38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
pashov-google.md
Loading report…
2 high-confidence findings ([90] and [85]) above the 75 threshold across initial and October 14 migration reviews; pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Pashov solidity-auditor · 5-agent parallel scan + judge.
Structured Solidity review. A Solidity audit workflow with focused agent reviews and a judgment stage. It organizes candidate findings into issues that can be checked and prioritized.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
pashov-google.md
2 high-confidence findings ([90] and [85]) above the 75 threshold across initial and October 14 migration reviews; pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Pashov solidity-auditor · 5-agent parallel scan + judge.
Structured Solidity review. A Solidity audit workflow with focused agent reviews and a judgment stage. It organizes candidate findings into issues that can be checked and prioritized.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
Initial reviewed revision: c435fa3dbfa179aa9083134ba8729c2ac2d34dc0October 12, 2026 smart-contract audit freeze commit; October 14, 2026 follow-up on 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft).
Findings and responses
Project responses updated October 14, 2026. Both findings ([90] 1. and [85] 2.) above the 75 confidence threshold from the October 13, 2026 Pashov × Google (gemini-4-argon) review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 are currently pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. The October 14, 2026 follow-up review of token/migration-draft/src/GlazeMigration.sol (3401450e038a136b17b935eb4ad6107ee0b5320b) produced 0 findings at or above the >= 75 confidence threshold (12 screened candidate observations [10]–[45]). Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Each observation retains its review date, source revision, model and project decision.
[90] 1. Unvalidated asset list lets a caller reset the auction epoch without buying usdg
Description:GlazeBuybackAuction.buy(address[] calldata assets, address revenueReceiver, uint256 expectedEpochId, uint256 deadline, uint256 maxPaymentAmount) accepts an arbitrary caller-supplied assets array and considers the buy valid as long as any token in assets has IERC20(asset).balanceOf(address(this)) > 0 (hasRevenue = true), without requiring the immutable usdg revenue token to be included in assets when usdg.balanceOf(address(this)) > 0. Once currentPrice() decays to 0 (or near 0 near the end of epochDuration), any caller can transfer 1 wei of a worthless ERC-20 to GlazeBuybackAuction and call buy([dustToken], receiver, epochId, deadline, 0). This increments epochId (causing legitimate USDG buyers to revert with EpochIdMismatch), resets epochStartedAt = block.timestamp, and resets or ratchets initialPrice while leaving 100% of the USDG balance untouched in the contract.
Fix: Require usdg to be swept on every purchase (or validate assets against an explicit behavior enforcing that usdg cannot be omitted when usdg.balanceOf(address(this)) > 0) and reject asset == address(paymentToken).
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
[85] 2. Parallel wrapper creation on the same V4 PoolId lets an attacker hijack initializeAndSeed pricing
Description:FullRange.create deploys a new FullRangeERC20 wrapper without initializing the underlying Uniswap V4 pool, and multiple wrappers created for the same (currency0, currency1, swapFee) share the same deterministic V4 PoolId. When initializeAndSeed is later called, quoteSeed checks poolManager.getSlot0(id) and, if currentPrice != 0, silently adopts the existing V4 pool sqrtPriceX96 instead of computing FullRangeMath.seedPrice(amount0Max, amount1Max). If a standalone integrator calls FullRange.create and FullRange.initializeAndSeed in separate transactions (or without tight amount0Min / amount1Min bounds), an attacker can front-run initializeAndSeed by creating a sibling wrapper on the same (currency0, currency1, swapFee) and seeding it with tiny dust at an extreme ratio, forcing the victim's initializeAndSeed call to deposit one-sidedly at the attacker's price.
Fix: Either revert in initializeAndSeed when currentPrice != 0 unless the caller explicitly opts into joining an already-initialized V4 pool (with explicit price bounds), or combine create and initializeAndSeed atomically for new pool creation.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
October 14, 2026 Follow-Up Scan — GlazeMigration.sol (token/migration-draft)
Screened observations below confidence threshold (< 75):12 candidate observations ([10]–[45]) across all 12 Pashov solidity-auditor agents (Reentrancy & Cross-Contract Control Flow [20], Access Control & Trust Boundaries [35], Economic Security & Game Theory [30], Execution Trace & Edge Cases [25], Invariant & Conservation Analysis [40], Periphery & Integration Surfaces [45], First-Principles Design Review [20], Asymmetry & Paired-Operation Analysis [40], Boundary & Extreme-Input Analysis [15], Numerical Precision & Rounding Gap Analysis [45], Trust Gap & External Dependency Analysis [35], and Flow Gap & Multi-Step State Transition Analysis [10]) are documented in docs/audits/pashov-gemini-4-argon.md.
Review summary and follow-ups
Pashov × Google
This file collects the recorded reviews for this harness and company. Each section identifies the reviewed source and model; partial reviews and coverage limits are preserved.
Current project response
Project responses updated October 14, 2026. Both findings ([90] 1. and [85] 2.) above the 75 confidence threshold from the October 13, 2026 review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 remain pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. The October 14, 2026 follow-up 12-agent scan of token/migration-draft/src/GlazeMigration.sol (3401450e038a136b17b935eb4ad6107ee0b5320b) raised 0 findings above the 75 confidence threshold (12 candidate observations screened below threshold at [10]..[45]). Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Coverage: 38 Solidity source files across packages/contracts/src (34 files) and packages/contracts-token/src (4 files). 5 parallelized vector-scan and adversarial reasoning agents + 1 validation agent executed under the pashov/skills (solidity-auditor) methodology, with strict confidence filtering (>= 75) and false-positive screening (docs/audits/pashov-gemini-4-argon.md).
Findings summary: 2 high-confidence findings ([90] and [85]) reported above the threshold; 8 lower-confidence / design-tradeoff observations documented as screened below threshold.
Owner review: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Pashov × Gemini 4 Argon · October 14 follow-up (token/migration-draft)
Coverage: Full 12-agent pashov/skills (solidity-auditor) review (access-control, economic-security, execution-trace, invariant, periphery, first-principles, asymmetry, boundary, numerical-gap, trust-gap, flow-gap, and judge) with 4-gate confidence scoring (threshold >= 75) recorded in docs/audits/pashov-gemini-4-argon.md.
Findings summary: 0 findings >= 75 and 0 leads in GlazeMigration.sol; 12 candidate observations ([10] through [45]) evaluated and screened below threshold due to GlazeMigration.sol's on-chain guards (block.chainid == 4663, code.length != 0, decimals() == 18, nonReentrant, SafeERC20, direct retirement to DEAD, and newGlaze.balanceOf(msg.sender) - balanceBefore != amount) and finalized on-chain treasury retirement (excludedMultisigRaw == "0").
Owner review: No contract changes required for GlazeMigration.sol; pre-deployment verification of the pons replacement token and pre-funding reconcile.mjs execution remain tracked in token/migration-draft/README.md.
Original executable evidence and full report (docs/audits/pashov-gemini-4-argon.md) are retained in the repository. This is a source-specific public summary, not a complete-coverage certificate or professional audit by the harness author.
