Skip to content
$VIBES--

Security audits.

Independent security reviews of the Vibestarter protocol contracts. The contracts are live on mainnet, and review and remediation continue alongside them, so expect this page to grow as further audits land.

Threat log

Medium

1 finding
  • CORE-06Medium✓ Remediated

    Community-rewards slice was counted as circulating, diluting backer refunds on a freeze (on-chain denominator + the off-chain Merkle builder that feeds it)

Low

4 findings
  • VTR-07Low✓ Remediated

    Challenge resolution could run after a campaign left the funded state, and a pending challenge stake could be left parked on freeze / emergency refund

  • DEP-1Low✓ Remediated

    A default deploy could leave the platform fee recipient set to the throwaway deployer key, baked immutably into per-campaign fee claimers

  • REG-01Low◇ Accepted risk

    The majority-supply registration guard is bypassable for liquid tokens via flash-borrowed supply (the launch registration path is unaffected)

  • VTR-05Low○ Tracked / open

    Testnet-twin refund merkle-root commit guard diverges from mainnet (testnet-only; no delay bypass either side)

Informational

5 findings
  • DEP-4/5/6Informational✓ Remediated

    Deploy validation + the wiring verifier were missing some guards (deployer-key collisions, the factory fee wallet, the staking signer)

  • STK-claimInformational✓ Remediated

    A staker-reward claim could silently no-op after a long-delay rescue, leaving the claim advertised forever

  • LP-implInformational✓ Remediated

    The LP fee-claimer implementation left its initializer open (clones unaffected); the LP locker emitted no events on privileged setters

  • DOC-rolesInformational✓ Remediated

    The privileged-roles document described the per-escrow admin as the multisig; on-chain it is the operations hot key

  • PAUSE-finalizeInformational› Deferred

    finalize() is reachable from a paused campaign, so a deliberate pause does not halt early finalization

Threat log

Critical & High

1 finding
  • VIB-01High✓ Remediated

    Frozen refund denominator included non-redeemable AMM / project-token balances

High / Medium

3 findings
  • VIB-02High / Medium✓ Remediated

    Operations admin could manipulate the frozen refund denominator via mutable custody-address setters

  • VIB-03High / Medium✓ Remediated

    Deployment completeness was not fail-closed and could silently strand staker rewards

  • VIB-04High / Medium✓ Remediated

    Historical staker rewards could become permanently unclaimable after a full unstake

Medium

4 findings
  • VIB-05Medium✓ Remediated

    Staking snapshot backfill could make long-lived stakers unable to unstake

  • VIB-07Medium✓ Remediated

    Public registry registration could squat predicted factory token addresses

  • VIB-08Medium✓ Remediated

    A weak or collusive challenge could consume the only tranche challenge slot

  • VIB-09Medium✓ Remediated

    Manual LP recovery proof could accept non-canonical pools or withdrawable claimers

Low

3 findings
  • VIB-06Medium / Low✓ Remediated

    Staker rewards could be stranded by same-block eligibility mismatch or floor rounding

  • VIB-10Low / Medium✓ Remediated

    Community rewards batch totals were not enforced at claim time

  • VIB-11Low / Medium✓ Remediated

    Accrued platform fees could become unreachable after freeze / refund

→ Report a vulnerability← All documentation