Veridise · September 2026
Veridise audit
The original review of twelve core contracts. It does not cover later Launchpad, FullRange or token changes.
Page 1 of 15: Cover
Original report layout. Switch to Text view for selectable text and easier reading on smaller screens.
Findings and responses
Project responses updated October 9, 2026. Latest inventory: 133 observations including duplicates; 125 accepted, two locally remediated Periphery observations, six deferred in whole or part, zero undecided contract portions. The Periphery fix passed 43 contract and 21 SDK tests; the owner waived its additional independent re-audit, which was not run. Acceptance is not remediation; deferred work stays open.
Project responses updated October 5, 2026. Original reviewer labels are preserved. Accepted risks are not fixes; local verification is separate from independent re-audit. Findings refer to the source revision on this report, not every later contract change.
V-GLZC-VUL-001 — No minimum USDG amount on Strategy buy
Severity: Low.
Original disposition: Acknowledged. No auditor-confirmed fix claimed.
Disposition: Accepted epoch-bound Auction purchase protection; no contract change.
Response: After reviewing the caller-supplied epoch guard and keeping the Auction USDG-only, the owner accepted retaining the existing protections without a minimum-output parameter. This reconfirms the earlier local Veridise disposition and the requirement that integrations preserve the buyer's reviewed epoch.
Remaining work / limits: Keep reviewed-epoch integration requirements explicit in SDK and client documentation. The October 4 confirmation is source-based: Auction.sol:168, packages/sdk/src/actions.ts:587 and apps/web/lib/coin/steps.ts:653, consistent with docs/reviews/veridise-findings-2026-09-15.md. No contract change, new test execution, runtime validation, deployment verification or source-freeze closure is claimed.
V-GLZC-VUL-002 — Direct USDG transfers inflate Strategy Purchased events
Severity: Warning.
Original disposition: Acknowledged. No auditor-confirmed fix claimed.
Disposition: Accepted gross purchased-USDG event semantics; no contract change.
Response: The owner chose to keep the event because its amount describes what the buyer purchased, including any directly donated USDG.
Remaining work / limits: Keep event documentation and analytics labels aligned with gross purchased USDG. No contract or frontend implementation, new test execution, deployment verification or source-freeze closure is claimed.
V-GLZC-VUL-003 — Maintainability Concerns
Severity: Info.
Fix: Maintainability changes acknowledged as fixed by Veridise on report page 15.
Verification: Auditor-confirmed at 741d05b0. See the original report for the specific changes.
<!-- current-followups -->