Every finding and every correction of the public repository, with the audits and snapshots behind them. Each page is the note as written, with its date, its chains and a link to the contracts it names.
2026-10-05. The price-consumer rule of 2026-10-04 (METHODOLOGY, "oracleAuthorityScore for price consumers") was built for ten lending markets. This study asked the same question of every other tracked target that might read prices. One reader studied each...
2026-10-04. Companion to the METHODOLOGY section "oracleAuthorityScore for price consumers", decided that day. The rule scores whoever controls what a lending market reads directly: a Chainlink proxy, a rate provider, an upgradeable feed. It does not score...
2026-10-01. Tool: scripts/checklendingpriceauthority.py (read-only, ethcall only), test scripts/tests/testchecklendingpriceauthority.py. Amounts are from the run of about 10:50 UTC. The tool went through two independent reviews that day; the second found that...
2026-10-01. The test this repository said it lacked (data/research2026-09-21-authority-incidents-evidence-table.md:48-51): read the authority configuration of incident victims 30 days before the incident, and of comparable untouched protocols at the same...
2026-09-30. Third of the 3 SolGov-adjacent candidates never turned into scorers (finding2026-09-26-solgov-registry-verified-live.md listed Hylo, Switchboard, Pyth as untracked; Hylo and Switchboard closed tonight, see their own findings). This one is not...
2026-09-26. Investigates an open follow-up: attributing the two coinbase payout addresses that have no published label (t1MKn34 29.6%, t1SEgZ 7.7%) to entities through a primary source. Result: the addresses are real and persistent (confirmed live, current...
New read-only tool scripts/checkpendingops.py (+ scripts/lib/pendingops.py, 5 tests). A timelock's delay is a promise; the queue is the fact. For each watched timelock it reads the queue events of the last N days (365 by default: an OpenZeppelin queue has no...
2026-09-26. finding2026-09-26-tvl-coverage-by-ecosystem.md ranks Ethereum's untracked protocols by DefiLlama value: SSV Network ($14.1B) and Binance staked ETH ($9.4B) come first. data/coverage2026-09-21-tvl-by-ecosystem.md had already set both aside as...
2026-09-26. The 26/09 bounded-loop routine's Hyperliquid worker listed four HIP-3 perp dexes the oracle does not track. Checked live, read-only (api.hyperliquid.xyz/info perpDexs and metaAndAssetCtxs per dex, plus ethgetCode on HyperEVM for each address): the...
2026-09-26. Closes an open follow-up: the pathUSD ISSUERROLE is a UUPS proxy, upgradable by a single EOA that also holds DEFAULTADMIN, never reviewed since the committed score. It was already covered (scoredtargets2026-09-18-controller-types.md classifies the...
2026-09-26. Closes the one genuinely open point data/finding2026-09-25-vault-v2-inventory.md explicitly left unresolved rather than guessed at: Sentora x Spark RLUSD ($250.0M, Ethereum L1 Vault V2)'s owner, 0x3300f198988e4C9C63F75dF86De36421f06af8c4, is a...
2026-09-26. Backlog item 15 (data/finding2026-09-20-competitor-gaps-and-morpho-vault-layer.md:499- 519,717-719: "An issuer-power tag per vault asset (freeze, seize, pause, upgrade, and who holds the roles)... Cheap, because verified ABIs are public"). That...
2026-09-26. Extends today's checkissuerpower.py/checkaavev3poolissuerpower.py pattern to this oracle's 3 already-tracked, already-scored Compound V3 Comet markets (scorecompoundv3cusdc on Ethereum L1, scorecompoundv3cometarbitrumusdc,...
2026-09-26. Extends today's checkissuerpower.py (built for the 9 tracked Morpho V1 vaults' 4 underlying assets) to a much bigger, ALREADY-TRACKED and ALREADY-SCORED target: scoreaavev3pool() (chains/ethereum-l1/scorers.py, $14.77B TVL) scores the Pool's OWN...
Already covered, and scored. The Hyperliquid oracle tracks this contract as "Hyperliquid legacy USDC bridge (Bridge2, Arbitrum One)" (chains/hyperliquid/scripts/scoringbuild20260918.py::scorebridge2: 3-of-4 equal-weight hot and cold sets, admin 65, multisig...
2026-09-26, revised 2026-09-27 after an independent review (the review's corrections are folded in below). data/research2026-09-21-authority-incidents-evidence-table.md lists 23 authority incidents and concludes that the honest claim is "measured exposure of...
2026-09-26. New read-only tool scripts/whocontrols.py (+ scripts/lib/authorityindex.py, 11 unit tests). It reuses the live resolution checkcrossecosystemoverlap.py already does for every registry group (110 groups, 8 EVM ecosystems), extracted into...
Documentation only -- no scorers.py entry created for the Core Bridge itself. This was looked at as a candidate target (worm2ZoG2kUd4vFXhvjh93UUH596ayRfgQ2MgjNMTth, the Wormhole Core Bridge, i.e. the cross-chain messaging program, not the "Portal" token...
2026-09-25. Continues data/finding2026-09-25-vault-v2-scoring-scope.md (Vault V2 scoring needs a real methodology decision, not built) with the safe next step that finding flagged: a disclosed-only inventory reusing already-settled patterns (owner/curator...
2026-09-25. Roadmap item 9 (broad-review round 2), continued after the go-ahead. This project already tracked, on 5 chains it monitors (Ethereum L1, Arbitrum, Base, Plasma, Monad), that the SAME 7 signers hold Aave's PROTOCOLGUARDIAN/EMERGENCYADMIN seat -- a...
2026-09-25. Roadmap item 5 (broad-review round 2): scripts/lib/crossecosystemoverlap.py's GROUPS-based registry (used by checkcrossecosystemoverlap.py, checksafemodulesguards.py and checknestedsigners.py) covered Robinhood Chain, Ethereum L1, Arbitrum, Base,...
2026-09-25. Continues the broad-review round 2 roadmap item 4 (extend the role-sweep pattern that already found 2 real bugs on Radiant and Aave V3 Monad). scoreaavev3pool -- $14.77B TVL, this oracle's single largest tracked target by TVL -- had checked...
2026-09-25. Roadmap item 10 (broad-review round 2), continued after the go-ahead. The research already existed in full (data/finding2026-09-20-competitor-gaps-and-morpho-vault-layer.md, "eighth pass": chains/ethereum-l1/scripts/sweepexitcapacity.py, a...
safeownersandthreshold returns a list of owner addresses and a threshold, and every scorer and the cross-ecosystem overlap check treated each owner as one independent key. Some owners are not keys. This pass resolves every registered root Safe's signers down...
The oracle scores authority: who can change a target, how many keys, with what delay. It says nothing about the code they control having changed. A score can be right about the authority and stale about the code. This pass measured how often that happens and...
A Safe's owner set and threshold only say who can act if nothing else can. A module executes transactions as the Safe without the owners' signatures; a guard can block them. Until today the shared helper every scorer uses (safeownersandthreshold) read...
Question asked of the 8 ecosystems' scorer output, with no new target and no new chain: does the same relation get the same number wherever it appears? Two token-free scans (a same-protocol table across ecosystems, and every address named by two or more...
Phase: cross-ecosystem (Zcash, Solana, Ethereum L1, Base, Plasma). Changes two computations (both provably value-preserving on every published score) and pins the rest as tests. Nothing is re-pushed and no anchor changes.
Found during the registry coverage pass, by asking the one question the cross-exposure field exists for: which tracked targets share a root, across ecosystems, that the oracle still scores as if they did not?
Status: corrected in the scorer (chains/ethereum-l1/scorers.py::scoreethenaminting, commit 042f805) and pushed on-chain 2026-09-20 as a new Ethereum L1 target, index 14 (transaction 0x14b0466ab52a7bf6cab54253cda92c73d52ca1b88957632911d79136b99b7a98, block...
Status: decided and implemented in the scorers on 2026-09-20 (commit 042f805), and pushed on-chain the same day (section 9: six transactions, all status 1, read back with getScore() on all 7 oracles with 0 differences). This file was first written before the...
On 2026-09-19 an independent verification pass found that the Euler V2 eVaultFactory Governor's PAUSEGUARDIANROLE was held by two bare EOAs and that no scorer or note in the repo had ever seen it, because the scorers checked the role NAMES they knew to look...
The cross-ecosystem overlap sweep (scripts/checkcrossecosystemoverlap.py) is the tool that found the Aave guardian committees on five chains and the Morpho committee on four, but its registry only listed the Safes each scorer already knew about. A coverage...
Read-only, mainnet-only pass (no testnet/devnet write, no key, no funding request). Live reads: python3 chains/hyperliquid/scripts/scout20260919section6.py bridge-vs-l1 and ... hip4-deployers (new script, reuses scout20260917run2.py's own HTTP/RPC helpers...
Status: still OPEN. No score change. This is a documented search, not a resolution.
Task: find 2-3 legitimate new Monad MAINNET targets with real, Monad-specific TVL (not a protocol's multi-chain total), verify authority structure on 2+ independent sources per candidate, discard anything that turns out to be a duplicate of already-tracked...
Depth work, not new-ecosystem work: after Monad shipped, the standing directive shifted from adding more chains to strengthening what's already built (see [[feedbackoracledepthoverbreadth]] in this pass's own memory). The most concrete, well-scoped piece of...
19 oracle targets had no hand-written dashboard card (dashboard/index.html rendered them as "Untitled target"). Cards were drafted per chain from scorer docstrings, repo data files and live reads, and every draft was then handed to a SECOND agent whose only...
Triggered by re-reading the hackathon submission text's Hyperliquid narrative while fixing an unrelated staleness issue: target #6 (scorekinetiqstakingmanager() in chains/hyperliquid/scripts/methodologytest.py, added 2026-09-17) is called "kHYPE...
Direct follow-up to the standing directive to improve depth on ecosystems already in scope (see [[feedbackoracledepthoverbreadth]] and [[feedbackecosystemaddition5pointdiscoverygate]] in this pass's own memory) and to the disclosed "worth a systematic sweep...
Requested by a tracked GitHub Projects item bundling two related cross-ecosystem questions. Pure investigation -- no scorer file (chains//scorers.py, scripts/lib/scorers.py) is modified by this finding. A change to any of these formulas needs this project's...
Surfaced from an open follow-up: the 20/20 fallback for an unresolved threshold ranks an unknown above a known 1-of-N. Investigated via a dedicated Explore pass, cross-checked independently against the real source before writing this up. Pure investigation --...
Raised by an open follow-up: should the generic Morpho scorer treat a 1-of-1 Safe as an EOA? (NetNet Credit scores 22 on-chain against 8 by hand.) Pure investigation -- scripts/lib/scorers.py is unmodified by this finding. A change to this scorer's formula...
Scope: find new territory that the competition does not cover for the oracle, after two earlier, broader competitive scans this week already covered SolGov, Hypernative/Blockaid, Gauntlet/Chaos Labs/LlamaRisk, DeFiSafety, ERC-8241, RWA platforms, L2Beat's...
Surfaced while writing the first test coverage scripts/lib/signeroverlap.py has ever had (scripts/lib/tests/testsigneroverlap.py, confirmed via grep that zero tests referenced this module before this pass, despite it being real, load-bearing code:...
Surfaced as a side effect of the 2026-09-18 test-coverage audit (writing scripts/lib/tests/testrobinhoodsimpleandsaferootedscorers.py, testrobinhoodvaultandinfrascorers.py, and testrobinhoodeventreplayscorers.py), not from a dedicated bug hunt. Each was found...
data/finding2026-09-17-cross-ecosystem-aave-guardian-overlap.md (the day this module first went live) explicitly disclosed: "Does not extend this same check to Solana/Hyperliquid/Tempo/Zcash -- their signer formats ... are not directly comparable to EVM...
Closes an open question chains/base-ecosystem/scorers.py's scoreaerodromepoolfactory and data/scoredtargets2026-09-16.md (section 3) both explicitly flagged from the start: Voter at 0x16613524e02ad97eDfeF371bC883F2F5d6C480A5 (confirmed live via...
Closes two open points standing since the 2026-09-16 discovery draft (chains/solana/METHODOLOGY.md section 7): "Identify the controller of the SPL Governance instance authority HF7gCq7B...8y9n" and "Identify program SMPLVC8MxZ5Bf5EfF7PaMiTCxoBAcmkbM2vkrvMK8ho...
Correction, added after this file's own second revision overclaimed: an earlier version of this file said the evidence gathered (Hyperliquid's own CoreWriter docs plus the implementation bytecode containing the CoreWriter address) made it "likely a real, not...
This project's own README (SolGov comparison, point 3) states its differentiator against every existing risk tool -- including its own closest precedent, SolGov -- is checking whether the same key sits behind two protocols tracked as independent: "SolGov's...
scripts/lib/scorers.py scores a Safe-rooted target with saferootedscores (the batch-9 convention): adminKeyScore 65 for threshold >= 3, and multisigScore = min(100, 15 threshold + 5 (owners - threshold)), "rewards both threshold and dispersion". Two older...
This corrects an entry that was already published in this repository, it is not a new finding. Nothing changed on any chain because of it: the correction is to a record file that had drifted away from the state the oracle has actually been serving since 14:12...
Same-day follow-up to the Ventuals vHYPE staking addition (a third HyperEVM-native Hyperliquid target, found by sweeping every HIP-3 dex deployer's own EIP-1967 implementation slot -- a still-dormant dex, vntl, turned out to carry a real, named liquid-staking...
Same-day follow-up to the para StakingVault addition (the second HyperEVM-native Hyperliquid target, closing this project's own explicitly left-open question about HIP-3 dex para's EVM-side proxy: new read helpers and scoreparastakingvault in...
Same-day follow-up to the Solend DAO governance promotion (chains/solana/scorers.py::scoresolenddaogovernance, chains/solana/data/methodologytest2026-09-17-solend-governance.md, data/backtest2026-09-17-solend-governance-emergency-powers.md). Before...
Same-day follow-up to the Kinetiq HIP3StakingManager addition (the first HyperEVM-native target this project scores: new read helpers and scorekinetiqstakingmanager in chains/hyperliquid/scripts/ methodologytest.py, wired into chains/hyperliquid/scorers.py,...
Same-day follow-up to the Drift Protocol addition (third retroactive backtest, data/backtest2026-09-17-drift-protocol-security-council- compromise.md, plus a new live scorer, chains/solana/scorers.py:: scoredriftprotocol, and...
Commit 064a30d (same day, afternoon) revised Robinhood Chain's own L1 rollup authority score from 60 to 57/100 in scripts/lib/scorers.py::scorerollupl1authority() and in README.md, after a cross-Safe signer-overlap finding was wired in. That commit did not...
This is a follow-up to data/correction2026-09-16-uniswap-bridge-alias.md. That correction, and the same day's later "RESOLVED 2026-09-17" addendum in the same file, fixed scripts/lib/scorers.py, README.md, and dashboard/index.html to describe Uniswap v4...
While auditing METHODOLOGY.md's claim that crossExposureScore "defaults to 100 (not applicable)" on every scoringbuild-phase ecosystem outside Robinhood Chain, a direct grep for the field across every chains//scorers.py found it absent entirely -- not...
Building `scripts/validate_all_scorers.py` (a new cross-ecosystem schema check, added the same day after two other real bugs -- see data/correction2026-09-17-missing-crossexposure-field.md -- were only caught by manual audit) and running it against every...
A deliberate, adversarial audit across all 8 ecosystems plus shared infrastructure and the new cross-ecosystem validator, run via a multi-agent workflow: one agent per area tried to actually BREAK the code (live execution with mocked/edge-case inputs, not...
chains/ethereum-l1/scorers.py's scoreaavev3pool() originally shipped (commit 4d74261, same day) with an explicitly disclosed open gap: the ACLManager's EMERGENCYADMINROLE holder was checked and not identified -- GOVERNANCEGUARDIAN-style probing failed, the...
scoreuniswapv3factory, scoreuniswapv4poolmanager, scoreuniswapxreactor, and scoreuniswapv2factoryfeetosetter all resolve owner()/feeToSetter() to 0x2BAD…46CD. Since batch 4, this project has described that address in scorers.py, dashboard/index.html, and...
Six independent reviewers read the shared scoring library, the per-chain scorers, the dashboard script, the Solana and Zcash code and the push scripts, each told to refute the code rather than confirm it. Every finding below was re-checked against the code...
Not a scouting or maintenance run of this pass's own: an independent verification pass re-checked three gaps this ecosystem's own prior notes had explicitly left open, and handed back the missing facts. Implemented here faithfully (not re-derived from...
Result: no divergence. The six dimensions published on the Moderato oracle for USDC.e (0x20C0...8b50) -- adminKey 65, multisig 98, timelock 0, oracleAuthority 100, crossExposure 80, composite 55 -- were each re-derived from Tempo mainnet without running any...
Target: Aave V3 Base PoolAddressesProvider 0xe20fCBdBfFC4Dd138cE8b2E6FBb6CB49777ad64D, index 1 of the 9 targets on the Base Sepolia oracle 0x50840a7667baEa9D05ad4ae3dCeb384724b58720.
A first measurement, from open data only (DefiLlama's /protocols for TVL per chain, matched by protocol name to the labels of the targets each oracle tracks; for Robinhood Chain also hoodscan's public project registry). It is an estimate with a stated method...
Compiled on 21 Sep 2026 by a research reviewer (web search and page reads only, no on-chain reads), then spot-checked by me. Read this as a lead list, not as verified data. I opened three rows (Humanity, AFX, CrediX) and corrected two details; two more...
Phase: maintenance (transverse). Changes no score, no oracle and no push. Adds a guard that refuses an ABI read whose answer has the wrong size, and a tool that audits every ecosystem's scoreall() with it, and records the first result. Measured on the tree at...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 15 going into this run. Same discipline as every prior rotation audit: the target is read live from the testnet oracle (trackedTargets(15)), every authority fact is re-derived from scratch on...
Run by the maintainer with scripts/repushalloracles.sh (two terminals: the eight shared-key oracles, and Robinhood on its own key), read back by the assistant with plain ethcall and getProgramAccounts, no key. Every step recomputed each target live before...
Phase: maintenance (transverse). Nothing about any score changes and nothing is pushed. This adds a pre-push guard to every push script and a tool that audits every ecosystem at once, and records the first result.
Phase: maintenance (Plasma). Changes the scorer of one target, scorefluidliquidityplasma(), from 40 / 100 / 70 / cross 100 (composite 67) to 65 / 55 / 55 / cross 80 (composite 59). Pushed on-chain the same evening (Plasma testnet tx...
Read-only on Ethereum mainnet (chain 1) and on the Sepolia oracle (0xB6F8474ccC71AF477c31c2DF663B3942ddfbf906). Nothing was pushed on-chain by the pipeline run, by design: the push command is prepared below and left for the maintainer to run.
Budget for this run was up to 10 new targets. One was added. That is the honest result, not a target: the one added carries a real authority finding that needed the time, and the second candidate traced (Dolomite) is left explicitly unscored rather than...
> STATUS UPDATE 2026-09-20: the premise of this note (a live custody keyring) no longer holds. See > zenzecstatus2026-09-20.md: the zrchain node it was read from is frozen since 2026-08-10, the product is > winding down, the backing ZEC sits at an address not...
Extends data/testnetoraclepoc2026-09-19.md (ARO1: one score, Zcash L1) to every target chains/zcash/scorers.py scoreall() returns, in ONE on-chain commitment. The format was already built and unit-tested, but never broadcast, by commit 7833263...
Resumes the zenZEC lead data/scoutingcandidates2026-09-18.md deferred: Zenrock's docs/API were re-checked today and are still down (identical HTTP 402/503), but a working alternative primary source (zrchain's own Tendermint RPC, hand-decoded against its own...
Phase: maintenance (real deploy already done 2026-09-19, see ../deploy/README.md). Read-only Tempo mainnet (chain id 4217). No transaction, no key, no write. This is the follow-up to the open point left in ../METHODOLOGY.md section 7.2: "other,...
> CORRECTED 2026-09-20: the Morpho Blue core's crossExposureScore is 80, > not 100. The 9-signer committee shared with Morpho's Ethereum L1, Base and > Robinhood Chain owner Safes, treated below as context that stays out of the > score, is now folded into the...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 9 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(9) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 8 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(8) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 14 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(14) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 13 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(13) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 12 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(12) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 11 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(11) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 10 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(10) read live from the testnet oracle, then every authority fact re-derived from scratch...
First maintenance-phase run for this ecosystem, rotation index 0. trackedTargets(0) read live from the Arbitrum Sepolia oracle 0x50840a7667baEa9D05ad4ae3dCeb384724b58720 on 2 RPCs (sepolia-rollup.arbitrum.io/rpc, arbitrum-sepolia-rpc.publicnode.com):...
Phase: scouting, addendum to the 2026-09-18 batch. Task: find 2-3 NEW legitimate Plasma MAINNET (chain 9745) targets with real Plasma-specific TVL/usage (not global multi-chain TVL), verified on 2+ independent sources/RPCs, and screened for duplicate...
Phase: scoringbuild for a new target family (the ecosystem as a whole is already at deploytestnet, see ../deploy/README.md; this pass does not change that). Read-only, mainnet-only: official HyperCore info API, HyperCore block-explorer endpoint and HyperEVM...
First run of the maintenance phase for this ecosystem (pipeline authority-risk-oracle-multichain-pipeline, scheduled worker). Three parts: (a) audit rotation, (b) new targets, (c) README figures check.
Phase: maintenance (first maintenance run, audit rotation index 0). Evidence folder (pipeline side, outside this repo): authority-risk-oracle-multichain-pipeline/runs/2026-09-19-cron/base-ecosystem/.
Budget ceiling was 50 new protocols. 4 were kept: each has real Arbitrum TVL on DefiLlama (api.llama.fi/protocols, chainTvls.Arbitrum, pulled 2026-09-19), an address from the protocol's own repo or docs, an authority chain traced live to its root, a scorer...
Scouting-phase pass. Budget: up to 50 new targets, never forced -- see `METHODOLOGY.md` section 1 for why Zcash's real target universe (no general-purpose contracts) is narrow to begin with. This pass scanned every DefiLlama-tracked protocol for one that...
Phase scouting -> scoringbuild continued: data/scoutingcandidates2026-09-18.md found Maya Protocol's 2 live Asgard TSS vaults as a new target but deliberately left them unscored (no target type fit them yet). This pass closes that gap: a new target type,...
Closes chains/tempo/data/scoutedtargets2026-09-17-run2.md section 8's open point 4 for Morpho Vault V2 ("Morpho Vault V2 and market oracles need a written target type"). Unlike the same day's other R2 extension (4 controller shapes,...
Closes chains/tempo/data/scoutedtargets2026-09-17-run2.md section 8's open points 1, 2 and 3 in one pass, since all three turned out to share one root cause: rule R2's classify() had no resolution path for 4 real, live controller SHAPES it had never needed...
Closes two open points at once from scoutedtargets2026-09-17-run2.md (target #3, upper-bound composite 54): "decode State.adminauthority" and Methodology gap H1 ("legacy serum-style multisig has no timelock field, needs to be written into METHODOLOGY.md")....
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 7 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(7) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 6 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(6) read live from the testnet oracle, then every authority fact re-derived from scratch...
rotationstate.json -> robinhood-chain -> lastauditedtargetindex was 5 going into this run. Same discipline as every prior rotation audit in this project: trackedTargets(5) read live from the testnet oracle, then every authority fact re-derived from scratch...
Phase: scouting, Plasma mainnet (chain 9745), read-only. First research pass for this ecosystem -- no prior candidate backlog to draw from (chains/plasma-ecosystem/data/ and scripts/ existed as empty scaffolding before this pass; no plasma commit existed in...
Final live-verified output of chains/plasma-ecosystem/scorers.py::scoreall() against https://rpc.plasma.to (chain 9745), after consolidating several parallel research passes into one clean file and independently re-verifying every address and authority-chain...
Closes the 5 "Rules needed before scoringbuild" gaps `scouted_targets_2026-09-17-run2.md` left open, and writes the scorer for every target that file verified live at 3/3 but could not yet score. See `../METHODOLOGY.md` section 4 for the 5 new/extended rules...
Eighth Hyperliquid target overall, and the THIRD native to HyperEVM rather than HyperCore (after Kinetiq's HIP3StakingManager and para StakingVault, both 2026-09-17). Found while chasing a loose end from the para promotion: hyperevmscan.io flagged a "Similar...
Target: Fluid (Instadapp) Liquidity, Plasma mainnet (EVM L1, chain ID 9745, RPC https://rpc.plasma.to, no API key). Companion to chains/plasma-ecosystem/scorers.py's scorefluidliquidityplasma().
Two full dress rehearsals of the deploy pipeline on a local anvil fork of Sepolia already exist and are committed: `deploy_rehearsal_2026-09-17.md` (morning, 4-target scorer) and `deploy_rehearsal_2026-09-17-run2.md` (evening, 9-target scorer, current state)....
Scouted from DefiLlama's live protocol list (https://api.llama.fi/protocols, chains containing "Robinhood Chain", 176 protocols listed), sorted by Robinhood Chain TVL, skipping protocols already tracked directly or through a shared authority chain (Morpho...
Phase: deploytestnet (maintained, not yet advanced). Third rehearsal for Base Ecosystem, run after 6db58ac ("base: trace Aerodrome Voter's authority, close open question") changed chains/base-ecosystem/scorers.py since the previous rehearsal...
scripts/solread.py originally ran main() unconditionally at module scope (no if name == "main": guard), so nothing else in this project could import solread without it immediately crashing on sys.argv. Every decoder also lived inline in main()'s if/elif...
Full tables are in METHODOLOGY.md section 7.3. This file is the short record of what was tested, what held and what changed.
METHODOLOGY.md 4.1's own framing for POOL targets (shielded value pools): "No key. Replaced by setup risk: no SRS (Halo 2) scores higher than an MPC SRS (Groth16)." No formula existed for this framing -- this file is the resolution: the facts, cross-checked...
Different in kind from this project's other three 2026-09-17 promotions (Solana, Hyperliquid, Tempo): those each reused a numeric mapping already written and tested a day earlier. Zcash's `METHODOLOGY.md` had qualitative rules (sections 4.1-4.5) but no 0-100...
Phase: scouting. Read-only Tempo mainnet (chain id 4217), official endpoint https://rpc.tempo.xyz, facts re-read on https://tempo-rpc.publicnode.com. Ethereum reads on https://ethereum-rpc.publicnode.com. No transaction, no key. Two authority checks use...
Promotes `../METHODOLOGY.md` section 4.1's rules (R1-R7) into the standard scorers.py / scoreall() shape every other ecosystem in this project uses: `../scorers.py`. The underlying read-and-score logic was already fully implemented and live-tested in...
Third Solana target, and the first Realms-governed one -- closes the "(untested: no Realms-governed target scored yet)" flag on METHODOLOGY.md 6.1's Realms governance row. Surfaced as a byproduct of...
Fourth Solana target. Surfaced while researching a third retroactive backtest (data/backtest2026-09-17-drift-protocol-security-council- compromise.md): Drift's own 2026-04-01 Security Council compromise is independently, fully on-chain-verifiable (exact...
Promotes `../METHODOLOGY.md` section 6.1's deterministic formulas and the two targets already worked by hand in `methodology_test_2026-09-16.md` into a real, re-runnable scorer: `../scorers.py`. Every number below is re-derived live by scoreall() against...
Item 8 of the after-hackathon roadmap: would this project's methodology have flagged a real, already-happened incident as high risk, using facts anyone can re-verify live today -- not a claim taken on faith from a citation.
Second backtest of the after-hackathon roadmap (see data/backtest2026-09-17-wasabi-protocol.md for the first). Chosen over the other obvious Solana candidate (Mango Markets, October 2022) because it is a governance/authority-risk failure in this project's own...
Third retroactive backtest of the after-hackathon roadmap (see data/backtest2026-09-17-wasabi-protocol.md and data/backtest2026-09-17- solend-governance-emergency-powers.md for the first two). Chosen because it directly ties into this project's own README...
Resolved 2026-09-18: this file's own "Rules needed before scoringbuild" section (5 items) is now closed and all 10 targets below are scored -- see `../METHODOLOGY.md` section 4 for the 5 new rules and `scored_targets_2026-09-18-scoring-build.md` for the...
Seventh Hyperliquid target, and the second one native to HyperEVM rather than HyperCore (after Kinetiq's HIP3StakingManager, same day). Closes this project's own open question about HIP-3 dex para's EVM-side proxy...
Sixth Hyperliquid target, and the first one native to HyperEVM rather than HyperCore. Surfaced as a byproduct of data/finding2026-09-17-hyperliquid- hip3-evm-proxy-authority.md's investigation into whether HIP-3 dexes mkts/km's shared deployer address (which...
Updated 2026-09-18: added an 8th target, Ventuals vHYPE staking (a third HyperEVM-native target, found the same way as the two added the day before) -- see this file's own entry below and chains/hyperliquid/...
The morning's rehearsal (deployrehearsal2026-09-17.md) proved the pipeline against a 4-target scorer (composite 85/78/81/52, crossExposureScore still a flat 100 placeholder). Between that run and this one, an interactive session pushed 17 commits...
The shared throwaway deployer 0xA08a76457b758aFF9702dBf5b870679E1232B715 (a throwaway testnet key kept outside the repository) still has 0 ETH on real Sepolia, confirmed live on 2 independent RPCs at the start of this run:
Scouted from DefiLlama's live protocol list (https://api.llama.fi/protocols, chains containing "Robinhood Chain"), sorted by Robinhood Chain TVL, skipping protocols already tracked directly or through a shared authority chain. One target only. Of the...
Scouted from DefiLlama's live Robinhood Chain protocol list (https://api.llama.fi/protocols, filtered to chains containing "Robinhood Chain"), re-checked against the same list already covered by README.md's Status table before picking a target -- 175...
Phase: deploytestnet. This is the second rehearsal for Base Ecosystem, run after the afternoon session (17 commits, 14:39-18:51) changed chains/base-ecosystem/scorers.py twice since the morning's rehearsal (see...
> CORRECTION 2026-09-19: the GMX V2 RoleStore row below (composite 71) > is superseded. It is now 22: a bare EOA holds TIMELOCKADMIN, and the > controller this pass checked holds no role on the live RoleStore. See >...
Purpose: apply chains/tempo/METHODOLOGY.md end to end to real, significant Tempo mainnet targets, read live, and record every place where the written rules were not enough to produce a number. The fixes are in METHODOLOGY.md (new section 4.1, corrected...
Purpose: apply `../METHODOLOGY.md` end to end to two real, high-usage Solana protocols, derive every score dimension from live Mainnet Beta state, and record where the written grid was not enough. Nothing was pushed on-chain. All reads are plain JSON-RPC...
Scouting pass 2 for the arbitrum-ecosystem chain (Arbitrum One, chain 42161, mainnet read-only). Distinct from Robinhood Chain, already covered by the root of this repo.
Purpose: apply chains/hyperliquid/METHODOLOGY.md section 4 end to end to real, significant HyperCore targets, read live, and record every place where the written rules were not enough to produce a number. The fixes are in METHODOLOGY.md (sections 4.6, 4.7 and...
authority-risk-oracle-multichain-pipeline's automated worker/verifier pair scouted and fully verified these 4 targets on 2026-09-16 (scouting phase), including a corrected retry (attempt 2 fixed two real gaps attempt 1 left open: the Aave delay-getter dead...
Source of candidates: the local candidate backlog prepared on 2026-09-16 (4 entries, each already sourced from 2+ independent sources with ethgetCode confirmed, but explicitly NOT yet verified live -- two of them had unresolved hops). No new web research this...
Prompted by a research question: what in our postmortems (onchain-postmortems, 42 independently-reconstructed exploits) is relevant for authority-risk-oracle? Three cross-cutting patterns came out of that read, cross-checked against exactly what this...
Two changes in this batch, both structural rather than "one more protocol":
Phase: scouting, Base mainnet (chain 8453), read-only. First research pass for this ecosystem -- no prior candidate backlog to draw from. Reuses the exact methodology already used for Robinhood Chain and Ethereum L1 (scripts/lib/scorers.py, web3utils.py):...
Phase: scoringbuild. Scores the exact 5 targets approved 3/3 in the scouting pass (maker-checker action 9), documented in full trace in data/scoutedtargets2026-09-16.md. Every number below is re-derived live by chains/base-ecosystem/scorers.py against...
Four more scores pushed (tx `0x8d2b4a82...`), bringing the total to 32 targets. This batch closes out two of the four candidates left honestly unresolved in batch 4, and deepens the confidence behind the single most consequential finding of the whole project.
Eleven more scores pushed (tx `0x1836bb5e...`), bringing the total to 28 targets. This batch reaches past every dApp already scored to the one authority every one of them ultimately sits on top of: who controls Robinhood Chain itself.
Ten more scores pushed in one updateScores() call (tx `0xb0908404...`), expanding coverage from 7 to 17 targets. This batch found the single worst score on the whole chain so far -- and it belongs to the chain's own flagship product.
Six more real scores pushed in one updateScores() call (tx `0x326a88df...`), closing out every target queued in the first pass. Same standard as before: every number is a live ethcall against Robinhood Chain mainnet, cross-checked at least twice, with any...
First real score pushed through the oracle end-to-end (testnet). Every number below comes from a direct ethcall against Robinhood Chain mainnet, not from Morpho's own app UI or any secondhand description - the UI's "7-day timelock" claim for this vault turned...
A correction is published next to what it corrects; a note does not change after the fact. Not an audit, not investment advice. Back to the dashboard.