Notes / Audits and snapshots

Ethereum L1 -- deploy_testnet fork rehearsal, run 2 (2026-09-17 evening)

Audits and snapshots2026-09-17Chain: EthereumLinked: Uniswap V3 Factory (Arbitrum One), Uniswap V3 Factory, Aave V3 Ethereum Pool, MakerDAO / Sky governance (MCD_PAUSE), Ethena EthenaMinting (retired minter), USDtb (Ethena Labs), USDtb PSM (peg-stability module), Ethena LayerZero OFTAdapters (0x5d3a…ef34)

Source: chains/ethereum-l1/data/deploy_rehearsal_2026-09-17-run2.md in the repository, rendered here without changes. Source file

Why a second rehearsal today#

The morning's rehearsal (deploy_rehearsal_2026-09-17.md) proved the pipeline against a 4-target scorer (composite 85/78/81/52, crossExposureScore still a flat 100 placeholder). Between that run and this one, an interactive session pushed 17 commits (14:39-18:51) that changed chains/ethereum-l1/scorers.py materially:

• Promoted USDtb, USDtb PSM and the 3 Ethena LayerZero OFTAdapters (USDe/sUSDe/ENA) from backlog to real scorers -- 4 -> 9 tracked targets.
• Fixed crossExposureScore from a hardcoded 100 to a real computed value (5 of the 9 targets share Ethena's root Safe and now read 20, not 100).
• Fixed a live Safe-threshold read that used to be discarded in favour of a hardcoded multisigScore=100.

None of that touched src/AuthorityRiskOracle.sol, script/Deploy.s.sol, or update_scores_ethereum_l1.py's encoding logic, but since the scorer output itself changed since the last fork run, this run re-verifies the full pipeline end to end against the CURRENT scorer state rather than assuming the morning's pass still applies.

Starting fact: deployer balance still 0 ETH on real Sepolia#

Re-checked live on 2 independent RPCs at the start of this run (see claims_attempt1.txt ids B01/B02):

No faucet was used (agent policy), no funds were requested. Per the run brief, since the scorer changed materially since the last fork rehearsal, the pipeline was rehearsed again on a fresh anvil fork rather than merely re-stating the morning's result.

What this rehearsal proves#

Script: 0 (updated this run: its getScore() read-back loop was extended from the original 4 hardcoded targets to all 9 the scorer now tracks -- it had gone stale after this afternoon's promotions).

getScore() read back vs. the live dry-run scores (all 9 targets)#

crossExposureScore read back on-chain confirms the real computed value, not the old flat-100 placeholder: Uniswap, Aave, Maker and USDtb (the ERC20 token contract itself) read 100; Ethena EthenaMinting, USDtb PSM and the 3 OFTAdapters (5 of the 9 targets, the ones the scorer resolves as sharing the root Ethena Safe) all read 20, matching scorers.py's live cross-exposure computation exactly. Note USDtb PSM reads 20 while the USDtb token contract itself reads 100 -- the scorer treats the PSM and the token as different authority surfaces, not a documentation slip.

What this does and does not close#

• Closes: re-confirms the deploy -> role check -> live score push -> on-chain read-back pipeline is still correct end to end after this afternoon's scorer changes (9 targets, real crossExposureScore), not just for the original 4-target state.
• Does not close: the real Sepolia deployment. Still blocked on funding -- 0xA08a76457b758aFF9702dBf5b870679E1232B715 remains at 0 ETH on real Sepolia (confirmed live again this run, 2 independent RPCs). No faucet use, no funds moved, no real-Sepolia or mainnet transaction sent this run.
• All contract interaction above happened on an ephemeral local anvil fork using anvil's own public, well-known default dev private key (never the real throwaway key). Anvil was stopped at the end of the run; the fork oracle address above will not resolve on any real network.

Recommended transition#

deploy_testnet -> deploy_testnet (maintained, not advanced) -- the deployer balance is still 0 ETH on real Sepolia, so no real deploy happened. The pipeline itself is re-proven correct against the current scorer state.

Not an audit, not investment advice. All notes · Back to the dashboard.