diff --git a/audit/2026-03-06-01/pass0/process.md b/audit/2026-03-06-01/pass0/process.md deleted file mode 100644 index e728ad7..0000000 --- a/audit/2026-03-06-01/pass0/process.md +++ /dev/null @@ -1,25 +0,0 @@ -# Pass 0: Process Review - -## Documents Reviewed - -- `CLAUDE.md` (root) -- `README.md` -- `REUSE.toml` -- `lib/rain.interpreter.interface/CLAUDE.md` (submodule) -- `foundry.toml` - -## Findings - -### A01-1: CLAUDE.md states compiler is 0.8.25 but pragma is ^0.8.18 (LOW) - -CLAUDE.md says "Compiler: Solidity 0.8.25" which is the foundry.toml `solc` version. But it also says "Interfaces use `pragma solidity ^0.8.18`". This is accurate but could confuse a future session — the compiler version (what foundry uses to compile) and the pragma (what the source files declare) are different things. A session might change pragmas to match the stated compiler version, or vice versa. - -The submodule CLAUDE.md says "Interfaces use `pragma solidity ^0.8.25`" which is also different from what this repo uses (`^0.8.18`). This inconsistency between the two CLAUDE.md files could cause a future session to use the wrong pragma when adding new files. - -### A01-2: CLAUDE.md mentions no test directory but repo has no tests (INFO) - -CLAUDE.md does not mention tests or a test directory. The repo has no `test/` directory — this is an interface-only library with no local tests. This is fine but a future session might try to create tests and not know where to put them or whether tests are expected. Explicitly stating "this repo has no local tests — it is interface-only" would prevent wasted effort. - -### A01-3: REUSE.toml does not list CLAUDE.md or audit directory (INFO) - -`REUSE.toml` lists specific files for SPDX annotation. `CLAUDE.md` and the `audit/` directory are not listed. Running `rainix-sol-legal` may fail if these files lack SPDX headers. Either add them to REUSE.toml annotations or add SPDX headers to CLAUDE.md. diff --git a/audit/2026-03-06-01/pass1/IERC3156FlashBorrower.md b/audit/2026-03-06-01/pass1/IERC3156FlashBorrower.md deleted file mode 100644 index 17eacca..0000000 --- a/audit/2026-03-06-01/pass1/IERC3156FlashBorrower.md +++ /dev/null @@ -1,15 +0,0 @@ -# Pass 1: Security — IERC3156FlashBorrower.sol (A12) - -## Evidence of Thorough Reading - -**Constant:** `ON_FLASH_LOAN_CALLBACK_SUCCESS` (line 7) = `keccak256("ERC3156FlashBorrower.onFlashLoan")` - -**Interface:** `IERC3156FlashBorrower` (line 9) - -**Functions:** `onFlashLoan(address, address, uint256, uint256, bytes)` (19-21) — returns bytes32 - -**No errors or events defined. License: CC0-1.0.** - -## Findings - -No findings. Standard ERC-3156 interface faithfully reproduced. diff --git a/audit/2026-03-06-01/pass1/IERC3156FlashLender.md b/audit/2026-03-06-01/pass1/IERC3156FlashLender.md deleted file mode 100644 index b44305d..0000000 --- a/audit/2026-03-06-01/pass1/IERC3156FlashLender.md +++ /dev/null @@ -1,13 +0,0 @@ -# Pass 1: Security — IERC3156FlashLender.sol (A13) - -## Evidence of Thorough Reading - -**Interface:** `IERC3156FlashLender` (line 7) - -**Functions:** `maxFlashLoan(address)` (13), `flashFee(address, uint256)` (21), `flashLoan(IERC3156FlashBorrower, address, uint256, bytes)` (30-32) - -**No errors or events defined. License: CC0-1.0.** - -## Findings - -No findings. Standard ERC-3156 interface faithfully reproduced. diff --git a/audit/2026-03-06-01/pass1/IOrderBookV5.md b/audit/2026-03-06-01/pass1/IOrderBookV5.md deleted file mode 100644 index 5cf7ab3..0000000 --- a/audit/2026-03-06-01/pass1/IOrderBookV5.md +++ /dev/null @@ -1,35 +0,0 @@ -# Pass 1: Security — IOrderBookV5.sol (A01) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV5` (line 318), inherits `IERC3156FlashLender`, `IInterpreterCallerV4` - -**Structs:** `ClearStateChangeV2` (35), `ClearConfigV2` (52), `TaskV2` (73), `IOV2` (86), `OrderConfigV4` (106), `OrderV4` (131), `TakeOrderConfigV4` (148), `TakeOrdersConfigV4` (172), `QuoteV2` (187) - -**Errors:** `ZeroDepositAmount` (323), `ZeroWithdrawTargetAmount` (331), `OrderNoSources` (334), `OrderNoHandleIO` (337), `OrderNoInputs` (339), `OrderNoOutputs` (342). Re-exported from V4: `NoOrders`, `ZeroMaximumInput` (18). - -**Events:** `DepositV2` (351), `WithdrawV2` (365), `AddOrderV3` (383), `RemoveOrderV3` (390), `TakeOrderV3` (401), `OrderNotFound` (409), `OrderZeroAmount` (417), `OrderExceedsMaxRatio` (425), `ClearV3` (433), `AfterClearV2` (439) - -**Functions:** `vaultBalance2` (446), `entask2` (453), `deposit3` (485), `withdraw3` (506), `orderExists` (511), `quote2` (527), `addOrder3` (556), `removeOrder3` (569), `takeOrders3` (609), `clear3` (660) - -## Findings - -### A01-1 | INFO | Line 420 -**NatSpec typo: "An error rather than an error"** -Should read "An event rather than an error" for `OrderExceedsMaxRatio`. - -### A01-2 | INFO | Lines 54-60 -**IO index fields use uint256 where smaller types would suffice** -`aliceInputIOIndex` etc. in `ClearConfigV2`, `TakeOrderConfigV4`, `QuoteV2` are `uint256` but index into small arrays. - -### A01-3 | LOW | Lines 96, 118 -**NatSpec references wrong EvaluableV version** -`OrderConfigV4` NatSpec says "Standard `EvaluableV3`" (line 96) but field is `EvaluableV4`. `OrderV4` NatSpec says "Standard `EvaluableV2`" (line 118) but field is `EvaluableV4`. - -### A01-4 | INFO | Line 316 -**NatSpec typo `IOderBookV5`** -Missing 'r' in "IOrderBookV5". - -### A01-5 | LOW | Lines 172-179 -**Float zero-value semantics undocumented for minimumInput** -NatSpec says minimumInput "MAY be set to zero" but doesn't clarify what zero means in the Float domain. diff --git a/audit/2026-03-06-01/pass1/IOrderBookV5ArbOrderTaker.md b/audit/2026-03-06-01/pass1/IOrderBookV5ArbOrderTaker.md deleted file mode 100644 index f1f844e..0000000 --- a/audit/2026-03-06-01/pass1/IOrderBookV5ArbOrderTaker.md +++ /dev/null @@ -1,19 +0,0 @@ -# Pass 1: Security — IOrderBookV5ArbOrderTaker.sol (A02) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV5ArbOrderTaker` (line 14), inherits `IOrderBookV5OrderTaker` - -**Functions:** `arb4(IOrderBookV5, TakeOrdersConfigV4, TaskV2)` (15) — payable - -**No errors, events, or structs defined.** - -## Findings - -### A02-1 | LOW | Lines 14-18 -**`arb4` payable function lacks NatSpec documentation** -No documentation on what `msg.value` is used for, expected behavior, or access control expectations. Payable functions accepting external contract addresses are high-risk without documentation. - -### A02-2 | INFO | Line 15 -**`arb4` accepts single TaskV2 unlike array pattern elsewhere** -All other task-accepting functions use `TaskV2[]` arrays. Asymmetry may confuse integrators. diff --git a/audit/2026-03-06-01/pass1/IOrderBookV5OrderTaker.md b/audit/2026-03-06-01/pass1/IOrderBookV5OrderTaker.md deleted file mode 100644 index 11e9748..0000000 --- a/audit/2026-03-06-01/pass1/IOrderBookV5OrderTaker.md +++ /dev/null @@ -1,19 +0,0 @@ -# Pass 1: Security — IOrderBookV5OrderTaker.sol (A03) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV5OrderTaker` (line 7) - -**Functions:** `onTakeOrders2(address, address, Float, Float, bytes)` (25-31) - -**No errors, events, or structs defined.** - -## Findings - -### A03-1 | MEDIUM | Lines 25-31 -**Callback lacks reentrancy warning in NatSpec** -`onTakeOrders2` executes mid-transaction (after input tokens sent, before output pulled). NatSpec does not warn that: -1. This is a mid-state-transition callback. -2. Implementations MUST NOT re-enter the orderbook. -3. Orderbook implementations MUST use reentrancy guards. -Missing guidance increases risk of unsafe implementations. diff --git a/audit/2026-03-06-01/pass1/IOrderBookV6.md b/audit/2026-03-06-01/pass1/IOrderBookV6.md deleted file mode 100644 index 8c17491..0000000 --- a/audit/2026-03-06-01/pass1/IOrderBookV6.md +++ /dev/null @@ -1,27 +0,0 @@ -# Pass 1: Security — IOrderBookV6.sol (A14) - -## Evidence of Thorough Reading - -**Struct:** `TakeOrdersConfigV5` (51-62) — fields: `minimumIO`, `maximumIO`, `maximumIORatio`, `IOIsInput`, `orders`, `data` - -**Interface:** `IOrderBookV6` (line 187), inherits `IERC3156FlashLender`, `IInterpreterCallerV4` - -**Errors:** `ZeroVaultId` (191), `ZeroDepositAmount` (197), `ZeroWithdrawTargetAmount` (205), `OrderNoSources` (208), `OrderNoHandleIO` (211), `OrderNoInputs` (214), `OrderNoOutputs` (217), `ZeroMaximumIO` (220), `NoOrders` (223) - -**Events:** `DepositV2` (231), `WithdrawV2` (245), `AddOrderV3` (263), `RemoveOrderV3` (270), `TakeOrderV3` (281), `OrderNotFound` (289), `OrderZeroAmount` (297), `OrderExceedsMaxRatio` (305), `ClearV3` (313), `AfterClearV2` (319) - -**Functions:** `vaultBalance2` (326), `entask2` (333), `deposit4` (368), `withdraw4` (391), `orderExists` (396), `quote2` (412), `addOrder4` (445), `removeOrder3` (459), `takeOrders4` (499), `clear3` (550) - -## Findings - -### A14-1 | INFO | Lines 34-37 -**NatSpec @param name mismatch for TakeOrdersConfigV5 fields** -NatSpec uses `minimumInput`/`maximumInput` but actual fields are `minimumIO`/`maximumIO`. - -### A14-2 | INFO | Lines 51-62 -**No validation guidance for zero maximumIORatio** -No error or NatSpec on whether zero `maximumIORatio` is valid (it would prevent any order matching). - -### A14-3 | INFO | Line 368 -**deposit4 Float input not reflected in DepositV2 event** -`deposit4` accepts `Float depositAmount` but `DepositV2` only emits `uint256`. Asymmetric with `WithdrawV2` which emits both. diff --git a/audit/2026-03-06-01/pass1/IOrderBookV6ArbOrderTaker.md b/audit/2026-03-06-01/pass1/IOrderBookV6ArbOrderTaker.md deleted file mode 100644 index e0946b7..0000000 --- a/audit/2026-03-06-01/pass1/IOrderBookV6ArbOrderTaker.md +++ /dev/null @@ -1,15 +0,0 @@ -# Pass 1: Security — IOrderBookV6ArbOrderTaker.sol (A15) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV6ArbOrderTaker` (line 8), inherits `IOrderBookV6OrderTaker` - -**Functions:** `arb5(IOrderBookV6, TakeOrdersConfigV5, TaskV2)` (9-11) — payable - -**No errors, events, structs, or NatSpec.** - -## Findings - -### A15-1 | LOW | Lines 8-12 -**`arb5` payable function lacks NatSpec documentation** -Same concern as A02-1: no documentation on `msg.value` usage, expected behavior, or orderBook address validation. diff --git a/audit/2026-03-06-01/pass1/IOrderBookV6OrderTaker.md b/audit/2026-03-06-01/pass1/IOrderBookV6OrderTaker.md deleted file mode 100644 index f076a77..0000000 --- a/audit/2026-03-06-01/pass1/IOrderBookV6OrderTaker.md +++ /dev/null @@ -1,15 +0,0 @@ -# Pass 1: Security — IOrderBookV6OrderTaker.sol (A16) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV6OrderTaker` (line 7) - -**Functions:** `onTakeOrders2(address, address, Float, Float, bytes)` (25-31) - -**No errors, events, or structs defined.** - -## Findings - -### A16-1 | LOW | Lines 25-31 -**`onTakeOrders2` callback lacks NatSpec guidance on caller validation** -NatSpec says "Called by IOrderBookV6" but does not specify that implementations MUST validate `msg.sender` is the trusted orderbook. Without this, any contract could call with fabricated parameters. diff --git a/audit/2026-03-06-01/pass1/deprecated.md b/audit/2026-03-06-01/pass1/deprecated.md deleted file mode 100644 index b5512b1..0000000 --- a/audit/2026-03-06-01/pass1/deprecated.md +++ /dev/null @@ -1,26 +0,0 @@ -# Pass 1: Security — Deprecated Interfaces (A04-A11) - -## Files Reviewed - -- A04: `deprecated/v1/IOrderBookV1.sol` -- A05: `deprecated/v2/IOrderBookV2.sol` -- A06: `deprecated/v3/IOrderBookV3.sol` -- A07: `deprecated/v3/IOrderBookV3ArbOrderTaker.sol` -- A08: `deprecated/v3/IOrderBookV3OrderTaker.sol` -- A09: `deprecated/v4/IOrderBookV4.sol` -- A10: `deprecated/v4/IOrderBookV4ArbOrderTaker.sol` -- A11: `deprecated/v4/IOrderBookV4OrderTaker.sol` - -All are deprecated and not expected to be modified. Only propagation to active interfaces is relevant. - -## Import Propagation Chain - -V4 defines `NoOrders` (line 20) and `ZeroMaximumInput` (line 23) → V5 imports both (line 18). - -## Findings - -### A09-1 | INFO | IOrderBookV4.sol lines 20, 23 -**Duplicate error definitions across V3 and V4** -`NoOrders()` and `ZeroMaximumInput()` defined in both V3 and V4 rather than V4 importing from V3. No bug since selectors are identical, but maintenance concern. No action needed on deprecated files. - -No CRITICAL, HIGH, MEDIUM, or LOW findings in deprecated interfaces. diff --git a/audit/2026-03-06-01/pass2/coverage.md b/audit/2026-03-06-01/pass2/coverage.md deleted file mode 100644 index b5039cd..0000000 --- a/audit/2026-03-06-01/pass2/coverage.md +++ /dev/null @@ -1,11 +0,0 @@ -# Pass 2: Test Coverage - -## Summary - -This repository contains only Solidity interface definitions (no implementation code). There is no `test/` directory and no test files exist. - -Since interfaces have no function bodies, there is nothing to unit test locally. Implementation testing belongs in downstream repos that implement these interfaces. - -## Findings - -No findings. Interface-only libraries have no testable logic. diff --git a/audit/2026-03-06-01/pass3/IERC3156FlashBorrower.md b/audit/2026-03-06-01/pass3/IERC3156FlashBorrower.md deleted file mode 100644 index bb59631..0000000 --- a/audit/2026-03-06-01/pass3/IERC3156FlashBorrower.md +++ /dev/null @@ -1,9 +0,0 @@ -# Pass 3: Documentation — IERC3156FlashBorrower.sol (A12) - -## Evidence of Thorough Reading - -Same as Pass 1. - -## Findings - -No findings. Fully documented per ERC-3156 spec. diff --git a/audit/2026-03-06-01/pass3/IERC3156FlashLender.md b/audit/2026-03-06-01/pass3/IERC3156FlashLender.md deleted file mode 100644 index 72178b7..0000000 --- a/audit/2026-03-06-01/pass3/IERC3156FlashLender.md +++ /dev/null @@ -1,12 +0,0 @@ -# Pass 3: Documentation — IERC3156FlashLender.sol (A13) - -## Evidence of Thorough Reading - -**Interface:** `IERC3156FlashLender` (line 7) -**Functions:** `maxFlashLoan` (13), `flashFee` (21), `flashLoan` (30) - -## Findings - -### A13-1 | LOW | Lines 23-32 -**`flashLoan` missing `@return` documentation** -Function returns `bool` (line 32) but NatSpec has no `@return` tag. Other functions in this file document their return values. diff --git a/audit/2026-03-06-01/pass3/IOrderBookV5.md b/audit/2026-03-06-01/pass3/IOrderBookV5.md deleted file mode 100644 index c6bbf88..0000000 --- a/audit/2026-03-06-01/pass3/IOrderBookV5.md +++ /dev/null @@ -1,27 +0,0 @@ -# Pass 3: Documentation — IOrderBookV5.sol (A01) - -## Evidence of Thorough Reading - -Same as Pass 1. All structs, errors, events, and functions enumerated there. - -## Findings - -### A01-6 | LOW | Line 116 -**`OrderV4` struct-level doc references stale `EvaluableV2`** -Line 116: "Identical to `Order` except for the newer `EvaluableV2`." Should reference `EvaluableV4`. (Related to A01-3 which covers lines 96 and 118 — this is a third occurrence on line 116.) - -### A01-7 | LOW | Line 312 -**Interface NatSpec references stale `IInterpreterV1`** -Line 312: "any expression that can run on any `IInterpreterV1`". The actual import and interface uses `IInterpreterV4`. - -### A01-8 | INFO | Line 43 -**`ClearConfigV2` doc uses unclear phrase "token moment"** -"allows two orders to be fully matched to a specific token moment" — unclear meaning. - -### A01-9 | LOW | Line 293 -**Interface NatSpec says vault IDs are `bytes` but they are `bytes32`** -"As vault IDs are `bytes` values" — vault IDs are `bytes32` (line 88). Technically inaccurate. - -### A01-10 | LOW | Lines 448-453 -**`entask2` missing `@param tasks` NatSpec** -Has descriptive prose but no `@param` tag for its `tasks` parameter, unlike all other functions. diff --git a/audit/2026-03-06-01/pass3/IOrderBookV5ArbOrderTaker.md b/audit/2026-03-06-01/pass3/IOrderBookV5ArbOrderTaker.md deleted file mode 100644 index 6922e11..0000000 --- a/audit/2026-03-06-01/pass3/IOrderBookV5ArbOrderTaker.md +++ /dev/null @@ -1,11 +0,0 @@ -# Pass 3: Documentation — IOrderBookV5ArbOrderTaker.sol (A02) - -## Evidence of Thorough Reading - -Same as Pass 1. - -## Findings - -### A02-3 | LOW | Line 14 -**`IOrderBookV5ArbOrderTaker` interface lacks any NatSpec** -No `@title` or `@notice` at the interface level. Both `arb4` function and interface are undocumented. diff --git a/audit/2026-03-06-01/pass3/IOrderBookV5OrderTaker.md b/audit/2026-03-06-01/pass3/IOrderBookV5OrderTaker.md deleted file mode 100644 index 7ebea63..0000000 --- a/audit/2026-03-06-01/pass3/IOrderBookV5OrderTaker.md +++ /dev/null @@ -1,11 +0,0 @@ -# Pass 3: Documentation — IOrderBookV5OrderTaker.sol (A03) - -## Evidence of Thorough Reading - -Same as Pass 1. - -## Findings - -### A03-2 | LOW | Line 7 -**`IOrderBookV5OrderTaker` interface lacks `@title`/`@notice` NatSpec** -No interface-level documentation. The `onTakeOrders2` function is well-documented but the interface itself has no doc comment. diff --git a/audit/2026-03-06-01/pass3/IOrderBookV6.md b/audit/2026-03-06-01/pass3/IOrderBookV6.md deleted file mode 100644 index 386c0d7..0000000 --- a/audit/2026-03-06-01/pass3/IOrderBookV6.md +++ /dev/null @@ -1,11 +0,0 @@ -# Pass 3: Documentation — IOrderBookV6.sol (A14) - -## Evidence of Thorough Reading - -Same as Pass 1. - -## Findings - -### A14-4 | LOW | Lines 328-333 -**`entask2` has no NatSpec tags — missing `@param tasks`** -Function has prose description but no formal NatSpec tags (`@notice`, `@param`). Same issue as A01-10 in V5. diff --git a/audit/2026-03-06-01/pass3/IOrderBookV6ArbOrderTaker.md b/audit/2026-03-06-01/pass3/IOrderBookV6ArbOrderTaker.md deleted file mode 100644 index 956be89..0000000 --- a/audit/2026-03-06-01/pass3/IOrderBookV6ArbOrderTaker.md +++ /dev/null @@ -1,9 +0,0 @@ -# Pass 3: Documentation — IOrderBookV6ArbOrderTaker.sol (A15) - -## Evidence of Thorough Reading - -Same as Pass 1. - -## Findings - -No new findings beyond A15-1 (already reported in Pass 1). diff --git a/audit/2026-03-06-01/pass3/IOrderBookV6OrderTaker.md b/audit/2026-03-06-01/pass3/IOrderBookV6OrderTaker.md deleted file mode 100644 index 734a1f7..0000000 --- a/audit/2026-03-06-01/pass3/IOrderBookV6OrderTaker.md +++ /dev/null @@ -1,9 +0,0 @@ -# Pass 3: Documentation — IOrderBookV6OrderTaker.sol (A16) - -## Evidence of Thorough Reading - -Same as Pass 1. - -## Findings - -No findings. `onTakeOrders2` is fully documented with `@notice` and `@param` for all parameters. diff --git a/audit/2026-03-06-01/pass4/IERC3156FlashBorrower.md b/audit/2026-03-06-01/pass4/IERC3156FlashBorrower.md deleted file mode 100644 index bcb964e..0000000 --- a/audit/2026-03-06-01/pass4/IERC3156FlashBorrower.md +++ /dev/null @@ -1,19 +0,0 @@ -# Pass 4: Code Quality — IERC3156FlashBorrower.sol (A12) - -## Evidence of Thorough Reading - -**Constant:** `ON_FLASH_LOAN_CALLBACK_SUCCESS` (line 7) = `keccak256("ERC3156FlashBorrower.onFlashLoan")` - -**Interface:** `IERC3156FlashBorrower` (line 9) - -**Functions:** `onFlashLoan(address, address, uint256, uint256, bytes)` (19-21) -- returns bytes32 - -**No errors, events, or structs defined. License: CC0-1.0.** - -**Imports:** None - -**Forge-lint suppressions:** None - -## Findings - -No new findings. The `/** */` comment style (vs `///` used elsewhere) is intentional: this is a verbatim reproduction of the ERC-3156 standard interface under CC0-1.0 license, and maintaining comment fidelity to the original spec is appropriate. diff --git a/audit/2026-03-06-01/pass4/IERC3156FlashLender.md b/audit/2026-03-06-01/pass4/IERC3156FlashLender.md deleted file mode 100644 index 48eb441..0000000 --- a/audit/2026-03-06-01/pass4/IERC3156FlashLender.md +++ /dev/null @@ -1,17 +0,0 @@ -# Pass 4: Code Quality — IERC3156FlashLender.sol (A13) - -## Evidence of Thorough Reading - -**Interface:** `IERC3156FlashLender` (line 7) - -**Functions:** `maxFlashLoan(address)` (13), `flashFee(address, uint256)` (21), `flashLoan(IERC3156FlashBorrower, address, uint256, bytes)` (30-32) - -**No errors, events, structs, or constants defined. License: CC0-1.0.** - -**Imports:** `IERC3156FlashBorrower` from `./IERC3156FlashBorrower.sol` (5) - -**Forge-lint suppressions:** None - -## Findings - -No new findings. Same rationale as A12 regarding comment style. diff --git a/audit/2026-03-06-01/pass4/IOrderBookV5.md b/audit/2026-03-06-01/pass4/IOrderBookV5.md deleted file mode 100644 index 0b6745e..0000000 --- a/audit/2026-03-06-01/pass4/IOrderBookV5.md +++ /dev/null @@ -1,40 +0,0 @@ -# Pass 4: Code Quality — IOrderBookV5.sol (A01) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV5` (line 318), inherits `IERC3156FlashLender`, `IInterpreterCallerV4` - -**Structs:** `ClearStateChangeV2` (35), `ClearConfigV2` (52), `TaskV2` (73), `IOV2` (86), `OrderConfigV4` (106), `OrderV4` (131), `TakeOrderConfigV4` (148), `TakeOrdersConfigV4` (172), `QuoteV2` (187) - -**Errors:** `ZeroDepositAmount` (323), `ZeroWithdrawTargetAmount` (331), `OrderNoSources` (334), `OrderNoHandleIO` (337), `OrderNoInputs` (339), `OrderNoOutputs` (342). Re-exported from V4: `NoOrders`, `ZeroMaximumInput` (18). - -**Events:** `DepositV2` (351), `WithdrawV2` (365), `AddOrderV3` (383), `RemoveOrderV3` (390), `TakeOrderV3` (401), `OrderNotFound` (409), `OrderZeroAmount` (417), `OrderExceedsMaxRatio` (425), `ClearV3` (433), `AfterClearV2` (439) - -**Functions:** `vaultBalance2` (446), `entask2` (453), `deposit3` (485), `withdraw3` (506), `orderExists` (511), `quote2` (527), `addOrder3` (556), `removeOrder3` (569), `takeOrders3` (609), `clear3` (660) - -**Types/constants imported:** `Float` (21), `EvaluableV4`, `IInterpreterCallerV4`, `SignedContextV1`, `IInterpreterV4`, `IInterpreterStoreV3` (6-14), `NoOrders`, `ZeroMaximumInput` (18), `IERC3156FlashLender` (5) - -**Forge-lint suppressions:** `unused-import` on lines 10, 12, 17-19; `mixed-case-variable` on lines 53, 55, 57, 59, 150, 152, 175, 189, 191; `pascal-case-struct` on line 85 - -## Findings - -### A01-11 | LOW | Line 469 -**Broken NatSpec: `//` instead of `///` truncates `deposit3` documentation** -Line 469 uses `//` (regular comment) instead of `///` (NatSpec), breaking the NatSpec block mid-paragraph. All text from line 470 onward (vault ID namespacing, zero-deposit behavior, `@param` tags) is excluded from generated documentation. V6's `deposit4` does not have this issue (line 349 correctly uses `///`). This was inherited from the deprecated `IOrderBookV4.deposit2` (line 420 in that file). - -### A01-12 | INFO | Line 488 -**Typo "withrawer" in `withdraw3` NatSpec** -Should be "withdrawer". V6's `withdraw4` at line 371 has the correct spelling, confirming this is a known typo that was fixed in V6 but not backported to V5. - -### A01-13 | INFO | Line 317 -**Typo "Calcuations" in interface-level NatSpec** -"Calcuations and vault balances are rain floating point values" should be "Calculations". This is on the same line block as the already-reported `IOderBookV5` typo (A01-4) but is a separate word. - -### A01-14 | INFO | Lines 205, 643, 647, 286 -**Multiple NatSpec typos shared with V6 that V6 partially fixed** -- Line 205: "perpective" (should be "perspective") -- also in V6 line 73 -- Line 643: "evalulate" (should be "evaluate") -- also in V6 line 533 -- Line 647: "suddently" (should be "suddenly") -- also in V6 line 537 -- Line 286: "balanes" (should be "balances") -- V6 line 154 correctly says "balances" - -These are carried forward from older versions. V6 fixed "balanes" and "withrawer" but missed the other three, indicating an incomplete cleanup pass. diff --git a/audit/2026-03-06-01/pass4/IOrderBookV5ArbOrderTaker.md b/audit/2026-03-06-01/pass4/IOrderBookV5ArbOrderTaker.md deleted file mode 100644 index e1067cf..0000000 --- a/audit/2026-03-06-01/pass4/IOrderBookV5ArbOrderTaker.md +++ /dev/null @@ -1,19 +0,0 @@ -# Pass 4: Code Quality — IOrderBookV5ArbOrderTaker.sol (A02) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV5ArbOrderTaker` (line 14), inherits `IOrderBookV5OrderTaker` - -**Functions:** `arb4(IOrderBookV5, TakeOrdersConfigV4, TaskV2)` (15-17) -- payable - -**No errors, events, structs, or constants defined.** - -**Imports:** `IOrderBookV5OrderTaker` (5), `TakeOrdersConfigV4`, `IOrderBookV5`, `TaskV2`, `EvaluableV4` (6-12) - -**Forge-lint suppressions:** `unused-import` on line 10 for `EvaluableV4` - -## Findings - -### A02-4 | INFO | Lines 10-11 -**`EvaluableV4` re-export present in V5 arb file but absent in V6 counterpart** -This file imports `EvaluableV4` with an `unused-import` suppression for re-export purposes (so downstream consumers can import it from here). The V6 counterpart `IOrderBookV6ArbOrderTaker.sol` does NOT do the same -- it imports only `TakeOrdersConfigV5`, `IOrderBookV6`, and `TaskV2` without `EvaluableV4`. This is an inconsistency in the re-export pattern between V5 and V6 arb interfaces. diff --git a/audit/2026-03-06-01/pass4/IOrderBookV5OrderTaker.md b/audit/2026-03-06-01/pass4/IOrderBookV5OrderTaker.md deleted file mode 100644 index 5426afb..0000000 --- a/audit/2026-03-06-01/pass4/IOrderBookV5OrderTaker.md +++ /dev/null @@ -1,17 +0,0 @@ -# Pass 4: Code Quality — IOrderBookV5OrderTaker.sol (A03) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV5OrderTaker` (line 7) - -**Functions:** `onTakeOrders2(address, address, Float, Float, bytes)` (25-31) - -**No errors, events, structs, or constants defined.** - -**Imports:** `Float` from `./IOrderBookV5.sol` (5) - -**Forge-lint suppressions:** None - -## Findings - -No new findings. The file is clean from a code quality perspective. Import pattern, naming, formatting, and comment style are all consistent with its V6 counterpart (`IOrderBookV6OrderTaker.sol`). Both files are structurally identical modulo the interface/type names. diff --git a/audit/2026-03-06-01/pass4/IOrderBookV6.md b/audit/2026-03-06-01/pass4/IOrderBookV6.md deleted file mode 100644 index 71fac57..0000000 --- a/audit/2026-03-06-01/pass4/IOrderBookV6.md +++ /dev/null @@ -1,28 +0,0 @@ -# Pass 4: Code Quality — IOrderBookV6.sol (A14) - -## Evidence of Thorough Reading - -**Struct:** `TakeOrdersConfigV5` (51-62) -- fields: `minimumIO` (53), `maximumIO` (55), `maximumIORatio` (57), `IOIsInput` (59), `orders` (60), `data` (61) - -**Interface:** `IOrderBookV6` (line 187), inherits `IERC3156FlashLender`, `IInterpreterCallerV4` - -**Errors:** `ZeroVaultId` (191), `ZeroDepositAmount` (197), `ZeroWithdrawTargetAmount` (205), `OrderNoSources` (208), `OrderNoHandleIO` (211), `OrderNoInputs` (214), `OrderNoOutputs` (217), `ZeroMaximumIO` (220), `NoOrders` (223) - -**Events:** `DepositV2` (231), `WithdrawV2` (245), `AddOrderV3` (263), `RemoveOrderV3` (270), `TakeOrderV3` (281), `OrderNotFound` (289), `OrderZeroAmount` (297), `OrderExceedsMaxRatio` (305), `ClearV3` (313), `AfterClearV2` (319) - -**Functions:** `vaultBalance2` (326), `entask2` (333), `deposit4` (368), `withdraw4` (391), `orderExists` (396), `quote2` (412), `addOrder4` (445), `removeOrder3` (459), `takeOrders4` (499), `clear3` (550) - -**Imports:** `IERC3156FlashLender` (5), `IInterpreterCallerV4`, `SignedContextV1`, `EvaluableV4`, `IInterpreterV4`, `IInterpreterStoreV3` (6-15), `ClearStateChangeV2`, `ClearConfigV2`, `TaskV2`, `IOV2`, `OrderConfigV4`, `OrderV4`, `TakeOrderConfigV4`, `QuoteV2` (18-28), `Float` (30) - -**Forge-lint suppressions:** `unused-import` on lines 9, 11, 13, 22; `mixed-case-variable` on lines 52, 54, 56, 58 - -## Findings - -### A14-5 | INFO | Lines 73, 533, 537 -**Three NatSpec typos carried from V5 despite partial cleanup** -V6 fixed several typos from V5 ("balanes" -> "balances" at line 154, "withrawer" -> "withdrawer" at line 371) but missed three others: -- Line 73: "perpective" (should be "perspective") -- Line 533: "evalulate" (should be "evaluate") -- Line 537: "suddently" (should be "suddenly") - -These same typos exist in V5 (A01-14) and all deprecated versions. The partial fix creates an inconsistency -- some inherited typos were cleaned up while others were not. diff --git a/audit/2026-03-06-01/pass4/IOrderBookV6ArbOrderTaker.md b/audit/2026-03-06-01/pass4/IOrderBookV6ArbOrderTaker.md deleted file mode 100644 index c8bac72..0000000 --- a/audit/2026-03-06-01/pass4/IOrderBookV6ArbOrderTaker.md +++ /dev/null @@ -1,19 +0,0 @@ -# Pass 4: Code Quality — IOrderBookV6ArbOrderTaker.sol (A15) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV6ArbOrderTaker` (line 8), inherits `IOrderBookV6OrderTaker` - -**Functions:** `arb5(IOrderBookV6, TakeOrdersConfigV5, TaskV2)` (9-11) -- payable - -**No errors, events, structs, or constants defined.** - -**Imports:** `IOrderBookV6OrderTaker` (5), `TakeOrdersConfigV5`, `IOrderBookV6`, `TaskV2` (6) - -**Forge-lint suppressions:** None - -## Findings - -### A15-2 | INFO | Line 6 -**Missing `EvaluableV4` re-export, inconsistent with V5 counterpart** -`IOrderBookV5ArbOrderTaker.sol` imports and re-exports `EvaluableV4` (with an `unused-import` suppression) so that downstream consumers can access it from the arb interface file. This file does not do the same. If the re-export in V5 is intentional for consumer convenience, V6 should match. If it is unnecessary in V6, it should be removed from V5. diff --git a/audit/2026-03-06-01/pass4/IOrderBookV6OrderTaker.md b/audit/2026-03-06-01/pass4/IOrderBookV6OrderTaker.md deleted file mode 100644 index 3b1aeed..0000000 --- a/audit/2026-03-06-01/pass4/IOrderBookV6OrderTaker.md +++ /dev/null @@ -1,17 +0,0 @@ -# Pass 4: Code Quality — IOrderBookV6OrderTaker.sol (A16) - -## Evidence of Thorough Reading - -**Interface:** `IOrderBookV6OrderTaker` (line 7) - -**Functions:** `onTakeOrders2(address, address, Float, Float, bytes)` (25-31) - -**No errors, events, structs, or constants defined.** - -**Imports:** `Float` from `./IOrderBookV6.sol` (5) - -**Forge-lint suppressions:** None - -## Findings - -No new findings. The file is structurally identical to its V5 counterpart (`IOrderBookV5OrderTaker.sol`) with appropriate name substitutions. Import pattern, naming, formatting, and comment style are consistent. diff --git a/audit/2026-03-06-01/pass4/remaining.md b/audit/2026-03-06-01/pass4/remaining.md deleted file mode 100644 index 7cafff8..0000000 --- a/audit/2026-03-06-01/pass4/remaining.md +++ /dev/null @@ -1,19 +0,0 @@ -# Pass 4: Code Quality — Remaining Files - -## A03: IOrderBookV5OrderTaker.sol -No findings. - -## A12: IERC3156FlashBorrower.sol -No findings. `/** */` comment style is appropriate for ERC-3156 spec fidelity. - -## A13: IERC3156FlashLender.sol -No findings. - -## A15: IOrderBookV6ArbOrderTaker.sol - -### A15-2 | INFO | Line 6 -**Missing `EvaluableV4` re-export, inconsistent with V5 counterpart** -V5 counterpart (A02) re-exports `EvaluableV4` but V6 does not. - -## A16: IOrderBookV6OrderTaker.sol -No findings. diff --git a/audit/2026-03-06-01/pass5/IOrderBookV6.md b/audit/2026-03-06-01/pass5/IOrderBookV6.md deleted file mode 100644 index d7b2930..0000000 --- a/audit/2026-03-06-01/pass5/IOrderBookV6.md +++ /dev/null @@ -1,15 +0,0 @@ -# Pass 5: Correctness — IOrderBookV6.sol (A14) - -## Evidence of Thorough Reading - -Same as prior passes. - -## Findings - -### A14-7 | LOW | Lines 359, 380 -**`deposit4`/`withdraw4` docs don't name `ZeroVaultId` error** -Both functions document that vault ID `0` is disallowed but don't say "MUST revert with `ZeroVaultId`", unlike all other error references in the same interface (e.g., "MUST revert with `ZeroDepositAmount`"). Implementers may use a different error or forget to check. - -### A14-8 | LOW | Lines 464-478 -**`takeOrders4` NatSpec still describes input-only semantics** -NatSpec says "filled maximally until the request input is reached" and "MAY specify a minimum input". But V6's `TakeOrdersConfigV5` has `IOIsInput` flag allowing limits on either input or output. NatSpec should reflect the dual semantics. diff --git a/audit/2026-03-06-01/pass5/remaining.md b/audit/2026-03-06-01/pass5/remaining.md deleted file mode 100644 index fee9c03..0000000 --- a/audit/2026-03-06-01/pass5/remaining.md +++ /dev/null @@ -1,22 +0,0 @@ -# Pass 5: Correctness — Remaining Files - -## A01: IOrderBookV5.sol -No new findings beyond prior passes. Error names match trigger conditions. Event names/params match described behavior. Struct field types match purpose. ERC-3156 inheritance is correct. - -## A02: IOrderBookV5ArbOrderTaker.sol -No new findings. Inheritance chain is correct. - -## A03: IOrderBookV5OrderTaker.sol -No new findings. Function signature matches documented callback pattern. - -## A12: IERC3156FlashBorrower.sol -No findings. Spec-compliant. `ON_FLASH_LOAN_CALLBACK_SUCCESS` correctly computes `keccak256("ERC3156FlashBorrower.onFlashLoan")`. - -## A13: IERC3156FlashLender.sol -No findings. Spec-compliant. All function signatures match ERC-3156. - -## A15: IOrderBookV6ArbOrderTaker.sol -No new findings. - -## A16: IOrderBookV6OrderTaker.sol -No new findings. diff --git a/audit/2026-03-06-01/triage.md b/audit/2026-03-06-01/triage.md deleted file mode 100644 index d0e7fac..0000000 --- a/audit/2026-03-06-01/triage.md +++ /dev/null @@ -1,24 +0,0 @@ -# Triage — Audit 2026-03-06-01 - -## All LOW+ Findings - -| ID | Severity | Pass | File | Title | Status | -|-----|----------|------|------|-------|--------| -| A01-1 | LOW | P0 | CLAUDE.md | Pragma version inconsistency between CLAUDE.md and submodule | DISMISSED — CLAUDE.md already notes the difference with a parenthetical | -| A01-3 | LOW | P1 | IOrderBookV5.sol | NatSpec references wrong EvaluableV version (lines 96, 118) | FIXED | -| A01-5 | LOW | P1 | IOrderBookV5.sol | Float zero-value semantics undocumented for minimumInput | DISMISSED — Float zero semantics are the responsibility of the float library, not the interface NatSpec | -| A01-6 | LOW | P3 | IOrderBookV5.sol | OrderV4 struct-level doc references stale EvaluableV2 (line 116) | FIXED — addressed with A01-3 | -| A01-7 | LOW | P3 | IOrderBookV5.sol | Interface NatSpec references stale IInterpreterV1 (line 312) | FIXED | -| A01-9 | LOW | P3 | IOrderBookV5.sol | Interface NatSpec says vault IDs are bytes but they are bytes32 | FIXED | -| A01-10 | LOW | P3 | IOrderBookV5.sol | entask2 missing @param tasks NatSpec | FIXED | -| A01-11 | LOW | P4 | IOrderBookV5.sol | Broken NatSpec: // instead of /// truncates deposit3 docs | FIXED | -| A02-1 | LOW | P1 | IOrderBookV5ArbOrderTaker.sol | arb4 payable function lacks NatSpec documentation | FIXED | -| A02-3 | LOW | P3 | IOrderBookV5ArbOrderTaker.sol | IOrderBookV5ArbOrderTaker interface lacks any NatSpec | FIXED — addressed with A02-1 | -| A03-1 | MEDIUM | P1 | IOrderBookV5OrderTaker.sol | Callback lacks reentrancy warning in NatSpec | FIXED | -| A03-2 | LOW | P3 | IOrderBookV5OrderTaker.sol | IOrderBookV5OrderTaker interface lacks @title/@notice NatSpec | FIXED — addressed with A03-1 | -| A13-1 | LOW | P3 | IERC3156FlashLender.sol | flashLoan missing @return documentation | FIXED | -| A14-4 | LOW | P3 | IOrderBookV6.sol | entask2 has no NatSpec tags in V6 | FIXED | -| A14-7 | LOW | P5 | IOrderBookV6.sol | deposit4/withdraw4 docs don't name ZeroVaultId error | FIXED | -| A14-8 | LOW | P5 | IOrderBookV6.sol | takeOrders4 NatSpec still describes input-only semantics | FIXED | -| A15-1 | LOW | P1 | IOrderBookV6ArbOrderTaker.sol | arb5 payable function lacks NatSpec documentation | FIXED | -| A16-1 | LOW | P1 | IOrderBookV6OrderTaker.sol | onTakeOrders2 callback lacks caller validation guidance | FIXED |