Notes / Audits and snapshots

Ethereum L1 -- deploy_testnet fork rehearsal (2026-09-17)

Audits and snapshots2026-09-17Chain: EthereumLinked: Uniswap V3 Factory (Arbitrum One), Uniswap V3 Factory, Aave V3 Ethereum Pool, MakerDAO / Sky governance (MCD_PAUSE), Ethena EthenaMinting (retired minter)

Source: chains/ethereum-l1/data/deploy_rehearsal_2026-09-17.md in the repository, rendered here without changes. Source file

Why a rehearsal instead of a real Sepolia deploy#

The shared throwaway deployer 0xA08a76457b758aFF9702dBf5b870679E1232B715 (a throwaway testnet key kept outside the repository) still has 0 ETH on real Sepolia, confirmed live on 2 independent RPCs at the start of this run:

(A third RPC, https://sepolia.drpc.org, was tried per the run brief and returned an unrelated error -- "chain is not available on free plan" -- not a balance reading, so it was not counted as a confirmation either way.)

This matches the run's known starting fact: the address is still to be funded via a faucet by the maintainer, so no transaction was attempted on real Sepolia this run. Per the phase brief, the alternative is a full, reproducible dress rehearsal against a local anvil fork of Sepolia -- proving the entire pipeline works end to end so the real deploy is a known-good, mechanical step once the address is funded.

What the rehearsal proves#

Script: rehearsal_fork.sh (re-runnable, bash chains/ethereum-l1/deploy/rehearsal_fork.sh). One run, 2026-09-17:

getScore() read back vs. the calculated scores#

Read live from the fork oracle after the push, compared to data/scored_targets_2026-09-16-ethereum-l1.md (the committed source of truth for these 4 targets):

The sub-scores (adminKey/multisig/timelock) read back from getScore() also match the per-target breakdown in data/scored_targets_2026-09-16-ethereum-l1.md exactly (e.g. Uniswap 80/100/75, Aave 78/100/55, Maker 75/100/70, Ethena 55/100/0) -- the scores were re-derived live from real Ethereum L1 mainnet during this run (not replayed from a file), and matched the committed values because mainnet authority state for these 4 targets has not changed since 2026-09-16.

crossExposureScore reads back as 100 (the placeholder default) for all 4 targets, consistent with the known open thread documented in chains/ethereum-l1/deploy/README.md and update_scores_ethereum_l1.py -- the cross-ecosystem signer-overlap pass has not been built yet, so this is not a new finding.

What this does and does not close#

• Closes: the deploy -> role check -> live score push -> on-chain read-back pipeline is proven correct end to end for Ethereum L1, mechanically reproducible, and matches the committed scoring exactly. Nothing about the real deploy path (script/Deploy.s.sol, update_scores_ethereum_l1.py non-dry-run branch) needed to change to make this pass.
• Does not close: the real Sepolia deployment itself. That still requires funding 0xA08a76457b758aFF9702dBf5b870679E1232B715 on Sepolia -- no faucet was used, no funds were moved, no mainnet or real-Sepolia transaction was sent this run.
• All contract interaction above happened on an ephemeral local anvil fork, using anvil's own public, well-known default dev private key (never the real throwaway key, never printed here in full). Anvil was stopped at the end of the run; the fork oracle address above will not resolve on any real network.

Recommended transition#

deploy_testnet -> deploy_testnet (maintained, not advanced), justified by the deployer balance still being 0 ETH on real Sepolia. The pipeline itself is rehearsed and ready; only funding is blocking the real push.

Not an audit, not investment advice. All notes · Back to the dashboard.