38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
trail-of-bits-google.md
Loading report…
16 confirmed findings (2 High, 10 Medium, 4 Low) and 9-category maturity assessments across initial and October 14 migration reviews; pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Trail of Bits Skills · 8 skill tracks + fp-check.
Context, entry points and assumptions. Security skills guide code comprehension, state-changing entry points and specification checks. GlazeCorp runs the skills; this is not a commissioned Trail of Bits audit.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
38 Solidity source files across packages/contracts/src (34) and packages/contracts-token/src (4), plus token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs.
trail-of-bits-google.md
16 confirmed findings (2 High, 10 Medium, 4 Low) and 9-category maturity assessments across initial and October 14 migration reviews; pending pre-launch triage and remediation.
Initial review: GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Trail of Bits Skills · 8 skill tracks + fp-check.
Context, entry points and assumptions. Security skills guide code comprehension, state-changing entry points and specification checks. GlazeCorp runs the skills; this is not a commissioned Trail of Bits audit.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
This file includes 1 dated follow-up sections. Each records its own models, settings, source revision, outcome and project responses.
Initial reviewed revision: c435fa3dbfa179aa9083134ba8729c2ac2d34dc0October 12, 2026 smart-contract audit freeze commit; October 14, 2026 follow-up on 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft).
Findings and responses
Project responses updated October 14, 2026. All 16 confirmed findings (TOB-01 through TOB-16) from the October 13, 2026 Trail of Bits Skills × Google (gemini-4-argon) review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 are currently pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. The October 14, 2026 follow-up review of token/migration-draft/src/GlazeMigration.sol (3401450e038a136b17b935eb4ad6107ee0b5320b) produced 0 confirmed findings (5 candidate observations CAND-01–CAND-05 dismissed by all 6 fp-check gates and all 7 vulnerability-triage-brocards; Code Maturity score 3.89 / 4.00 Strong). Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Each observation retains its review date, source revision, model and project decision.
TOB-01 — Unvalidated assets[] in GlazeBuybackAuction.buy Allows Fake-Token Epoch Reset, EpochIdMismatch Griefing, and Price Ratchet Without Buying USDG
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:GlazeBuybackAuction.buy(address[] calldata assets, ...) loops over caller-supplied assets[] and sets hasRevenue = true whenever any assets[i] has balanceOf(address(this)) > 0, without requiring immutable usdg to be swept when usdg.balanceOf(address(this)) > 0. At currentPrice() == 0 (or near 0), an attacker can pass a worthless or custom ERC-20 with 1 wei balance to satisfy hasRevenue == true, increment epochId (reverting legitimate buyers with EpochIdMismatch), reset epochStartedAt = block.timestamp, and reset or ratchet initialPrice while leaving 100% of USDG unsold in GlazeBuybackAuction.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-02 — FullRange.initializeAndSeed and Launchpad._initializePool Adopt Pre-Initialized V4 slot0 Price and Override quoteSeed, Enabling Sibling-Wrapper Front-Running
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: Multiple FullRange wrappers created for the same (currency0, currency1, swapFee) share the same underlying Uniswap V4 PoolId. When initializeAndSeed calls quoteSeed, it checks poolManager.getSlot0(id) and, if currentPrice != 0, silently adopts the existing V4 pool sqrtPriceX96 instead of computing FullRangeMath.seedPrice(amount0Max, amount1Max). For standalone callers invoking FullRange.create and FullRange.initializeAndSeed across separate transactions without tight amount0Min / amount1Min bounds, an attacker can front-run initializeAndSeed via a sibling wrapper to set an extreme sqrtPriceX96.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-03 — Direct Fund.redeem Uses effectiveTotalSupply() Without Burning or Subtracting Fund-Held Coin, Enabling Sandwich Dilution and Final-Redeemer Asset Stranding
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: While Periphery._redeemFund calls Fund.burnCoin() before calling Fund.redeem, Fund.redeem() itself computes supplyBeforeBurn = IMine(coin.minter()).effectiveTotalSupply() without burning or subtracting coin.balanceOf(address(this)). Direct callers to Fund.redeem() when Fund holds unburned Coin suffer pro-rata dilution, and if the final circulating Coin holder redeems directly via Fund.redeem(), coin.balanceOf(fund) / supplyBeforeBurn of all treasury backing is permanently stranded in Fund.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Description: Unlike ResonanceRouter.route() (which checks if (Resonance(resonance).totalSignalWeight() == 0) return 0;), BribeRouter.route() omits bribe.totalSignalWeight() == 0 and forwards buffered paymentToken into Bribe.notifyReward whenever amount >= max(REWARD_DURATION, remainingReward). Starting a 7-day stream in Bribe while totalSignalWeight == 0 permanently locks elapsed * rewardRate during the zero-weight interval inside Bribe.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-05 — Auction.buy Continues Routing bribeBps (Up to 20%) to BribeRouter After Resonance.killStrategy, Permanently Stranding Post-Kill Bribes
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: When Resonance.killStrategy(strategy) sets isStrategyLive[strategy] = false, future addSignalFor calls revert with StrategyAlreadyDead. However, Auction.buy checks only configuredResonance.bribeBps() without checking configuredResonance.isStrategyLive(address(this)). As the retired strategy auctions off its remaining USDG balance or active 7-day ResonanceRouter stream after signalers withdraw, up to 20% (bribeBps) of every auction payment continues to be sent to the dead strategy's BribeRouter and is permanently stranded.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-06 — Permissionless Bribe.notifyReward Only Checks amount >= remainingReward, Allowing Mid-Stream rewardRate Dilution by Up to 504x
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:Bribe.notifyReward(rewardToken, amount) is permissionless and checks amount >= remainingReward(rewardToken) before stretching budget = amount + remaining + _rewardRemainder across a fresh 7-day REWARD_DURATION (604,800 seconds) without requiring rate >= rewardRate[rewardToken]. Near the tail of an active stream, supplying amount == remainingReward stretches 2 * remainingReward over 7 days, slashing rewardRate by up to 504x (99.8%).
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-07 — Auction.buy Omits revenueReceiver != address(this) Guard (Unlike GlazeBuybackAuction.buy and Periphery.buy), Allowing Self-Transfer Epoch Reset at price == 0
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:Auction.buy checks revenueReceiver == address(0) but omits revenueReceiver == address(this) (which both GlazeBuybackAuction.buy and Periphery.buy enforce). When currentPrice() == 0, any caller can invoke auction.buy(address(auction), epochId, block.timestamp, 0) directly, transferring USDG from Auction back to Auction itself while incrementing epochId, resetting epochStartedAt = block.timestamp, and resetting initialPrice = minimumPrice.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-08 — Unclamped Full-Balance Routing in BribeRouter.route and ResonanceRouter.route Permanently Bricks Routing When Balance Exceeds Remaining MAX_LIFETIME_* Cap
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: Both Bribe.notifyReward and Resonance.notifyRevenue enforce a lifetime cumulative funding cap of type(uint256).max / 1e36 (~1.1579e41 raw units), while BribeRouter.route() and ResonanceRouter.route() always pass their entire balanceOf(address(this)) without clamping to maximum - notified. If a high-decimal/high-supply token or direct donation causes balanceOf(router) + lifetimeNotified to exceed the cap, route() reverts permanently with RewardLifetimeCapExceeded / RevenueLifetimeCapExceeded.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-09 — Missing Balance-Delta Verification in Bribe.notifyReward and Auction._settlePayment Causes Accounting Insolvency with Fee-on-Transfer Tokens
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: Unlike Launchpad._seedPool and FullRange._settleDelta (which verify balanceAfter - balanceBefore), Bribe.notifyReward pulls amount via safeTransferFrom and credits the nominal amount to budget without checking actual received balance. If a fee-on-transfer token is registered as a rewardToken or strategy paymentToken, Bribe credits more rewards than it holds, causing late claimers to revert with insufficient balance.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-10 — USDG and Reward-Token Blocklist Traps: Immutable Destinations (GlazeRevenueSplitter, ResonanceRouter) and No Alternate receiver in Mine.claimPayment / Bribe.claimReward
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:GlazeRevenueSplitter.split() atomically transfers toEach of USDG to both teamRecipient and immutable auction (and does not disable renounceOwnership). In addition, Mine.claimPayment() and Bribe.claimReward(account, rewardToken) always transfer directly to msg.sender / account without allowing an alternate recipient address if account is blocklisted by a regulated token.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-11 — Two-Pass Balance Snapshot in Fund.redeem Allows 2x Pro-Rata Extraction on Shared-Ledger / Dual-Entry-Point Alias Tokens
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:Fund.redeem snapshots IERC20(tokens[i]).balanceOf(address(this)) and computes payouts[i] across all tokens[] in a first loop before executing safeTransfer in a second loop. While tokens[] is validated for strictly ascending addresses (token <= previous), if Fund ever held a dual-entry-point / shared-ledger alias token (proxyA < proxyB backed by the same balance table), a redeemer passing [proxyA, proxyB] would extract 2x their pro-rata share.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-12 — Dimensional Mismatches: Unscaled REWARD_DURATION = 604,800 Rate Floor in Bribe (DIM-001) and Hardcoded D6 ABSOLUTE_MINIMUM_PRICE = 1e6 in Auction & GlazeBuybackAuction (DIM-002)
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:Bribe stores rewardRate in unscaled raw token units per second (budget / 604_800) and enforces amount >= 604_800 raw units regardless of token decimals (requiring 604,800 whole tokens on a 0-decimal token or 0.6048 on a 6-decimal token). Similarly, Auction and GlazeBuybackAuction hardcode MIN_MINIMUM_PRICE = 1e6 raw units regardless of paymentToken.decimals().
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-13 — Permissionless Resonance.distributeRevenue(strategy) Discards Sub-Unit (activeBalance * revenueDelta) % 1e36 Remainders on Every Call, Zeroing Slow Strategy Streams
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:Resonance._updateRevenue(strategy) floors Math.mulDiv(activeBalance, revenueDelta, REWARD_PRECISION) to the nearest raw unit of 6-decimal USDG while unconditionally advancing strategyRevenuePerSignalPaid[strategy] = currentRevenuePerSignal. Because Resonance.distributeRevenue(strategy) is permissionless, frequent calls before activeBalance * revenueDelta >= 1e36 advance the strategy's paid index while crediting 0 USDG, permanently locking the truncated sub-unit USDG in Resonance.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-14 — OperationsPeriphery.run Re-Encodes Full LaunchRecord (6 Dynamic Arrays) Instead of LaunchComponents on Every Subcall, Breaking the EIP-150 60,000 Gas Headroom Assumption for Large additionalStrategies
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:OperationsPeriphery.run loads the full Launchpad.LaunchRecord (containing 6 dynamic arrays of length 3 + additionalStrategies.length) and passes it by value to this.perform{gas: CALL_GAS}(record, ...) up to 50 times instead of using Launchpad.LaunchComponents. Because Solidity allocates and ABI-encodes record after the gasleft() < CALL_GAS + 60_000 check and before the external CALL, launches with many additionalStrategies can exceed the 60,000 gas buffer.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-15 — High-Ratio Branch in FullRangeMath.seedPrice (amount1 / amount0 >= 1 << 64) Truncates Lower 32 Bits of Q96 Precision (DIM-003), and FullRangeMath.liquidity Reverts on Non-Binding Cap Overflow
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: In FullRangeMath.seedPrice, when amount1 / amount0 >= 1 << 64, Math.sqrt(FullMath.mulDiv(amount1, 1 << 64, amount0)) << 64 shifts left by 64 bits after the square root, zeroing the lower 64 bits of sqrtPriceX96. Additionally, FullRangeMath.liquidity calls LiquidityAmounts.getLiquidityForAmounts, which downcasts both L0 and L1 to uint128 before taking min(L0, L1).
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
TOB-16 — Missing address(poolManager) Recipient Validation on FullRangeERC20 and FullRange, Plus Unconditional forceApprove(..., 0) in Launchpad & Periphery
Review: Trail of Bits Skills × Gemini 4 Argon · October 13 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:FullRange._checkRecipient rejects address(poolManager) for LP share minting and liquidity withdrawals, but FullRangeERC20.setCreatorRecipients and FullRange.setProtocolFeeRecipient only reject address(0). Setting a fee recipient to address(poolManager) causes FullRange.claim to burn ERC-6909 claims and take tokens into PoolManager. Additionally, Launchpad._seedPool and Periphery.buy call forceApprove(spender, 0) unconditionally even when allowance is already 0.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
October 14, 2026 Follow-Up Audit — GlazeMigration.sol (token/migration-draft)
Review: Trail of Bits Skills × Gemini 4 Argon · October 14 follow-up (token/migration-draft). Reviewed source:3401450e038a136b17b935eb4ad6107ee0b5320b. Model:gemini-4-argon.
Confirmed findings:0 (5 candidate observations CAND-01 through CAND-05 dismissed by all 6 fp-check gates and all 7 vulnerability-triage-brocards).
Specification Compliance Note (REQ-11):token/migration-draft/README.md:116 contains a stale count (All 16 tests passed) from an earlier draft, whereas README.md:8 and token/migration-draft/test/GlazeMigration.t.sol contain 34 passing tests (28 unit + 6 fuzz). Full 8-track evidence is recorded in docs/audits/trailofbits-gemini-4-argon.md (Part 8).
Review summary and follow-ups
Trail of Bits Skills × Google
This file collects the recorded reviews for this harness and company. Each section identifies the reviewed source and model; partial reviews and coverage limits are preserved.
Current project response
Project responses updated October 14, 2026. All 16 confirmed findings (TOB-01 through TOB-16) from the October 13, 2026 review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 are currently pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. The October 14, 2026 follow-up review of token/migration-draft/src/GlazeMigration.sol (3401450e038a136b17b935eb4ad6107ee0b5320b) produced 0 confirmed findings (5 candidate observations CAND-01–CAND-05 dismissed by all 6 fp-check gates and all 7 vulnerability-triage-brocards; Code Maturity score 3.89 / 4.00 Strong). Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Trail of Bits Skills × Gemini 4 Argon · October 14 follow-up (token/migration-draft)
Reviewed source: 3401450e038a136b17b935eb4ad6107ee0b5320b (token/migration-draft/src/GlazeMigration.sol and token/migration-draft/reconcile.mjs). Status captured 2026-10-14.
Recorded outcome: COMPLETE.
Coverage:token/migration-draft/src/GlazeMigration.sol (1 Solidity source file, 60 lines), token/migration-draft/reconcile.mjs (150 lines), and token/migration-draft/README.md. Executed all 8 Trail of Bits security tracks (entry-point-analyzer, audit-context-building, dimensional-analysis & property-based-testing, token-integration-analyzer, spec-to-code-compliance, code-maturity-assessor, fp-check, and vulnerability-triage-brocards) (docs/audits/trailofbits-gemini-4-argon.md).
Findings summary:0 confirmed findings (5 candidate hypotheses CAND-01 through CAND-05 dismissed after fp-check and vulnerability-triage-brocards evaluation; 9-category Code Maturity score 3.89 / 4.00 Strong; minor documentation prose note REQ-11 on token/migration-draft/README.md:116). Cumulative total across both reviews remains 16 confirmed findings (TOB-01 through TOB-16: 2 High, 10 Medium, 4 Low).
Owner review: Recorded alongside the October 12, 2026 contract audit freeze; no contract-level remediation required on GlazeMigration.sol.
Trail of Bits Skills × Gemini 4 Argon · October 13 audit
Coverage: 38 Solidity source files across packages/contracts/src (34 files) and packages/contracts-token/src (4 files). Executed 6 Trail of Bits security skills (entry-point-analyzer, audit-context-building, token-integration-analyzer, code-maturity-assessor, domain-specific-audits/defi-protocols-amm, and issue-writer) with 4 parallel domain-specific review agents (docs/audits/trailofbits-gemini-4-argon.md).
Findings summary: 16 confirmed findings (2 High, 10 Medium, 4 Low), plus a 9-category Decentralization & Code Maturity scorecard and ERC-20 / LayerZero V2 OFT token integration matrix.
Owner review: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Original executable evidence and full report (docs/audits/trailofbits-gemini-4-argon.md) are retained in the repository. This is a source-specific public summary, not a complete-coverage certificate or professional audit by the harness author.
