38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
openkritt-google.md
Loading report…
16 canonical findings (2 High, 5 Medium, 5 Low, 4 Informational) across initial and October 14 migration reviews; all pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with OpenKritt · 5-stage multi-agent pipeline.
Focused tasks and finding validation. Breaks a review into smaller tasks, combines the results and supports validation and deduplication. Each run records which stages actually completed.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
openkritt-google.md
16 canonical findings (2 High, 5 Medium, 5 Low, 4 Informational) across initial and October 14 migration reviews; all pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with OpenKritt · 5-stage multi-agent pipeline.
Focused tasks and finding validation. Breaks a review into smaller tasks, combines the results and supports validation and deduplication. Each run records which stages actually completed.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
Initial reviewed revision: c435fa3dbfa179aa9083134ba8729c2ac2d34dc0October 12, 2026 smart-contract audit freeze commit; October 14, 2026 follow-up on 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft).
Findings and responses
Project responses updated October 14, 2026. All 13 canonical findings (KRITT-01 through KRITT-13) from the October 13, 2026 OpenKritt × Google (gemini-4-argon) review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 and all 3 migration findings (KRITT-14 through KRITT-16) from the October 14, 2026 follow-up review of token/migration-draft (3401450e038a136b17b935eb4ad6107ee0b5320b) are currently pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. None of these findings have been addressed in contract source yet. Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Each observation retains its review date, source revision, model and project decision.
KRITT-01 — Unvalidated caller-supplied assets basket in GlazeBuybackAuction.buy bypasses EmptyRevenue, enabling zero-cost epoch resets, initialPrice ratcheting, and expectedEpochId griefing
Description:GlazeBuybackAuction.buy accepts an arbitrary address[] calldata assets array and sets hasRevenue = true if any assets[i] has balanceOf(address(this)) > 0, without requiring usdg to be swept when usdg.balanceOf(address(this)) > 0 or rejecting assets[i] == address(paymentToken). At currentPrice() == 0 (or near 0), an attacker can pass 1 wei of a dust token in assets[] to reset epochStartedAt = block.timestamp, increment epochId (griefing legitimate USDG buyers with EpochIdMismatch), and reset or ratchet initialPrice while leaving 100% of USDG unsold in the contract.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-02 — Shared Uniswap V4 PoolId across FullRange wrappers allows cross-wrapper front-running of initializeAndSeed to hijack initial sqrtPriceX96 and bypass quoteSeed bounds
Description: Multiple FullRange wrappers created for the same (currency0, currency1, swapFee) map to the same underlying Uniswap V4 PoolId. When initializeAndSeed calls quoteSeed, it checks poolManager.getSlot0(id) and silently adopts currentPrice if non-zero instead of computing FullRangeMath.seedPrice(amount0Max, amount1Max). For standalone wrappers created and seeded in separate transactions without tight amount0Min / amount1Min bounds, an attacker can front-run initializeAndSeed via a sibling wrapper to set an extreme initial sqrtPriceX96.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-03 — Permissionless Bribe.notifyReward (and Resonance.notifyRevenue) only checks amount >= remaining, allowing callers in the second half of a 7-day stream to slash rewardRate by up to 99.8%
Description: Both Bribe.notifyReward and Resonance.notifyRevenue are permissionless and check amount >= remaining (InsufficientRewardAmount / InsufficientRevenueAmount) before stretching budget = amount + remaining + remainder over a full new 7-day REWARD_DURATION (604,800 seconds) without requiring newRate >= oldRate. Near the end of an active stream, supplying amount == remaining stretches 2 * remaining over 604,800 seconds, slashing the active emission rate by up to 504x (99.8%).
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-04 — Missing bribe.totalSignalWeight() == 0 guard in permissionless BribeRouter.route() allows starting a 7-day stream with zero signal weight, permanently stranding rewards
Description: Unlike ResonanceRouter.route() (which returns 0 when totalSignalWeight() == 0), BribeRouter.route() does not check bribe.totalSignalWeight() == 0 before calling Bribe.notifyReward. If BribeRouter.route() (or Periphery.buy) is called while a strategy has zero SignalCoin weight, a 7-day stream begins in Bribe and all emissions during the zero-weight interval are permanently stranded in Bribe.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-05 — Post-kill Auction.buy() fills continue diverting bribeBps (up to 20%) of payments to the dead Strategy's BribeRouter, permanently stranding funds once signalers exit
Description: After Resonance.killStrategy(strategy) sets isStrategyLive[strategy] = false and blocks future addSignalFor calls, Auction.buy() still reads configuredResonance.bribeBps() without checking configuredResonance.isStrategyLive(address(this)). As the retired strategy auctions off its remaining USDG balance or active 7-day ResonanceRouter stream after signalers withdraw, up to 20% (bribeBps) of every auction payment continues to be sent to the dead strategy's BribeRouter and is permanently stranded.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-06 — Launchpad._completeOwnership transfers FullRangeERC20 ownership to FundController even when receiveSwapFees == false, and setCreatorRecipients redirects unclaimed Fund fees without checkpointing
Description: When a launch configures ownable == true and receiveSwapFees == false, Launchpad._seedPool sets (Fund, Fund) as the initial creator fee recipients on the FullRangeERC20 wrapper, but _completeOwnership still transfers ownership of FullRangeERC20 to FundController. The FundController owner can call setPoolCreatorRecipients at any time to overwrite (Fund, Fund) with custom wallets, redirecting both future swap fees and already-realized unclaimed _creatorFees in FullRange.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-07 — Mine.setRevenueRouter only validates newRouter.code.length != 0, allowing FundController owner to bypass the 2% MAX_CREATOR_FEE_BPS cap or DoS paid mine() replacements
Description: In managed launches (ownable == true), FundController.setMineRevenueRouter allows the launch owner to replace Mine.revenueRouter with any contract address (newRouter.code.length != 0). Because Mine._distributePayment sends the entire non-miner USDG cut (20% of gross mine() payments: 18% Resonance + 2% creator) to revenueRouter and calls IRevenueRouter(revenueRouter).route(), a custom router contract can divert the full 20% share to the owner or revert in route() to block all non-zero-price mine() replacements.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-08 — Permissionless FullRange.collect triggers V4 zero-liquidity fee checkpointing whenever either currency has >= 1 raw unit of fees (||), enabling sub-unit fee wiping on 6-decimal USDG
Description:FullRange._hasCollectibleFees returns true when either currency0 OR currency1 has accrued >= 1 raw unit of fees, and collect(pool) checkpoints both currencies simultaneously in Uniswap V4 PoolManager. In pools pairing 18-decimal Coin with 6-decimal USDG, calling collect() whenever Coin accrues >= 1 wei of fee resets the USDG fee growth baseline before it reaches 1 raw unit (1e-6 USDG).
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-09 — Direct Fund.redeem calls do not burn or subtract unburned Coin held by Fund before querying effectiveTotalSupply(), diluting direct redeemers after Coin Strategy Auction fills
Description: While Periphery._redeemFund calls Fund.burnCoin() before Fund.redeem(), Fund.redeem() itself does not burn or subtract coin.balanceOf(address(this)) from supplyBeforeBurn = IMine(coin.minter()).effectiveTotalSupply(). Direct callers to Fund.redeem() when Fund holds unburned Coin from Strategy 1 Auction purchases or FullRange.claim receive a diluted pro-rata share of treasury backing.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-10 — Mine.mine locks _globalTps() into _slot.tps only at replacement time rather than integrating piecewise across HALVING_PERIOD (30 days) boundaries
Description:Mine._accruedEmissions computes (block.timestamp - _slot.updatedAt) * _slot.tps using the _slot.tps snapshot taken when the current miner entered the slot, rather than integrating piecewise across 30 days halving boundaries. A long-lived miner who is not replaced across one or more halving boundaries continues earning at the pre-halving _slot.tps rate until replaced or until claim() is called.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-11 — FullRangeMath.liquidity overflows uint128 in LiquidityAmounts.getLiquidityForAmounts when one token cap is large and pool price is asymmetric, even when min(L0, L1) fits in uint128
Description:FullRangeMath.liquidity delegates to Uniswap V4 LiquidityAmounts.getLiquidityForAmounts, which downcasts both intermediate getLiquidityForAmount0 and getLiquidityForAmount1 results to uint128 via SafeCast.toUint128() before taking min(liquidity0, liquidity1). If a caller passes a generous approval cap (such as type(uint128).max) on the non-binding token side while sqrtPriceX96 is skewed, the non-binding branch reverts with SafeCastOverflow even though the binding liquidity min(L0, L1) fits comfortably in uint128.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-12 — FullRange.quoteSeed and quoteDeposit ignore Uniswap V4's tickSpacingToMaxLiquidityPerTick(60) limit (~1.15058e34) shared across all wrappers at [-887220, 887220]
Description: Every FullRange wrapper on a shared (currency0, currency1, swapFee) V4 pool places its salted liquidity on the identical ticks [-887220, 887220], sharing Uniswap V4's per-tick maxLiquidityPerTick cap (~1.15058e34 for tickSpacing = 60), which quoteSeed and quoteDeposit do not check.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-13 — OperationsPeriphery.run loads full LaunchRecord with 6 dynamic arrays and ABI-encodes it up to 50 times in isolated self-calls instead of using LaunchComponents
Description:OperationsPeriphery.run reads launchpad.launches(coin) (which copies 6 dynamic arrays into memory) and passes the entire LaunchRecord struct by value to external this.perform{gas: CALL_GAS}(record, ...) up to 50 times, even though perform() only needs the 5 fixed addresses returned by launchpad.launchComponents(coin).
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-14 — reconcile.mjs does not assert zero remaining multisig balance or verify that multisigBalanceRaw deltas match retiredBalanceRaw deltas and retirementTransfers sums
Description:reconcile.mjs checks totalSupply == 1e27, circulatingOutsideMultisigAndDead + multisigBalance + retiredBalance == totalSupply, and nonDeadSupply == circulatingOutsideMultisigAndDead + multisigBalance, and outputs nonDeadSupplyRaw as the recommended newGlaze reserve funding target without asserting multisigBalance == 0n or cross-checking that the historical multisig decrease (audit.multisigBalanceRaw - multisigBalance) equals the DEAD balance increase (retiredBalance - audit.retiredBalanceRaw) and the sum of retirementTransfers. Because GlazeMigration.migrate cannot distinguish multisig-held OLD_GLAZE from community OLD_GLAZE on-chain, funding GlazeMigration when multisigBalance > 0n either over-funds the contract or allows unretired multisig tokens to dilute community reserves.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded alongside the October 12, 2026 contract audit freeze; not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-15 — Unsolicited OLD_GLAZE direct transfers, cross-chain LayerZero V2 OFT bridging directly to GlazeMigration, and Base sub-1e12 wei OFT dust permanently lock backing newGlaze reserves
Description:GlazeMigration exposes no sweep or recovery function and settles claims strictly via safeTransferFrom(msg.sender, DEAD, amount) (L54). Consequently, any OLD_GLAZE transferred directly to address(GlazeMigration) cannot be retired or migrated, any newGlaze bridged from Base (8453) with SendParam.to = address(GlazeMigration) increases newGlaze.balanceOf(address(this)) without triggering migrate, and any Base GlazeOFT bridge amount is truncated to a multiple of decimalConversionRate = 1e12 (sharedDecimals = 6), leaving up to 1e12 - 1 wei (< 1e-6 GLAZE) of unmigratable OLD_GLAZE dust per holder and stranding the corresponding newGlaze wei inside GlazeMigration.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded alongside the October 12, 2026 contract audit freeze; not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
KRITT-16 — GlazeMigration constructor does not pin OLD_GLAZE.codehash or prevent unretired treasury claims on-chain, and relies on external LayerZero V2 OFT peer integrity
Description:GlazeMigration verifies block.chainid == ROBINHOOD_CHAIN_ID, address(newGlaze_).code.length != 0, and IERC20Metadata(address(newGlaze_)).decimals() == 18, and checks OLD_GLAZE.code.length != 0, but does not assert address(OLD_GLAZE).codehash against the expected Robinhood Chain legacy token runtime codehash or enforce any on-chain caller restriction against the treasury multisig (0x593c9872255B076b026572E2C1A8224A9f3A93c2). In addition, because GlazeMigration has no pause switch, its newGlaze reserve remains exposed to cross-chain GlazeOFT minting on Base (8453) until the Base GlazeOFT owner (0x63d332F22274903f1244f6327fe3F991C73034e3) renounces ownership and locks LayerZero V2 peers/DVNs.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded alongside the October 12, 2026 contract audit freeze; not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Review summary and follow-ups
OpenKritt × Google
This file collects the recorded reviews for this harness and company. Each section identifies the reviewed source and model; partial reviews and coverage limits are preserved.
Current project response
Project responses updated October 14, 2026. All 13 canonical findings (KRITT-01 through KRITT-13) from the October 13, 2026 review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 and all 3 migration findings (KRITT-14 through KRITT-16) from the October 14, 2026 follow-up review of token/migration-draft (3401450e038a136b17b935eb4ad6107ee0b5320b) are currently pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. None of these findings have been addressed in contract source yet. Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
OpenKritt × Gemini 4 Argon · October 14 follow-up (token/migration-draft)
Reviewed source: 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs). Status captured 2026-10-14.
Findings summary: 3 canonical findings (0 High, 0 Medium, 1 Low, 2 Informational: KRITT-14 / KRITT-MIG-01 through KRITT-16 / KRITT-MIG-03) confirmed or marked plausible from 8 raw flow hypotheses (5 refuted). Cumulative total across both reviews: 16 findings (2 High, 5 Medium, 5 Low, 4 Informational).
Owner review: Pending pre-launch triage and remediation. Recorded alongside the October 12, 2026 contract audit freeze; not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Coverage: 38 Solidity source files across packages/contracts/src (34 files) and packages/contracts-token/src (4 files). 5-stage OpenKritt multi-agent pipeline executed: Lead Architecture Analysis, 4 Parallel Security Reviewers across 7 functional clusters, Skeptic Verification (CONFIRMED / PLAUSIBLE / REFUTED), Synthesis & Deduplication, and Final Report compilation (docs/audits/open-kritt-gemini-4-argon.md).
Findings summary: 13 canonical findings (2 High, 5 Medium, 4 Low, 2 Informational) confirmed or marked plausible from 19 raw cluster hypotheses (3 refuted, 3 merged as duplicates).
Owner review: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Original executable evidence and full report (docs/audits/open-kritt-gemini-4-argon.md) are retained in the repository. This is a source-specific public summary, not a complete-coverage certificate or professional audit by the harness author.
