…

scheduled before mainnet. report and any findings link from this page once cleared.

foundry suite covers unit + integration + fuzz + invariant runs. slither runs on every PR; mythril runs on push-to-main. axe-core checks accessibility on every web build.

pull payments throughout. excessivelySafeCall on every external call. royalty capped at 10% inside the marketplace. per-round budget hard-capped at 500 HYPE. no continuous bot key; every round is a single owner-signed transaction.

the treasury is a single-key wallet. no multisig. an env-var private key signs. mitigations: pause on the marketplace + sweeper, emergency-drain on the treasury (paused-only), reentrancy guards on every pay-out, owner2step rotation on every owned contract.

the treasury wallet is HYPE-only; NFTs never sit there. The procession spends treasury HYPE through the sweeper contract: phase 1 parks bought apes on the sweeper (custody pending audit, NOT the treasury), phase 2 is an owner-signed confirmBurnRound(roundId) tx that iterates the pending list and calls collection.burnFromSweeper per ape. The split means a compromised distributor or buggy sweep cannot destroy NFTs without an explicit principal signature on top of the buy. Once confirmed, the burn is permanent and decrements totalSupply.