Disposition: Accepted later-zero Bribe stream risk; no contract change.
Response: The owner explicitly accepted this finding after reviewing that Curve MultiRewards retains the same empty-period accounting. Preserve the inherited accounting for simplicity; this records an accepted limitation, not a fix or upstream endorsement.
Remaining work / limits: Keep the empty-interval loss and preserved previously earned claims clear in reward documentation. Preserve original source observations, upstream-comparison evidence and execution limits. No contract change, new test, live verification or source-freeze closure is claimed.
Project review: R002-FINAL-010 — Resonance routing only checks signal weight at the start.
Disposition: Accepted Resonance zero-signal behavior; no contract change.
Response: The owner chose to leave the current implementation unchanged, citing prior Veridise review and a preference to avoid further changes. Retain the existing start guard and accept the later-zero stream behavior. This disposition does not expand the historical auditor's verified scope or imply that an accepted limitation is fixed.
Remaining work / limits: Keep the difference between buffered new revenue and elapsed unallocated revenue clear in documentation. Preserve the existing guard, accrued entitlements and stream accounting during unrelated later work. Original evidence, severity disagreements and historical audit scope remain preserved. No code change, new execution, deployment verification or freeze closure is claimed.
Project review: R002-FINAL-011 — Retired Strategies can continue directing payments to unclaimable Bribes.
Disposition: Accepted retired-Strategy Bribe funding risk; no contract change.
Response: The owner reconfirmed the historical GZ-002 acceptance after reviewing that residual Auction sales can continue adding Bribe funding after retirement and final signal exit. Retain the current contracts for simplicity; potentially stranded amounts are not limited to rounding dust.
Remaining work / limits: Retain the existing GZ-002 follow-up to explain the permanent unearned-reward consequence before retirement and in documentation. Preserve current withdrawal and earned-claim rights, original observations and their evidence limits. No contract change, new execution, deployed UI verification or source-freeze closure is claimed.
R002-KRITT-FABLE-002 — Launchpad sets minimumPrice equal to the start price; the Auction clock runs while empty, so lots can leave for zero payment and restart at the same floor
Severity: Low.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-026 — Core auctions can clear at zero price after idle decay.
Disposition: Accepted core Auction idle decay and zero-price sales; no contract change.
Response: The owner explicitly accepted finding 026 after reviewing that the auction clock continues while empty, incoming revenue does not reset it, and minimumPrice is a next-epoch starting floor rather than a permanent purchase-price floor. This reconfirms the documented economic policy.
Remaining work / limits: Preserve accurate auction-decay and floor semantics in documentation and client descriptions. Retain original auditor findings and historical acceptance as separately attributed evidence. No contract change, new test execution, deployment verification or source-freeze closure is claimed.
R002-KRITT-FABLE-003 — Fee custody runs inside every LP operation; a pool asset that blocks or taxes transfers to the shared hook locks LP exits in every market of that asset
Severity: Low (Medium if the deployed USDG issuer can block arbitrary addresses).
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-001 — A token issuer can block FullRange principal withdrawals.
Fix: FullRange now uses one salted native V4 position per wrapper, one share per native liquidity unit, permanently locked initial shares, and separate creator/protocol role balances backed by PoolManager ERC-6909 claims. Principal operations realize fees without transferring fee tokens to the hook. Permissionless role/currency payouts redeem directly to fixed current recipients; each call is bounded to the signed settlement limit. PoolManager fee-realization limits and supported-token risks remain accepted.
Status: Implemented; focused local verification passed; dated follow-up reviews recorded separately with coverage limits.
Local verification (recorded October 5): Native FullRange unit/fuzz checks, shared-PoolId isolation and aggregate-claim invariants, fee-transfer-blocked principal withdrawal, failed independent-claim rollback and bounded aggregate payout regressions passed.
Independent follow-up: Source-specific reviews ran October 6 and October 8; see the dated follow-up sections in this report and the tools and supplementary reviews for actual coverage and limits. These reviews are not blanket confirmation of every historical fix or the later Periphery option.
Project review: R002-FINAL-081 — A rejected Mine revenue push can stop paid mining.
Disposition: Accepted synchronous Mine revenue-delivery dependency; no additional contract change.
Response: The owner accepts atomic payment/revenue delivery and the existing future-revenue redirection option rather than introducing another queue or accounting mechanism in Mine.
Remaining work / limits: Retain this dependency and recovery limits in operations guidance and production token verification. No additional contract remediation, source change, runtime test, live recovery or deployment is claimed.
R002-KRITT-FABLE-004 — Fee beneficiaries and the 70/30 split are resolved at collection time; the setters do not collect first
Severity: Low.
Original observation status: confirmed in existing post-seal evidence review.
Fix: Realized fees are recorded by wrapper, currency and role rather than historical wallet. Claims resolve the current creator or protocol recipient. A zero protocol recipient pays existing protocol credit to the current creator for that currency; disabled-period creator allocations acquire no retroactive protocol debt. Legacy deployed address-owned credits remain in their original contracts; no conversion or migration was executed.
Status: Implemented; focused local verification passed; dated follow-up reviews recorded separately with coverage limits.
Local verification (recorded October 5): Native recipient rotation, enabled/disabled/re-enabled allocation, fallback, independent payout rollback, rounding and PoolManager backing checks passed.
Independent follow-up: Source-specific reviews ran October 6 and October 8; see the dated follow-up sections in this report and the tools and supplementary reviews for actual coverage and limits. These reviews are not blanket confirmation of every historical fix or the later Periphery option.
R002-KRITT-FABLE-005 — First-come registration of an unordered pair on the shared hook is permanent
Severity: Low.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-022 — Unfunded public pair registration can reserve a market indefinitely.
Fix: Removed FullRangeFactory. FullRange directly creates and registers independent wrappers, enumerates all wrappers per PoolId and separates pool initialization from wrapper funding. Launchpad atomically registers, seeds and hands off ownership using the wrapper address. SDK discovery and indexer entities distinguish wrapper identity from shared PoolId. The subsequent first-release simplification removes legacy v5/v6 adapters from the current client. Existing deployments retain their original on-chain behavior.
Status: Implemented; focused local verification passed; dated follow-up reviews recorded separately with coverage limits.
Local verification (recorded October 5): Native tests passed for abandoned registration, independent first funding, existing-price later funding, atomic launch rollback and ownership handoff. Runtime size is under the chain limit; final deployment and integration checks are recorded in the remediation ledger.
Independent follow-up: Source-specific reviews ran October 6 and October 8; see the dated follow-up sections in this report and the tools and supplementary reviews for actual coverage and limits. These reviews are not blanket confirmation of every historical fix or the later Periphery option.
R002-KRITT-FABLE-006 — Position touches floor sub-unit fees; collect is guarded but one-share removals and dust deposits are not
Severity: Low.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-024 — Shared V4 position updates can discard fractional raw fees.
Disposition: Accepted native V4 fractional-fee rounding; no additional contract change.
Response: After confirming that the fee conversion and checkpoint advance occur in Uniswap V4 core, the owner accepted this inherited precision limitation. FullRange controls when it updates a position and retains its existing partial collection guard. This reconfirms prior acceptance without treating upstream behavior as a formal upstream risk endorsement.
Remaining work / limits: Retain rounding disclosures and preserve the existing partial guard when implementing findings 001 and 022. Verify per-wrapper position identity for the adapted guard in that later implementation phase. Preserve original severity and evidence records; acceptance is not a fix or proof of negligible impact for every asset. No additional contract change, new test execution, deployment verification or source-freeze closure is claimed.
R002-KRITT-FABLE-007 — A launch needs about 18.1M to 32.6M gas; the largest admitted configuration exceeds a 32M cap
Severity: Low (liveness, chain-dependent).
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-038 — Valid launch parameters can exceed a chain's transaction gas limit.
Response: The owner accepted the limited operational impact after confirming that failed launches revert atomically and callers can omit additional Strategies at launch, then chose to move to the next finding.
Remaining work / limits: Keep the gas-estimation and oversized-launch guidance in client remediation notes and recheck complete launch costs after the approved FullRange changes. No contract or UI implementation, new runtime test, deployment or source-freeze closure is claimed.
R002-KRITT-FABLE-008 — GlazeRevenueSplitter cannot rotate away from a team recipient that cannot receive USDG
Severity: Low.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-025 — Paying the old team recipient can block splitter rotation.
Fix: GlazeRevenueSplitter.setTeamRecipient now updates configuration without transferring tokens. Permissionless split sends floor(current USDG balance / 2) to each current destination and retains an odd raw unit. Removed totalToEach and historical distribution bookkeeping; preserved validation, reentrancy guard and atomic payout rollback.
Status: Implemented; focused local verification passed; dated follow-up reviews recorded separately with coverage limits.
Local verification (recorded October 5): All 57 token-contract tests passed with 1,024 fuzz iterations, including current-wallet payout, odd carry, independent recipient updates, authorization and failed-payout rollback; token workspace typecheck passed.
Independent follow-up: Source-specific reviews ran October 6 and October 8; see the dated follow-up sections in this report and the tools and supplementary reviews for actual coverage and limits. These reviews are not blanket confirmation of every historical fix or the later Periphery option.
R002-KRITT-FABLE-009 — GlazeBuybackAuction can be filled for zero GLAZE after any idle epoch; next epoch restarts at minimumPrice
Severity: Low (design acknowledged in source; configuration-sensitive).
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-027 — An idle buyback auction can distribute revenue without retiring GLAZE.
Disposition: Accepted buyback idle decay and zero-retirement sales; no contract change.
Response: The owner accepted that the GLAZE buyback auction can distribute USDG while retiring zero GLAZE after its price fully decays. This reconfirms the previously documented economic policy and applies the same retained decay direction as finding 026 to the buyback contract.
Remaining work / limits: Keep public buyback explanations accurate about zero-retirement sales and distinguish revenue funding from actual GLAZE retirement. Preserve original ratings, historical acceptance and evidence limits. No contract change, new test execution, deployment verification or source-freeze closure is claimed.
R002-KRITT-FABLE-010 — At price zero anyone can assign the Mine slot to any non-Fund address; emission to unusable addresses dilutes redemption; Mine/Periphery self-assignment strands proceeds
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-003 — Unreachable Mine beneficiaries can dilute other Coin holders.
Disposition: Accepted recipient-loss risk; no additional contract change.
Response: The owner accepted recipient-loss risk after reviewing that transferable tokens cannot guarantee a recipient's continuing control or ability to redeem. Keep the existing supply calculation; this is a policy disposition, not a claim that the reported behavior was fixed or that no partial safeguards are possible.
Remaining work / limits: Retain recipient-loss disclosure and the existing supply and recipient-check behavior. Preserve the source reports, differing severity assessments and execution limits. This owner disposition does not invalidate the source observations, add verification, or close the source freeze.
R002-KRITT-FABLE-011 — Direct Fund.redeem counts Fund-held Coin and pending emission in the denominator; the web app redeems directly for FullRange launches
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-004 — Direct Fund redemption includes the Fund's unburned Coin.
Disposition: Accepted existing direct-call behavior; no contract change for this finding.
Response: The owner accepted that pre-existing Fund-held Coin stays in the redemption denominator until actually burned. This behavior can be mitigated by burning first and is not an unavoidable technical limitation; the current Periphery helper already performs that maintenance burn atomically before redemption.
Remaining work / limits: Document direct versus burn-first redemption behavior and retain existing user bounds and helper semantics. Continue reviewing client quote/transaction consistency under finding 005. Original reports and evidence limits remain unchanged; no contract fix, client verification, or freeze closure is claimed.
R002-KRITT-FABLE-012 — The creator can divert all future mining revenue; managed-mode Strategy capture; killing the only weighted Strategy strands the stream
Severity: Informational (creator trust boundary).
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-053 — Creator authority includes future revenue redirection and Strategy selection.
Response: The owner confirms that creator control over future revenue and Strategy administration is intentional. Creators who want governance-controlled administration can choose onchain governance rather than requiring that architecture for every fund.
Remaining work / limits: Keep current authority disclosure in documentation and UI integration work. Any future governance adoption should verify ownership acceptance, executor permissions and remaining separate roles. No governance deployment, ownership transfer, source/UI change or newly verified decentralization is claimed.
Project review: R002-FINAL-012 — Strategy retirement and zero live weight do not stop all scheduled revenue effects.
Disposition: Accepted retirement-triggered zero-signal risk; no contract change.
Response: The owner accepted this retirement-triggered route to the same zero-signal stream condition reviewed under finding 010. Keep the current implementation and preserve existing guards and earned entitlements.
Remaining work / limits: Retain clear retirement disclosures distinguishing live Strategy count, eligible signal, active streams and accrued claims. Preserve original report wording while noting its scope in the consolidated record. No contract change, new execution, live verification or source-freeze closure is claimed.
R002-KRITT-FABLE-013 — Stream limits: lifetime cap never resets; fee-on-transfer reward shortfall; permissionless stream restart lowers the rate; checkpoint rounding
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Disposition: Accepted lifetime funding caps and full-balance routing; no contract change.
Response: The owner reconfirmed historical GZ-012 acceptance after reviewing the permanent cumulative limit, the full-balance routing consequence and the very large headroom for ordinary intended assets.
Remaining work / limits: Keep lifetime-cap and full-balance routing limitations in asset and operations documentation; monitor remaining capacity where relevant. No contract change, new executable validation, live-chain action or source-freeze closure is claimed.
Disposition: Accepted Bribe reward-token funding shortfall risk; no contract change.
Response: The owner accepted the exact-transfer reward-token assumption and the possibility that an incompatible admitted token leaves rewards underfunded and later claims unable to complete. Retain the current simple funding implementation.
Remaining work / limits: Keep exact-transfer reward-token requirements and possible underfunded claims explicit in reward admission and compatibility documentation. Preserve original conditional evidence and ratings; accepted risk is not a verified fix. No contract change, new test execution, live-asset validation, deployment verification or source-freeze closure is claimed.
Disposition: Accepted reward-stream restart timing; no contract change.
Response: The owner accepted that qualifying new funding resets the seven-day schedule and can push completion back, choosing to retain the current simple combined-budget stream with its existing funding safeguards.
Remaining work / limits: Keep the fresh seven-day schedule and qualifying-funding rules explicit in reward documentation. Preserve historical and current evidence boundaries. No contract change, new test execution, deployment verification or source-freeze closure is claimed.
Disposition: Accepted fractional checkpoint rounding loss; no contract change.
Response: The owner accepted the existing rounding behavior after reviewing that fractions are discarded when accounting advances, more frequent updates can increase the loss, and preserving those fractions would require additional accounting. This records acceptance of the limitation, not a verified fix or a universal claim that its economic impact is negligible.
Remaining work / limits: Keep the permanent fractional-entitlement loss and denomination-dependent impact explicit in reward-accounting documentation. Preserve original auditor conclusions, severity and evidence limits. No contract change, new test execution, deployment verification or source-freeze closure is claimed.
R002-KRITT-FABLE-014 — A callback-capable base token gains control inside the launch; privileged actions fail, ordinary public actions succeed; same-block indexer behaviour
Severity: Informational.
Original observation status: BLOCKED; pending human confirmation.
Project review: R002-FINAL-040 — Launch callbacks can observe ordinary public activity before launch completes.
Disposition: Accepted callback-time public activity during launch; no contract change.
Response: The owner accepted the described behavior after reviewing that callback-capable tokens may trigger ordinary paid public activity during launch, while the cited prior tests did not establish extra minting or administrative authority, unpaid extraction or LP-share theft.
Remaining work / limits: Preserve accurate initial-versus-current state labeling and the original evidence limits. Complete the separately pending human confirmation and indexer review without treating this acceptance as verification. No contract implementation, new test, live transaction or source-freeze closure is claimed.
Project review: R002-FINAL-041 — Indexer handling of events before the launch event needs confirmation.
Disposition: Accepted contract event ordering; indexer verification and any required fix pending.
Response: After clarifying that the concern is off-chain processing rather than disappearing trades or tokens, the owner agreed to accept the contract behavior. The indexer verification remains an explicit follow-up rather than treating possible missing history as resolved.
Remaining work / limits: Retain a separate indexer verification task covering launch setup deduplication and genuine earlier activity; fix confirmed omissions and verify the resulting records. No contract, indexer or test change, new runtime execution, deployment or source-freeze closure is claimed.
R002-KRITT-FABLE-015 — Launchpad renunciation freezes protocol fee recipient and rate for every Mine; other renunciation, delegate and typed-helper ownership properties
Severity: Informational (ownership and renunciation).
Original observation status: confirmed in existing post-seal evidence review.
Response: The owner accepts responsibility for authorized ownership actions and wants the UI to handle those actions clearly rather than changing contract ownership mechanics.
Remaining work / limits: Implement and verify the administration UI address review, handoff-state explanations and renunciation confirmations during remediation. No contract or UI implementation, runtime validation, deployment verification or source-freeze closure is claimed here.
Project review: R002-FINAL-033 — OFT ownership and endpoint delegate authority can diverge.
Disposition: Accepted LayerZero owner/delegate separation by design; no contract change.
Response: The owner chose to keep the upstream role separation by design. LayerZero documents delegate configuration separately from ownership transfer; the project accepts the operational consequences rather than adding automatic synchronization.
Remaining work / limits: Document intentional owner/delegate configurations and review both roles during operational handoffs. Official reference checked October 4: https://docs.layerzero.network/v2/get-started/create-lz-oapp/configuring-pathways (separate delegate and owner configuration). No contract or UI implementation, new executable validation, live-state verification or source-freeze closure is claimed.
Response: The owner states that splitter ownership will not be renounced and considers replacement deployment an additional operational option. Retained ownership preserves recipient-rotation authority; replacement deployment alone is not recovery of existing funds.
Remaining work / limits: Keep ownership retention and replacement-migration limits explicit in operations guidance. If replacement is needed, verify deployment bindings, upstream redirection permissions and treatment of old balances/claims. No additional contract remediation or completed recovery is claimed.
Disposition: Accepted compatible-contract controller scope; no additional registry restriction.
Response: The owner accepts the intended flexibility to administer compatible LP contracts. The existing ownership-interface check is not proof of canonical FullRange identity, and the report did not establish an unauthorized action through these owner-only helpers.
Remaining work / limits: Retain accurate helper-scope documentation and verify official-wrapper identity in relevant client integration work, including the approved multi-wrapper redesign. No additional contract restriction, source/UI change, runtime execution or completed fix is claimed.
R002-KRITT-FABLE-016 — GLAZE revenue contracts bind tokens without identity checks and have no deploy/verify scripts; wiring hazards strand non-USDG assets
Severity: Informational (deployment and wiring).
Original observation status: confirmed in existing post-seal evidence review.
Disposition: Accepted deployment configuration risk with existing post-deployment verification; no contract change.
Response: The owner confirmed that deployment verification scripts are used after deployment to check the resulting configuration and chose to rely on that release process.
Remaining work / limits: Keep post-deployment verification as a release requirement and retain results for the exact deployed configuration. No verifier execution, deployment, source implementation or source-freeze closure is claimed in this decision.
Project review: R002-FINAL-080 — Misrouted non-USDG revenue assets can have no exit.
Disposition: Accepted misrouted-asset stranding risk; no rescue function or contract change.
Response: The owner accepts that the dedicated USDG revenue contracts do not recover arbitrary tokens sent to them. The chosen mitigation is correct asset/destination configuration rather than additional recovery authority.
Remaining work / limits: Retain asset/destination compatibility checks and clear routing guidance in configuration and deployment work. No contract remediation, recovery guarantee, new runtime verification, deployment or completed fix is claimed.
R002-KRITT-FABLE-017 — A shared-ledger alias token is paid once per alias by Fund.redeem; Periphery's receiver-delta check accepts it
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-031 — Fund treats shared-ledger aliases as distinct backing assets.
Disposition: Accepted unsupported shared-ledger asset risk; no contract change.
Response: The owner accepts the risk as arising from unsupported asset behavior and chose not to add special accounting for multiple token addresses exposing one underlying balance.
Remaining work / limits: Keep supported-token documentation and integration screening clear about shared-ledger aliases. No contract implementation, new executable validation, deployment verification or source-freeze closure is claimed.
R002-KRITT-FABLE-018 — Read-only reentrancy window: position liquidity changes before LP supply, so quote views are transiently inconsistent
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Disposition: Accepted callback-time quote integration risk; no additional contract change.
Response: The owner accepted the limitation after reviewing that intermediate liquidity/share state may be visible to callback-time readers, while the reports did not identify an in-scope lending consumer or resulting loss in this system.
Remaining work / limits: Keep quote limitations in integration documentation and review wrapper-specific quote behavior during planned remediation. No contract or client implementation, new runtime validation, deployment or source-freeze closure is claimed.
R002-KRITT-FABLE-019 — More than int128-max raw fee units between touches bricks a market through the v4-core cast
Severity: Informational.
Original observation status: BLOCKED; pending human confirmation.
Project review: R002-FINAL-002 — Extreme accumulated V4 fees can prevent position changes and exits.
Disposition: Accepted risk; no contract change for this finding.
Response: The owner chose to retain the native Uniswap V4 full-range design and accept its accumulated-position-fee limit rather than add a separate prevention mechanism. The limit remains present; this decision does not establish that intended assets cannot reach it.
Remaining work / limits: Keep the accepted limitation visible in release and asset-compatibility documentation, and assess intended assets' supply and issuer powers without claiming that work is already complete. Preserve existing fee-processing behavior during the finding-001 refactor. Original evidence and OpenKritt Claude 019's pending human confirmation remain unchanged. No fix, new test, live-asset safety determination, or freeze closure is claimed.
R002-KRITT-FABLE-020 — An OperationsPeriphery run sized from an earlier estimate reverts as a whole when one more operation becomes ready
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-052 — Newly ready work can make an estimated operation batch revert.
Response: The owner accepts that changing readiness between estimation and execution may increase gas use and make the maintenance batch revert. The whole transaction rolls back, preserving funds and claims, while an included failed transaction still costs the caller gas.
Remaining work / limits: Retain batch rollback disclosure and gas/retry guidance in client and keeper integration work. Verify relevant client handling when implemented and preserve the separate finding-045 helper requirements. No contract, UI, test or deployment change or new runtime validation is claimed.
R002-KRITT-FABLE-021 — Event and binding integrity: MetadataURISet never emitted; forwardToken event uses caller-chosen token; tooling binds an archived ABI
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-046 — Metadata consumers must follow the actual emitting contract.
Fix: Removed FundController.MetadataURISet and LiquidityFeeRecipientsSet plus the duplicate emit. Forwarding and ownership checks remain. Coin emits TokenURISet; FullRangeERC20 emits CreatorRecipientsSet. Regenerated current ABIs; legacy indexer ABIs remain explicitly pinned.
Status: Implemented; focused local verification passed; dated follow-up reviews recorded separately with coverage limits.
Local verification (recorded October 5): Authorized forwarding, refusal of unauthorized calls and exact canonical event-emitter checks passed in FullRangeControllerOwnershipTest as part of the 51-test launch/controller regression run.
Independent follow-up: Source-specific reviews ran October 6 and October 8; see the dated follow-up sections in this report and the tools and supplementary reviews for actual coverage and limits. These reviews are not blanket confirmation of every historical fix or the later Periphery option.
Response: After clarifying that FeesForwarded includes the token address, amount, recipient and caller, the owner agreed to move on with the event behavior retained. The remaining concern is how consumers label and attribute amounts, not an established defect in the event or loss of protocol funds.
Remaining work / limits: Retain the analytics attribution guidance for client/indexer work. No source, UI, test or deployment change, newly executed verification or fixed active analytics defect is claimed.
Project review: R002-FINAL-055 — Some token tooling binds an archived artifact ABI.
Disposition: ABI tooling verification and cleanup noted; implementation and verification pending.
Response: The owner requested that the tooling follow-up be recorded. Shared ABI functions may remain compatible, so the active release and actual call surface must be checked before treating an archived binding as a broken integration.
Remaining work / limits: After freeze closure, verify active-release ABI/artifact bindings, make any needed tooling cleanup and validate affected call/event encoding and decoding against the intended contracts. Implementation and verification remain pending; no source, generated binding, deployment or new runtime check is claimed here.
R002-KRITT-FABLE-022 — Disclosure, documentation and tooling drift (LPs earn no swap fees vs FAQ; LP naming; stuck donations; size margin; NOTICE; dependencies; tooling)
Severity: Informational.
Original observation status: confirmed in existing post-seal evidence review.
Project review: R002-FINAL-047 — FullRange has limited bytecode size headroom.
Disposition: Accepted bytecode size maintenance constraint; no separate contract change.
Response: The owner accepts the limited size margin in the audited build. Exceeding the applicable deployment limit would prevent deploying that build; this finding does not establish a withdrawal, fee-accounting or asset-loss defect in an already deployed contract.
Remaining work / limits: Remeasure FullRange after the approved implementation changes and before deployment. This owner acceptance records a maintenance constraint; no source change, new build, deployment or completed remediation is claimed.
Project review: R002-FINAL-056 — LP swap-fee expectations disagree with some public documentation.
Disposition: LP fee docs/UI correction noted; implementation and verification pending.
Response: The owner requested that misleading LP and protocol swap-fee expectations be corrected in documentation and UI. LP share ownership does not itself confer creator fee rights; public descriptions must match the implemented allocation and recipient authority.
Remaining work / limits: Update and verify affected documentation and UI explanations against the implemented release during remediation. Docs/UI correction remains pending; no contract or published UI change, deployment or completed verification is claimed.
Project review: R002-FINAL-057 — All LP tokens share the same display name and symbol.
Disposition: Accepted shared LP naming; no contract change.
Response: The owner pointed out that Uniswap V2 also uses shared LP metadata and chose to proceed with naming unchanged. The upstream source was checked and defines the common name Uniswap V2 and symbol UNI-V2; this supports the naming comparison, not a security endorsement of the broader implementation.
Remaining work / limits: Keep address-based identification and clear display context in integration work. No additional contract remediation is selected; no source, UI, test or deployment change is claimed.
Project review: R002-FINAL-058 — Direct token transfers to the FullRange hook have no recovery claim.
Disposition: Accepted direct-transfer stranding risk; no recovery function or contract change.
Response: The owner accepts that sending tokens directly to the hook is not a supported liquidity deposit and may leave the tokens unrecoverable. The selected approach is clear funding-path guidance rather than an additional admin recovery mechanism.
Remaining work / limits: Retain correct-funding-path guidance in release UI/docs and preserve the distinction between unsolicited balances and legitimate claims during the FullRange redesign. No contract change, recovery guarantee, new test, deployment or completed UI/docs fix is claimed.
Project review: R002-FINAL-059 — Build, dependency and default-value documentation has drift.
Disposition: Build and documentation maintenance follow-up noted; implementation and verification pending.
Response: The owner requested that the bundled maintenance observations be tracked for review and cleanup. Their mixed source and executed evidence calls for checking each against the intended release, not applying blanket changes or claiming an established fund-loss defect.
Remaining work / limits: After freeze closure, verify the listed maintenance subclaims against the intended release, correct confirmed documentation/tooling mismatches and validate affected build and coverage workflows. Keep economic-default and dependency-version changes separately reviewed. No source, dependency, compiler, test, UI or deployment change, new runtime execution or completed fix is claimed.
<!-- current-followups -->
OpenKritt × Opus 5.5 · October 6 follow-up — FP-03 (Low) The creator can redirect Fund-designated LP fees, including realized-unclaimed balances. receiveSwapFees=false is not binding, and the UI and indexer show the launch-time flag.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: INTENDED, DEFERRED.
Response: FR06: INTENDED — Retain current-recipient and realization-time fee allocation, including prior unclaimed balances. No entitlement snapshot change. DOCS: DEFERRED — Documentation and client disclosure recorded for later under the owner directive. No completion or acceptance of a defect is inferred.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-02 (Low) Splitter: both legs must succeed atomically, there is no rescue path, and renounceOwnership is enabled. A USDG freeze of one leg locks all routed revenue.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: ACCEPTEDRISK, ACCEPTEDRISK.
Response: SPLITTER: ACCEPTEDRISK — Retain atomic splitter legs, immutable auction, no pause/rescue and inherited renunciation. Keep ownership; replacement directs eligible future fees only and cannot recover old trapped balances. TK04: ACCEPTEDRISK — Retain standard exact-transfer/non-rebasing token assumptions. This does not approve actual issuer behavior or unsupported assets.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-09 (Low, environment-dependent) Launch gas exceeds plausible per-transaction caps for configurations that _validate and the web app accept.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: ACCEPTED_RISK, DEFERRED.
Response: GAS: ACCEPTED_RISK — Retain launch configuration limits despite potentially excessive maximum-configuration gas; actual chain gas feasibility remains required. OFFCHAIN: DEFERRED — Non-contract backlog recorded for later under the owner directive. No completion or acceptance of a defect is inferred.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-04 (Low) Permissionless pokes floor sub-unit fee accruals; collect()'s guard does not prevent it.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: ACCEPTED_RISK.
Response: FR01: ACCEPTED_RISK — Retain native V4 fractional fee rounding, including permissionless update frequency; no fractional fee carry.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-05 (Low) Fee-claim destinations are not validated (creator recipients, protocol recipient).
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: ACCEPTED_RISK.
Response: FR03: ACCEPTED_RISK — Retain configurable fee recipients and their custody/misconfiguration risk; no generic recovery guard.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-01 (Low, off-chain) The web coin-manager fee panels are unusable whenever Coin sorts after the base token. The recipient step also has a latent coin/base order bug.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: DEFERRED.
Response: OFFCHAIN: DEFERRED — Non-contract backlog recorded for later under the owner directive. No completion or acceptance of a defect is inferred.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-10 (Informational) Protocol-recipient toggles re-route accrued fees; the split is decided at realization time.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: INTENDED.
Response: FR06: INTENDED — Retain current-recipient and realization-time fee allocation, including prior unclaimed balances. No entitlement snapshot change.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-06 (Informational) Read-only reentrancy window in removeLiquidity.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: ACCEPTED_RISK.
Response: CALLBACK: ACCEPTED_RISK — Retain FullRange callback ordering and reentrancy guards. Callback-time views are not guaranteed coherent for external pricing.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-08 (Informational) First funding of a non-Launchpad wrapper inherits the shared PoolId price, which a third party can set with dust.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: INTENDED.
Response: SEED: INTENDED — Retain fresh-launch price setup and current-market pricing for subsequent wrappers; same-transaction quotes are not external price guarantees.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-07 (Informational) Quotes ignore V4 maxLiquidityPerTick.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: ACCEPTED_RISK.
Response: CAP: ACCEPTED_RISK — Retain shared native per-tick liquidity capacity; quotes are not guaranteed executable. Supported-domain verification remains open.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-15 (Informational) Non-unique wrapper labels, self-reporting look-alike wrappers, and FundController administering unregistered look-alikes.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: INTENDED, DEFERRED.
Response: GD01: INTENDED — Retain owner-only compatible-contract administration without canonical-registry enforcement; official-client identity work is deferred. OFFCHAIN: DEFERRED — Non-contract backlog recorded for later under the owner directive. No completion or acceptance of a defect is inferred.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-11 (Informational) Splitter team-recipient rotation can be front-run by split().
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: INTENDED.
Response: TK03: INTENDED — Retain current team recipient for unpaid revenue and transaction-order dependence.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-12 (Informational) The splitter constructor accepts any contract that reports the same usdg() as the immutable buyback destination, and the token package has no deploy/verify tooling in the snapshot.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: RELEASECHECKOPEN.
Response: DEP01: RELEASECHECKOPEN — Retain deployment verification as the control. Actual runtime, immutable graph, token and chain verification remain required.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-13 (Informational, documented design) Permissionless split() plus an auction price that decays to zero while empty allows atomic free fills after idle epochs.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: ACCEPTED_RISK.
Response: TK01: ACCEPTED_RISK — Retain idle time decay and zero-price fills, including permissionless funding cadence.
OpenKritt × Opus 5.5 · October 6 follow-up — FP-14 (Informational) VerifyLaunchpad couples immutable constructor inputs to mutable current state.
Review: OpenKritt × Opus 5.5 · October 6 follow-up. Reviewed source:91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Model: claude-opus-5-5. Settings: max requested; returned effort unavailable.
Disposition: DEFERRED.
Response: OFFCHAIN: DEFERRED — Non-contract backlog recorded for later under the owner directive. No completion or acceptance of a defect is inferred.
OpenKritt × Opus 5.5 · October 8 follow-up — outcome and project response
Review: OpenKritt × Opus 5.5 · October 8 follow-up. Reviewed source:ff973d5ca9e137f5561de88b22d8a53f221f9e19. Model: claude-opus-5-5. Settings: max requested; independent echo unavailable.
The provider blocked this attempt. It did not produce a completed review or a new registered finding. The attempted scope and block remain recorded in the review history.
Review summary and follow-ups
Status: Completed review with blocked evidence checks.
Result
Twenty-two reported findings: nine Low and thirteen Informational; most overlap earlier reports or accepted behavior.
Scope and limits
39/39 primary files reviewed. Five evidence reviews were later supplemented by Opus. Two findings await human confirmation after classifier stops.
Original run evidence is preserved separately. The findings and project responses on this page record the subsequent owner review and remediation status. This summary does not certify deployment safety or count historical Veridise and V12 work as coverage of this freeze.
<!-- current-followups -->
Current project response
Project responses updated October 9, 2026. Latest inventory: 133 observations including duplicates; 125 accepted, two locally remediated Periphery observations, six deferred in whole or part, zero undecided contract portions. The Periphery fix passed 43 contract and 21 SDK tests; the owner waived its additional independent re-audit, which was not run. Acceptance is not remediation; deferred work stays open.
OpenKritt × Opus 5.5 · October 6 follow-up
Reviewed source: 91206a4ed18c514cdad3f8e8b09e0ca08ffd3ffb. Status captured 2026-10-06.
Recorded outcome: COMPLETE.
Coverage: 11/11 primary files across 4 partitions; first pass sealed; executed validation; see attempt RECONCILIATION.md.
Runner model selection: claude-opus-5-5. Historical returned-model field: claude-opus-5-5 (step metadata, all 24 jobs; per-message identity not exposed). Separate server-attested identity: not independently returned. Requested reasoning setting max. Returned effort: max (step metadata).
Harness revision: 43e1d19a00ce50bd93253d1c6c3a48cfffbcc4c3. FullRange-focused scope and supporting integrations; this is not a new 39-contract review.
Later source changes include manager permissions, forced exit for revoked managers, buyback basket selection, richer events, launch caps, component getters, and fee-preparing Periphery redemption. October 8 follow-ups reviewed the resulting October 7 candidate. The later October 9 fee opt-out received local validation and owner acceptance with the additional re-audit waived.
Original executable evidence and provider transcripts remain private. This is a source-specific public summary, not a downloadable original, complete-coverage certificate or professional audit by the harness author.
OpenKritt × Opus 5.5 · October 8 follow-up
Reviewed source: ff973d5ca9e137f5561de88b22d8a53f221f9e19. Status captured 2026-10-09.
2026-10-08-claude-preflight-blocked-01: BLOCKEDPREDISPATCH. No exact workflow/runtime pinned; installed checkout dirty; bundled workflow records require malicious input, trigger flow and exploitable flag. No model call; no reduced substitute.
2026-10-08-full-method-blocked-02: BLOCKEDANTHROPICSAFETY_CLASSIFIER. Full-method run (owner-authorized) stopped by an Anthropic safety classifier during preparation; not retried or substituted.
2026-10-08-r003-method-blocked-04: BLOCKEDANTHROPICSAFETY_CLASSIFIER. Round-003-style run requested by owner; classifier stopped the coordinator while reviewing that configuration (direct stop). No scan created; not retried.
2026-10-08-defensive-subset-infeasible-05: DEFENSIVESUBSETNOT_FEASIBLE. Defensive subset not feasible: engine enforces malicious-actor/input/trigger-flow fields on every terminal finding. Not run; no scan created.
Identity/settings: Returned Opus 5.5 identity recorded; max effort requested/accepted locally but not independently echoed.
Owner review: All registered observations from this source have a decision. The two helper-redemption findings were remediated later in Periphery at 517e09a33ba1c5d506566b32398f254c5121d231; 43 contract and 21 SDK tests passed. The owner accepted that fix and waived its additional independent re-audit, which was not run.
Original executable evidence and provider transcripts remain private. This is a source-specific public summary, not a downloadable original, complete-coverage certificate or professional audit by the harness author.
