Security Review
WeedSwap has development evidence, but no independent audit or Robinhood Chain deployment.
#Review coverage
| Area | Review | Meaning |
|---|---|---|
| Foundry tests | Implemented | Unit, fuzz, invariant, and mocked integration coverage |
| Frontend tests | Implemented | Unit and Chromium route checks in the repository |
| Slither | Triaged | 90 detector results recorded; no claim of audit clearance |
| Aderyn | Blocked | Pinned dependency failed to compile in the available toolchain |
| Independent audit | Not completed | Mainnet blocker |
| Vault independent review | Not completed | High-priority custody and accounting review |
| Source-level safety findings | Launch blocker | 15 canonical findings; every item is listed below |
| Robinhood deployment | Not deployed | No official WeedSwap address |
#Static-analysis record
The recorded Slither 0.11.6 run found 0 high, 30 medium, 54 low, and 6 informational detector results. Medium categories include fixed-point ordering, sentinel equality, a local-only locked-ETH fixture, external-call reentrancy observations, zero-initialized locals, and unused tuple fields.
The repository triage explains current reasoning and test coverage for each category. It does not dismiss the results or replace review by an independent security team.
#Open security work
- Same-token Greenhouse recovery can currently include staked principal.
- EmissionController pause time can accrue after resume.
- Referral eligibility can desynchronize across WeedChef pools.
- WeedV3Vault share issuance can transfer existing idle assets or fees to later depositors.
- Greenhouse and Garden rescheduling can erase uncheckpointed prior-program rewards.
- Empty WeedChef positions can pre-arm or retain a matured harvest timer through a zero deposit or full exit and restake.
- WeedV3Vault deposits and redemptions can fail while its position is fully out of range.
- Referral bindBySig does not require invitee authorization and can permanently bind an unbound invitee.
- LiquidityBootstrapVault does not enforce pair-specific position creation or NFT locking before releasing its reserve.
- Budget vault initialization does not bind the protected asset to WEED, allowing an administrator to initialize with another matching-balance token and recover the WEED allocation; WEED is also recoverable before initialization.
- WeedChef emergency withdrawal can change pool-stake and active-allocation denominators before checkpointing elapsed emissions, over-crediting remaining users or redistributing historical pool allocation.
- WeedChef emergency withdrawal does not reset optional Rewarder stake and can leave stale reward accrual.
- WeedReferral preview can crowd out an invitee boost with commission that the referral vault later clips to zero.
- WeedChef pool reconfiguration can leave old Rewarder stake stale and omit existing stake from a replacement Rewarder.
- Rewarder schedules trust an out-of-band fundedAmount without transferring or verifying reward tokens, can strand undistributed balances, and have no recovery path.
- Review accumulator rounding and long-duration reward accounting.
- Review every v3 callback and token-approval boundary.
- Verify multisig, timelock, guardian, recipient, and role handoffs.
- Complete end-to-end testnet validation with decoded indexer data.
#How to interpret tests
#Current user exposure
The public application has no connected WeedSwap deployment and keeps all writes disabled. No user principal, active reward, live TVL, or mainnet transaction was created during this documentation pass.