39 production Solidity files: core, FullRange, launch, periphery and the separate GLAZE token system.
veridise-scout.md
Loading report…
1 Medium and 1 Low, both locally reproduced and previously accepted risks. Neither fixed; no new source changes.
Reviewed by Veridise using Scout via AuditHub · internal version not disclosed. The model and reasoning effort were not disclosed.
Automated contract security review. Scout reviewed 39 production Solidity files across the protocol and separate GLAZE token system. Both findings were locally reproduced and remain accepted risks; underlying models and complete coverage were not independently attested.
Scout did not disclose its underlying models or reasoning settings. High was the selected budget tier, not an attested reasoning effort.
Reviewed revision: b72216d758c90e8ea21642fdbf970309b9038fe7Upload bytes verified against develop; server-side ingestion and complete coverage not independently attested
1 Medium and 1 Low, both locally reproduced and previously accepted risks. Neither fixed; no new source changes.
Reviewed by Veridise using Scout via AuditHub · internal version not disclosed. The model and reasoning effort were not disclosed.
Automated contract security review. Scout reviewed 39 production Solidity files across the protocol and separate GLAZE token system. Both findings were locally reproduced and remain accepted risks; underlying models and complete coverage were not independently attested.
Scout did not disclose its underlying models or reasoning settings. High was the selected budget tier, not an attested reasoning effort.
Reviewed revision: b72216d758c90e8ea21642fdbf970309b9038fe7Upload bytes verified against develop; server-side ingestion and complete coverage not independently attested
Findings and responses
Scout reported two findings against b72216d758c90e8ea21642fdbf970309b9038fe7. Both are confirmed behaviors and duplicates of previously accepted risks. The owner reaffirmed acceptance after reviewing the reproductions. AuditHub labels both Confirmed Bug; acceptance is recorded in the project comments because that label does not mean fixed.
Medium — FullRange mandatory fee realization can permanently freeze LP principal
Severity: Medium, as reported by Scout.
Disposition: Accepted risk; not fixed. Duplicate of FR07 / R003-FR-07.
Impact: When an admitted currency accrues more than 2^127 - 1 raw units of uncollected fees to a wrapper's native Uniswap v4 position, signed fee-delta conversion can revert. Collection, deposits and withdrawals requiring that realization can remain blocked, including access to LP principal in the affected position.
Response: Retain the previously accepted upstream fee-realization limit. At 18 decimals the threshold is approximately 170 quintillion whole tokens, but arbitrary high-supply or cheaply mintable assets can make exposure possible. The decimal restriction and frontend token selection do not impose a contract-level supply cap. Periodic collection and chunking already-realized claims are not guaranteed prevention or recovery.
Verification: The existing FullRange huge-fee reproduction passed locally against the audited source, confirming collection and withdrawal failures while the LP retains unusable shares. Scout could not execute its reproduction in the service environment; this local check is separately attributed to GlazeCorp.
Deployment condition: Supported-asset exposure validation remains open. Base assets are supplied per launch, including direct contract calls; no finite frontend token list establishes safety for every permissionless asset. Verify the real USDG deployment identity and intended token policy when configuring launch. No contract fix or deployment clearance is implied.
Disposition: Accepted risk; not fixed. Duplicate of R002-FINAL-016 / H016.
Impact: A permissionless strategy checkpoint can advance its paid index after rounding its earned revenue down to whole raw USDG units. Repeated checkpoints can discard fractional entitlements without paying the caller or changing signal balances.
Response: Preserve the previously accepted accounting policy and permissionless distribution. Each strategy conversion loses less than one raw USDG unit: less than 0.000001 USDG with six decimals. This is a per-conversion bound, not a lifetime loss cap; tiny streams can still lose a large percentage of their revenue.
Verification: Two local EVM tests passed. A two-second control credited one raw USDG unit; an unrelated caller checkpointing each second credited zero twice. The caller received nothing, signal balances were unchanged, and the other strategy retained its entitlement. These tests reproduce the behavior, not a remediation.
Fix: None. No fractional carry, checkpoint restrictions or frozen-source edits were introduced.
Review summary and validation
Veridise Scout
Scout completed an automated security review on October 28, 2026 (Pacific), reporting one Medium and one Low finding. Both were reproduced locally and match previously accepted risks. Neither is fixed; no contract source changed for this review.
Source and scope
The reviewed source is develop commit b72216d758c90e8ea21642fdbf970309b9038fe7: 39 production Solidity files in core, FullRange, launch, periphery and the separate GLAZE token system. Tests, documentation and demo contracts were excluded as scan targets; supporting artifacts were uploaded as context. This scope does not expand the separate Cyfrin or historical Veridise professional audits.
The uploaded repository files were checked against that commit. Contract source bytes were checked again after local reproduction. This establishes the prepared upload's source identity, not an independent attestation of AuditHub's server-side ingestion.
Result and validation
The FullRange finding concerns oversized uncollected fees that can prevent an affected position from realizing fees or withdrawing principal. The Resonance finding concerns permissionless checkpoints discarding fractional strategy revenue. The finding responses below preserve Scout's severity and distinguish acceptance from remediation.
Three focused local EVM tests passed against the reviewed source: one FullRange reproduction and two Resonance control/checkpoint cases, using Foundry 1.7.1 and Solidity 0.8.26. Scout itself could not execute its FullRange reproduction because the uploaded artifacts lacked installed dependencies and a PoolManager build artifact. The local tests validate these mechanisms; they do not prove complete security coverage.
Service provenance
The scan ran for 24 minutes 49 seconds and the service reported that all tasks and findings triage completed. Its underlying models, reasoning settings and runner version were not disclosed, and independent complete coverage evidence was not supplied. This is therefore an imported AI service report, separate from Veridise's professional human audit.
The selected High tier capped AI consumption at 16,000 credits; High is not an attested model reasoning setting. Actual usage was 7,134.98 AI credits plus 102.08 compute credits, totaling 7,237.06.
The download preserves Scout's original scan summary byte for byte. The public finding responses are GlazeCorp's reviewed summaries and owner dispositions. Detailed execution evidence is retained outside the website bundle.
