V12 · GlazeCorp

4 High / Unreviewed findings and 69 entries marked Invalid by V12. Supplied PoC results have not been independently reproduced.

Findings and responses

Project responses updated October 9, 2026. Latest inventory: 133 observations including duplicates; 125 accepted, two locally remediated Periphery observations, six deferred in whole or part, zero undecided contract portions. The Periphery fix passed 43 contract and 21 SDK tests; the owner waived its additional independent re-audit, which was not run. Acceptance is not remediation; deferred work stays open.

Project responses updated October 5, 2026. Original reviewer labels are preserved. Accepted risks are not fixes; local verification is separate from independent re-audit. Findings refer to the source revision on this report, not every later contract change.

The four service-reported High / Unreviewed findings are below. The original report also lists 69 entries that V12 marked Invalid; no fix is claimed for those rejected entries. Their full index remains in the report below.

V12-303202 — Fractional strategy reward rounding

Severity: High (service-reported).

Original observation status: Unreviewed in the original service export.

Project review: R002-FINAL-016 — Repeated zero-payout checkpoints can lose fractional reward entitlement.

Disposition: Accepted fractional checkpoint rounding loss; no contract change.

Response: The owner accepted the existing rounding behavior after reviewing that fractions are discarded when accounting advances, more frequent updates can increase the loss, and preserving those fractions would require additional accounting. This records acceptance of the limitation, not a verified fix or a universal claim that its economic impact is negligible.

Remaining work / limits: Keep the permanent fractional-entitlement loss and denomination-dependent impact explicit in reward-accounting documentation. Preserve original auditor conclusions, severity and evidence limits. No contract change, new test execution, deployment verification or source-freeze closure is claimed.

V12-303306 — Reward stream restart timing

Severity: High (service-reported).

Original observation status: Unreviewed in the original service export.

Project review: R002-FINAL-017 — Repeated stream restarts may delay reward completion.

Disposition: Accepted reward-stream restart timing; no contract change.

Response: The owner accepted that qualifying new funding resets the seven-day schedule and can push completion back, choosing to retain the current simple combined-budget stream with its existing funding safeguards.

Remaining work / limits: Keep the fresh seven-day schedule and qualifying-funding rules explicit in reward documentation. Preserve historical and current evidence boundaries. No contract change, new test execution, deployment verification or source-freeze closure is claimed.

V12-303307 — Direct notification and buffered router balances

Severity: High (service-reported).

Original observation status: Unreviewed in the original service export.

Project review: R002-FINAL-060 — A historical direct-notification claim concerns stranded router buffers.

Disposition: Accepted direct-funding routing delay; no contract change; historical permanence claim unconfirmed.

Response: After clarification that BribeRouter holds tokens awaiting admission while Bribe distributes scheduled rewards, the owner accepts that direct funding can increase remaining rewards and delay forwarding the router buffer. The timing interaction does not itself erase the buffer or previously earned reward claims.

Remaining work / limits: Retain the accepted timing limitation and evidence distinction in reports and integration documentation. No contract remediation is selected and no new executable verification, source change, deployment or completed fix is claimed.

V12-303390 — Fund-held Coin in the redemption denominator

Severity: High (service-reported).

Original observation status: Unreviewed in the original service export.

Project review: R002-FINAL-004 — Direct Fund redemption includes the Fund's unburned Coin.

Disposition: Accepted existing direct-call behavior; no contract change for this finding.

Response: The owner accepted that pre-existing Fund-held Coin stays in the redemption denominator until actually burned. This behavior can be mitigated by burning first and is not an unavoidable technical limitation; the current Periphery helper already performs that maintenance burn atomically before redemption.

Remaining work / limits: Document direct versus burn-first redemption behavior and retain existing user bounds and helper semantics. Continue reviewing client quote/transaction consistency under finding 005. Original reports and evidence limits remain unchanged; no contract fix, client verification, or freeze closure is claimed.

Original review summary

Provenance and scope

Provider / runner: V12 web service (https://v12.sh/), manually run by the owner.
Reported audited commit: 1b6fa35dae858c96783d6259877f5ed097cb533a. Owner-reported, source-corroborated; exact upload not independently attested. The owner believes this was the uploaded revision. It predates initial-strategy launch support.
Source evidence: the exported Launchpad creates exactly three default strategies. Reconstructed original files from the supplied remediation diffs match the comparison revision 1b6fa35dae858c96783d6259877f5ed097cb533a. This supports the earlier-source attribution, but does not prove the exact whole-repository commit. See source attribution.
Requested round-001 freeze is not the audited revision: do not attribute this report to eac03c614328a4260975323c53b38299fc21cc5a or the later cleanup freeze.
Model, model version, reasoning effort, internal harness version, service run ID and audit start/end: not disclosed in the export. Highest effort is requested for future reviews; actual settings of this past run are unknown.
Original export: v12-export.md, preserved byte-for-byte; SHA256 2b71d55e3dae7d92db56af6736c2ba06592cb0b1a673f43b3da0ce7506b202c1.
Coverage: source locations are evidence of referenced files, not a complete coverage manifest. No assertion that all contracts, initial strategies, or GLAZE contracts were audited.
Independence: export references existing tests; first-pass sealing and prior-findings exposure are not evidenced.

Reported outcome

The export contains 73 entries: four High / Unreviewed and 69 Low / Invalid, using V12's labels. No findings have been independently validated during import. Invalid entries are retained for traceability, not counted as confirmed vulnerabilities. The export supplies successful PoC logs for the four high findings; those logs are service-reported evidence, not local reproduction.

V12 ID	High / Unreviewed finding	Evidence status
V12-303202	Permissionless checkpointing strands fractional strategy rewards	Service reports PoC passed; not rerun locally
V12-303306	Permissionless stream restart dilutes reward rate	Service reports PoC passed; not rerun locally
V12-303307	Direct notify can strand BribeRouter's buffered balance	Service reports PoC passed; not rerun locally
V12-303390	Direct redemptions include Fund-held Coin in the payout denominator	Service reports PoC passed; not rerun locally

The source's remediation patches and setup scripts are preserved only as report content. No patch or embedded command was applied or executed during import. Current-source applicability and proposed fixes need separate review after the independent audit passes.

Full finding index

The unedited export contains the complete descriptions, source excerpts, PoCs, logs, validation reasoning and suggested patches. Machine-readable index retains service IDs, severity, validity and source locations.

V12 ID	Severity	V12 validity	Title
V12-303139	Low	Invalid	Periphery redeem leaves pulled Coin allowance window open to front-run burn
V12-303140	Low	Invalid	Coin emission permanently trappable via no-exit miner address
V12-303146	Low	Invalid	Pool ownership check trusts arbitrary owner() implementation
V12-303170	Low	Invalid	Coincident beneficiary roles correctly aggregate without duplication
V12-303171	Low	Invalid	Permissionless claimPayment correctly pays only the named beneficiary
V12-303199	Low	Invalid	Full-balance routing can permanently exhaust revenue lifetime cap
V12-303201	Low	Invalid	Revenue accounting trusts nominal amounts without balance-delta verification
V12-303202	High	Unreviewed	Permissionless checkpointing strands fractional strategy rewards
V12-303210	Low	Invalid	Unregistered-token BribeRouter graphs freeze bribe funds forever
V12-303212	Low	Invalid	Factory decimals probe is an unguarded external call pre-registration
V12-303218	Low	Invalid	Unpinned Base Token Behavior
V12-303219	Low	Invalid	Zero Approval Cleanup Blocks Launch
V12-303222	Low	Invalid	Terminal nonce permanently freezes creator
V12-303223	Low	Invalid	Token callback skips next creator nonce
V12-303225	Low	Invalid	Mutable Proxies Bypass Dependency Validation
V12-303229	Low	Invalid	Unrestricted signal receipt metadata
V12-303230	Low	Invalid	Semantic Dependencies Are Not Verified
V12-303233	Low	Invalid	Controller accepts mismatched launch components
V12-303234	Low	Invalid	Undelayed Fee Recipient Changes
V12-303235	Low	Invalid	Immediate Global Mining Fee Repricing
V12-303239	Low	Invalid	FullRangeERC20 fee-recipient zero-address lockout risk
V12-303240	Low	Invalid	Launchpad seed-shares slippage check omits creator grant ordering
V12-303243	Low	Invalid	Factory-trusted decimals() call unguarded against reverting tokens
V12-303244	Low	Invalid	Unverified helper can replace canonical Coin
V12-303246	Low	Invalid	Standalone helper bypasses metadata bounds
V12-303251	Low	Invalid	Mismatched Router Traps Mining Revenue
V12-303252	Low	Invalid	Unverified Signal Deployer Captures Graph
V12-303255	Low	Invalid	Unverified Controller Deployer Captures Launch Ownership
V12-303256	Low	Invalid	Unverified Resonance Captures Revenue Graph
V12-303277	Low	Invalid	Same-tx create/selfdestruct can brick the launchpad binding
V12-303285	Low	Invalid	Per-Mint Issuance Cap Is Not Enforced
V12-303294	Low	Invalid	Protocol fee basis points unbounded inside Mine's payment allocation
V12-303304	Low	Invalid	Permissionless factories let anyone brick a self-created Auction bound to the real Resonance
V12-303306	High	Unreviewed	Permissionless stream restart dilutes reward rate
V12-303307	High	Unreviewed	Direct notify can strand BribeRouter's buffered balance
V12-303311	Low	Invalid	Bribe Surplus Has No Recovery Path
V12-303325	Low	Invalid	Unverified PoolManager Binding Enables Fund Theft
V12-303328	Low	Invalid	Creator-share fee split resettable by rotating protocol fee recipient
V12-303330	Low	Invalid	Withdrawal Slippage Uses Nominal Token Amounts
V12-303334	Low	Invalid	Zero-liquidity fee poke skip trusts stale checkpoint under fee-growth wraparound
V12-303335	Low	Invalid	Protocol Fee Routing Is Correctly Scoped
V12-303372	Low	Invalid	Periphery helpers do not authenticate their Launchpad dependency
V12-303373	Low	Invalid	Periphery-routed mining events misattribute the payer
V12-303374	Low	Invalid	Unchecked revenue-router configuration can strand mining revenue
V12-303375	Low	Invalid	Unvalidated fee source can freeze or misallocate paid mining
V12-303376	Low	Invalid	Single-key control over protocol revenue and administration
V12-303377	Low	Invalid	Strategy admission accepts nonconforming payment tokens
V12-303378	Low	Invalid	Component ownership handoffs lack recipient acceptance
V12-303379	Low	Invalid	Unverified payment settlement enables free Auction fills
V12-303380	Low	Invalid	Unsupported token behavior breaks settlement and reward accounting
V12-303381	Low	Invalid	Bribe-share changes take effect without notice
V12-303382	Low	Invalid	Revenue maintenance targets the stale router after migration
V12-303383	Low	Invalid	Unverified Mine binding controls minting and Fund redemption
V12-303384	Low	Invalid	Permissionless Fund deployment accepts arbitrary Coin bindings
V12-303385	Low	Invalid	Permanent coordinator binding lacks reciprocal authentication
V12-303386	Low	Invalid	Router dependency graph is not verified before permanent binding
V12-303387	Low	Invalid	Payout-incompatible reward token can brick aggregate claims
V12-303388	Low	Invalid	Nominal outbound payouts can underpay LPs and claimants
V12-303389	Low	Invalid	Mutable token transfers can freeze LP exits
V12-303390	High	Unreviewed	Direct redemptions include Fund-held Coin in the payout denominator
V12-303391	Low	Invalid	Shared-ledger token aliases are double-counted during redemption
V12-303392	Low	Invalid	Nominal USDG transfers can leave payment claims undercollateralized
V12-303393	Low	Invalid	Fee and revenue routing changes take effect without delay
V12-303394	Low	Invalid	Declared controller metadata event is never emitted
V12-303395	Low	Invalid	Ownerless controller permanently strands component administration
V12-303396	Low	Invalid	Code-presence checks do not authenticate launch dependencies
V12-303397	Low	Invalid	Unverified USDG transfers allow unfunded mining and liabilities
V12-303398	Low	Invalid	Unauthenticated factory outputs can corrupt strategy registration
V12-303399	Low	Invalid	Zero-signal bribe routing permanently strands streamed rewards
V12-303400	Low	Invalid	Public factory deploys strategy graphs without required registrations
V12-303401	Low	Invalid	Unsupported assets can be permanently registered as markets
V12-303402	Low	Invalid	Unbounded accrued fees can permanently freeze LP exits
V12-303403	Low	Invalid	Non-exact backing tokens can undercollateralize signal receipts

Verification and limitations

Confirmed 73 unique source IDs and preserved the 655,084-byte export checksum.
Compared reconstructed file contents and launch excerpts against Git history; exact uploaded commit remains unverified.
No local exploit execution, complete scope coverage or before/after service freeze attestation is claimed.
Dates shown for import are not the service's audit dates. Blank model/settings fields mean undisclosed, not an inferred model or effort.
Keep this historical report separate from planned reviews of the new freeze. Obtain the original upload or V12 job metadata to establish the exact revision.

Original review summary

Provenance and scope

Provider / runner: V12 web service (https://v12.sh/), manually run by the owner.
Reported audited commit: 1b6fa35dae858c96783d6259877f5ed097cb533a. Owner-reported, source-corroborated; exact upload not independently attested. The owner believes this was the uploaded revision. It predates initial-strategy launch support.
Source evidence: the exported Launchpad creates exactly three default strategies. Reconstructed original files from the supplied remediation diffs match the comparison revision 1b6fa35dae858c96783d6259877f5ed097cb533a. This supports the earlier-source attribution, but does not prove the exact whole-repository commit. See source attribution.
Requested round-001 freeze is not the audited revision: do not attribute this report to eac03c614328a4260975323c53b38299fc21cc5a or the later cleanup freeze.
Model, model version, reasoning effort, internal harness version, service run ID and audit start/end: not disclosed in the export. Highest effort is requested for future reviews; actual settings of this past run are unknown.
Original export: v12-export.md, preserved byte-for-byte; SHA256 2b71d55e3dae7d92db56af6736c2ba06592cb0b1a673f43b3da0ce7506b202c1.
Coverage: source locations are evidence of referenced files, not a complete coverage manifest. No assertion that all contracts, initial strategies, or GLAZE contracts were audited.
Independence: export references existing tests; first-pass sealing and prior-findings exposure are not evidenced.

Reported outcome

V12 ID	High / Unreviewed finding	Evidence status
V12-303202	Permissionless checkpointing strands fractional strategy rewards	Service reports PoC passed; not rerun locally
V12-303306	Permissionless stream restart dilutes reward rate	Service reports PoC passed; not rerun locally
V12-303307	Direct notify can strand BribeRouter's buffered balance	Service reports PoC passed; not rerun locally
V12-303390	Direct redemptions include Fund-held Coin in the payout denominator	Service reports PoC passed; not rerun locally

Full finding index

V12 ID	Severity	V12 validity	Title
V12-303139	Low	Invalid	Periphery redeem leaves pulled Coin allowance window open to front-run burn
V12-303140	Low	Invalid	Coin emission permanently trappable via no-exit miner address
V12-303146	Low	Invalid	Pool ownership check trusts arbitrary owner() implementation
V12-303170	Low	Invalid	Coincident beneficiary roles correctly aggregate without duplication
V12-303171	Low	Invalid	Permissionless claimPayment correctly pays only the named beneficiary
V12-303199	Low	Invalid	Full-balance routing can permanently exhaust revenue lifetime cap
V12-303201	Low	Invalid	Revenue accounting trusts nominal amounts without balance-delta verification
V12-303202	High	Unreviewed	Permissionless checkpointing strands fractional strategy rewards
V12-303210	Low	Invalid	Unregistered-token BribeRouter graphs freeze bribe funds forever
V12-303212	Low	Invalid	Factory decimals probe is an unguarded external call pre-registration
V12-303218	Low	Invalid	Unpinned Base Token Behavior
V12-303219	Low	Invalid	Zero Approval Cleanup Blocks Launch
V12-303222	Low	Invalid	Terminal nonce permanently freezes creator
V12-303223	Low	Invalid	Token callback skips next creator nonce
V12-303225	Low	Invalid	Mutable Proxies Bypass Dependency Validation
V12-303229	Low	Invalid	Unrestricted signal receipt metadata
V12-303230	Low	Invalid	Semantic Dependencies Are Not Verified
V12-303233	Low	Invalid	Controller accepts mismatched launch components
V12-303234	Low	Invalid	Undelayed Fee Recipient Changes
V12-303235	Low	Invalid	Immediate Global Mining Fee Repricing
V12-303239	Low	Invalid	FullRangeERC20 fee-recipient zero-address lockout risk
V12-303240	Low	Invalid	Launchpad seed-shares slippage check omits creator grant ordering
V12-303243	Low	Invalid	Factory-trusted decimals() call unguarded against reverting tokens
V12-303244	Low	Invalid	Unverified helper can replace canonical Coin
V12-303246	Low	Invalid	Standalone helper bypasses metadata bounds
V12-303251	Low	Invalid	Mismatched Router Traps Mining Revenue
V12-303252	Low	Invalid	Unverified Signal Deployer Captures Graph
V12-303255	Low	Invalid	Unverified Controller Deployer Captures Launch Ownership
V12-303256	Low	Invalid	Unverified Resonance Captures Revenue Graph
V12-303277	Low	Invalid	Same-tx create/selfdestruct can brick the launchpad binding
V12-303285	Low	Invalid	Per-Mint Issuance Cap Is Not Enforced
V12-303294	Low	Invalid	Protocol fee basis points unbounded inside Mine's payment allocation
V12-303304	Low	Invalid	Permissionless factories let anyone brick a self-created Auction bound to the real Resonance
V12-303306	High	Unreviewed	Permissionless stream restart dilutes reward rate
V12-303307	High	Unreviewed	Direct notify can strand BribeRouter's buffered balance
V12-303311	Low	Invalid	Bribe Surplus Has No Recovery Path
V12-303325	Low	Invalid	Unverified PoolManager Binding Enables Fund Theft
V12-303328	Low	Invalid	Creator-share fee split resettable by rotating protocol fee recipient
V12-303330	Low	Invalid	Withdrawal Slippage Uses Nominal Token Amounts
V12-303334	Low	Invalid	Zero-liquidity fee poke skip trusts stale checkpoint under fee-growth wraparound
V12-303335	Low	Invalid	Protocol Fee Routing Is Correctly Scoped
V12-303372	Low	Invalid	Periphery helpers do not authenticate their Launchpad dependency
V12-303373	Low	Invalid	Periphery-routed mining events misattribute the payer
V12-303374	Low	Invalid	Unchecked revenue-router configuration can strand mining revenue
V12-303375	Low	Invalid	Unvalidated fee source can freeze or misallocate paid mining
V12-303376	Low	Invalid	Single-key control over protocol revenue and administration
V12-303377	Low	Invalid	Strategy admission accepts nonconforming payment tokens
V12-303378	Low	Invalid	Component ownership handoffs lack recipient acceptance
V12-303379	Low	Invalid	Unverified payment settlement enables free Auction fills
V12-303380	Low	Invalid	Unsupported token behavior breaks settlement and reward accounting
V12-303381	Low	Invalid	Bribe-share changes take effect without notice
V12-303382	Low	Invalid	Revenue maintenance targets the stale router after migration
V12-303383	Low	Invalid	Unverified Mine binding controls minting and Fund redemption
V12-303384	Low	Invalid	Permissionless Fund deployment accepts arbitrary Coin bindings
V12-303385	Low	Invalid	Permanent coordinator binding lacks reciprocal authentication
V12-303386	Low	Invalid	Router dependency graph is not verified before permanent binding
V12-303387	Low	Invalid	Payout-incompatible reward token can brick aggregate claims
V12-303388	Low	Invalid	Nominal outbound payouts can underpay LPs and claimants
V12-303389	Low	Invalid	Mutable token transfers can freeze LP exits
V12-303390	High	Unreviewed	Direct redemptions include Fund-held Coin in the payout denominator
V12-303391	Low	Invalid	Shared-ledger token aliases are double-counted during redemption
V12-303392	Low	Invalid	Nominal USDG transfers can leave payment claims undercollateralized
V12-303393	Low	Invalid	Fee and revenue routing changes take effect without delay
V12-303394	Low	Invalid	Declared controller metadata event is never emitted
V12-303395	Low	Invalid	Ownerless controller permanently strands component administration
V12-303396	Low	Invalid	Code-presence checks do not authenticate launch dependencies
V12-303397	Low	Invalid	Unverified USDG transfers allow unfunded mining and liabilities
V12-303398	Low	Invalid	Unauthenticated factory outputs can corrupt strategy registration
V12-303399	Low	Invalid	Zero-signal bribe routing permanently strands streamed rewards
V12-303400	Low	Invalid	Public factory deploys strategy graphs without required registrations
V12-303401	Low	Invalid	Unsupported assets can be permanently registered as markets
V12-303402	Low	Invalid	Unbounded accrued fees can permanently freeze LP exits
V12-303403	Low	Invalid	Non-exact backing tokens can undercollateralize signal receipts

Verification and limitations

Confirmed 73 unique source IDs and preserved the 655,084-byte export checksum.
Compared reconstructed file contents and launch excerpts against Git history; exact uploaded commit remains unverified.
No local exploit execution, complete scope coverage or before/after service freeze attestation is claimed.
Dates shown for import are not the service's audit dates. Blank model/settings fields mean undisclosed, not an inferred model or effort.
Keep this historical report separate from planned reviews of the new freeze. Obtain the original upload or V12 job metadata to establish the exact revision.