Security Audits · Vibestarter

[ Auditor ]

ZXVC LLC

Chance Santana-Wees

Smart Contract Security Audit

Date: May 2026
Window: Reviewed May 8–9, 2026
Scope: Core protocol contract suite (14 contracts)

✓ Status · Remediation complete

All 11 findings have been remediated and merged. An independent re-audit of the fixes is in progress, and the full report will be published here once that re-verification completes.

[ Threat Matrix ]

High

High / Medium

Medium

Medium / Low

Observations

Total

[ Overview ]

ZXVC reviewed the Vibestarter smart contract suite with emphasis on loss-of-funds scenarios, deployment completeness, Aerodrome integration, refund accounting, staking rewards, and manual recovery paths. The review surfaced 11 findings and 8 further observations.

No direct public reentrancy drain, tx.origin authorization flaw, selfdestruct path, or arbitrary delegatecall pattern was found in this review.

[ Threat Log ]

[ Critical & High ]

1 finding

VIB-01High
Frozen refund denominator included non-redeemable AMM / project-token balances
✓ Remediated

[ High / Medium ]

3 findings

VIB-02High / Medium
Operations admin could manipulate the frozen refund denominator via mutable custody-address setters
✓ Remediated
VIB-03High / Medium
Deployment completeness was not fail-closed and could silently strand staker rewards
✓ Remediated
VIB-04High / Medium
Historical staker rewards could become permanently unclaimable after a full unstake
✓ Remediated

[ Medium ]

4 findings

VIB-05Medium
Staking snapshot backfill could make long-lived stakers unable to unstake
✓ Remediated
VIB-07Medium
Public registry registration could squat predicted factory token addresses
✓ Remediated
VIB-08Medium
A weak or collusive challenge could consume the only tranche challenge slot
✓ Remediated
VIB-09Medium
Manual LP recovery proof could accept non-canonical pools or withdrawable claimers
✓ Remediated

[ Low ]

3 findings

VIB-06Medium / Low
Staker rewards could be stranded by same-block eligibility mismatch or floor rounding
✓ Remediated
VIB-10Low / Medium
Community rewards batch totals were not enforced at claim time
✓ Remediated
VIB-11Low / Medium
Accrued platform fees could become unreachable after freeze / refund
✓ Remediated