SECURITY · DISCLOSURE V1.0 · LAST UPDATED 17 MAY 2026
Smart Contract Audit.
Internal collaborative audit Claude × Gemini · 15/15 findings closed · 12/12 Foundry invariants · Ownable2Step + Pausable + ReentrancyGuard · Gnosis Safe 2-of-3 multisig planned · Bug bounty pool $10k dedicated · max €25k single high-severity.
Summary
Numbers from the SC_AUDIT v1.0 disclosure (audit/SC_SECURITY_DISCLOSURE.md).
15 / 15
Findings closed
0 crit · 2 high · 4 med · 6 low · 3 info
12 / 12
Invariants covered
Foundry fuzz 256 runs
49 / 49
Unit tests passing
Hardhat suite
0.8.27
Pragma frozen
Pre-deploy lock
Findings
12 findings categorized by severity · all closed
#1HIGH
tokenOut lockup via SDK calldata bug
→ swapWithFee(tokenIn, tokenOut, ...) + post-swap sweep tokenOut → msg.sender
#2HIGH
rescueTokens hardcoded recipient
→ Explicit recipient parameter + zero-address guard
#3MED
setDexAllowed missing timelock
→ Asymmetric timelock: queueDexAllowed 24h + revokeDexAllowed immediate
#4MED
Fee-on-transfer multiplicative effect on treasury
→ Documented tradeoff + off-chain correction
#5MED
No emergency pause
→ OpenZeppelin Pausable: pause / unpause, owner only
#6MED
No TVL cap (large swap exposure)
→ Rolling 24h cap per token (raw, Option C). Chainlink upgrade planned at $100k MRR
#7LOW
Ownable single-step (misclick risk)
→ Ownable2Step (transferOwnership → acceptOwnership)
#8LOW
Constructor does not emit TreasuryUpdated
→ Emit TreasuryUpdated(0x0, treasury) in the constructor
#10LOW
setDexAllowed(treasury, true) possible
→ Revert DexCannotBeTreasury on add. Revoke always safe
#13LOW
Pragma caret ^0.8.20
→ Pragma frozen at 0.8.27 (fixed)
#14LOW
AA bundler caller pattern (msg.sender)
→ Documentation: caller must be an EOA or Smart Wallet, not EntryPoint directly
#15LOW
safeIncreaseAllowance does not handle USDT
→ forceApprove (OZ v5 best practice)
Responsible disclosure
Pool $10k · max €25k single high-sev · PGP first-touch 60 min · safe-harbor policy
Bug Bounty
Dedicated $10k pool · max single payout €25k per verified high-severity finding · tier rewards $50-$25,000 EUR equivalent · HackenProof setup in progress · official publication within 30 days of mainnet deploy.
$10k / €25k
Dedicated pool · max single high-sev
Email + PGP
security@pulsentric.com · 60 min first-touch guarantee · PGP encrypted submissions.
Safe Harbor
Good-faith security research protected · no legal action against researchers acting in good faith.
DYOR · Pulsentric provides data and analytics, not investment advice · Smart contract audit public · MiCA compliant