Security Audits · Vibestarter

[ Auditor ]

Claude Fable

Anthropic · frontier model, run as an autonomous auditor

Pre-Mainnet Security Audit & Remediation

Date: June 2026
Window: Reviewed June 9–10, 2026
Scope: Full mainnet contract suite + the final deployment scripts

[ About the auditor ]

Claude Fable 5 is a frontier model from Anthropic. It shares its underlying model with Claude Mythos 5 — a Mythos-class model that sits a tier above Anthropic’s Opus class — the two differing in their safeguards rather than their core capability (the name Fable, from the Latin fabula, “that which is told,” echoes the Greek mythos). Anthropic describes that shared model, in its Mythos 5 configuration, as having the strongest cybersecurity capabilities of any model in the world, which is what makes Fable well-suited to adversarial review of fund-custody code.

✓ Status · Remediation in progress

The one Medium and the deploy-script and contract-hygiene findings have been fixed and covered by regression tests; the full test suite passes. A small number of low/informational items are tracked as accepted or deferred to a separately-reviewed change, as noted per finding.

[ Threat Matrix ]

Medium

Low

Informational

Test suites

Total

[ Overview ]

A final pass before the hardened mainnet deploy, treating the three prior audit rounds as a known-findings baseline so effort went to gaps, regressions, the newest code, and the never-before-reviewed deploy scripts. It surfaced one Medium accounting bug in the newest code path and a cluster of low/informational deploy-time and hygiene items — and, critically, validated the deploy ceremony end-to-end on a forked chain.

No Critical or High issues were found. Every prior-audit fix was re-derived from current source and holds with no regression; static analysis matched the established clean baseline.

[ Threat Log ]

[ Medium ]

1 finding

CORE-06Medium
Community-rewards slice was counted as circulating, diluting backer refunds on a freeze (on-chain denominator + the off-chain Merkle builder that feeds it)
✓ Remediated

[ Low ]

4 findings

VTR-07Low
Challenge resolution could run after a campaign left the funded state, and a pending challenge stake could be left parked on freeze / emergency refund
✓ Remediated
DEP-1Low
A default deploy could leave the platform fee recipient set to the throwaway deployer key, baked immutably into per-campaign fee claimers
✓ Remediated
REG-01Low
The majority-supply registration guard is bypassable for liquid tokens via flash-borrowed supply (the launch registration path is unaffected)
◇ Accepted risk
VTR-05Low
Testnet-twin refund merkle-root commit guard diverges from mainnet (testnet-only; no delay bypass either side)
○ Tracked / open

[ Informational ]

5 findings

DEP-4/5/6Informational
Deploy validation + the wiring verifier were missing some guards (deployer-key collisions, the factory fee wallet, the staking signer)
✓ Remediated
STK-claimInformational
A staker-reward claim could silently no-op after a long-delay rescue, leaving the claim advertised forever
✓ Remediated
LP-implInformational
The LP fee-claimer implementation left its initializer open (clones unaffected); the LP locker emitted no events on privileged setters
✓ Remediated
DOC-rolesInformational
The privileged-roles document described the per-escrow admin as the multisig; on-chain it is the operations hot key
✓ Remediated
PAUSE-finalizeInformational
finalize() is reachable from a paused campaign, so a deliberate pause does not halt early finalization
› Deferred

[ Auditor ]

ZXVC LLC

Chance Santana-Wees

Smart Contract Security Audit

Date: May 2026
Window: Reviewed May 8–9, 2026
Scope: Core protocol contract suite (14 contracts)

✓ Status · Remediation complete

All 11 findings have been remediated and merged. An independent re-audit of the fixes is in progress, and the full report will be published here once that re-verification completes.

[ Threat Matrix ]

High

High / Medium

Medium

Medium / Low

Observations

Total

[ Overview ]

ZXVC reviewed the Vibestarter smart contract suite with emphasis on loss-of-funds scenarios, deployment completeness, Aerodrome integration, refund accounting, staking rewards, and manual recovery paths. The review surfaced 11 findings and 8 further observations.

No direct public reentrancy drain, tx.origin authorization flaw, selfdestruct path, or arbitrary delegatecall pattern was found in this review.

[ Threat Log ]

[ Critical & High ]

1 finding

VIB-01High
Frozen refund denominator included non-redeemable AMM / project-token balances
✓ Remediated

[ High / Medium ]

3 findings

VIB-02High / Medium
Operations admin could manipulate the frozen refund denominator via mutable custody-address setters
✓ Remediated
VIB-03High / Medium
Deployment completeness was not fail-closed and could silently strand staker rewards
✓ Remediated
VIB-04High / Medium
Historical staker rewards could become permanently unclaimable after a full unstake
✓ Remediated

[ Medium ]

4 findings

VIB-05Medium
Staking snapshot backfill could make long-lived stakers unable to unstake
✓ Remediated
VIB-07Medium
Public registry registration could squat predicted factory token addresses
✓ Remediated
VIB-08Medium
A weak or collusive challenge could consume the only tranche challenge slot
✓ Remediated
VIB-09Medium
Manual LP recovery proof could accept non-canonical pools or withdrawable claimers
✓ Remediated

[ Low ]

3 findings

VIB-06Medium / Low
Staker rewards could be stranded by same-block eligibility mismatch or floor rounding
✓ Remediated
VIB-10Low / Medium
Community rewards batch totals were not enforced at claim time
✓ Remediated
VIB-11Low / Medium
Accrued platform fees could become unreachable after freeze / refund
✓ Remediated