No firm has audited these contracts. There is no “Audited by …” badge anywhere on this site, no report link, and no bounty program to link to. If that changes, the firm, date, scope, report URL and unresolved findings will be added here and on the Verify page before any badge appears.
We looked, with tools. It is still not an audit.
What was run
Slither 0.11.6 over the product contracts (107 findings, 17 High/Medium before triage), the 138 Hardhat tests, the 20-test Foundry fuzz/invariant suite, and a reentrancy proof-of-concept. Halmos did not run on this Foundry toolchain; no symbolic result is claimed. Full self-review →
What it found
Two conditional High findings: (SR-01) a token with a transfer callback can re-enter createLock/editLock and over-credit a lock, at the expense of another lock of the same token; and (SR-04) a revocable lock that is partially claimed, edited down and then revoked could refund more than the vault held for it. SR-01 is fixed in v2; SR-04 is fixed in v4. One Low: the v1 adapter accepts ETH it cannot return (fixed in v2). The rest were informational or false positives, each with a reason in the report.
This is not an independent review. The code was reviewed by the same person who wrote it, with public tools and a reproducible command list. Treat it as evidence of method, not as an audit opinion.
A v4 fork is deployed on Robinhood Chain, BNB Chain, Base and Polygon at the same addresses. New locks and new launches go through v4; v1, v2 and v3 remain live for the locks created under them, and the site reads all four (the warning above still applies to existing v1 locks). v4 is v3 behind an ERC1967 proxy, with a 2-of-3 multisig and a 48-hour delayed admin; the upgrade path preserves existing locks (covered by the v4 Hardhat tests and the local upgrade E2E). The addresses, deployment records and migration notes are in v3/README.md.
No operator over a lock
No key can move a lock's tokens or change its schedule: no pause, no fee switch, no rescue. The creator of a lock has one power: revoke its own lock, and only if the lock declared itself revocable at creation.
- LockVault v1 / v2 / v3: no admin key, no proxy. Immutable.
- LockVault v4: ERC1967 proxy. A 2-of-3 multisig can replace the implementation after 48h; it cannot move a lock's balance or date directly.
- PositionLock: no admin key, no proxy.
- TokenFactory: fixed supply; no mint, pause or owner after deployment.
- MultiSender: no storage between calls.
- Airdrop / Presale / Launcher: product-specific creator powers, no upgrade key.
Admin is a different product
Bonds are not ownerless. They have a 2-of-3 Safe, a Timelock and a NAV keeper. Reading a bond as if it were a lock is a user-interface mistake; this page keeps the boundary explicit.
- Safe: 0x5E8C4c241a29ff7E60c648f378A4AA70053Ee92e · 2-of-3.
- Timelock delay at handoff: 172,800 seconds (48h).
- Changing that number is a governance action through the Safe, not a promise made by this page.
- Locks: no operator over a lock; v4 has a 2-of-3 upgrade key + 48h delay. Bonds: admin, keeper and oracle risk.
The parts we can put a number on.
Coverage: v1 product contracts 99.58% statements · 99.82% lines · 100% functions; branch coverage 73.38% and is reported separately rather than rounded up. Each fork is reported on its own: v2 is v1 plus a reentrancy guard and an ETH refund; v3 is v2 plus the revoke clamp. v4 is v3 behind an ERC1967 proxy, plus the multisig and delayed-admin path — covered by 9 Hardhat upgrade tests and a local upgrade E2E that preserves existing locks. The four deterministic-address tests run in the normal suite; the coverage build uses viaIR instrumentation and excludes them.
Locks
Credited amount equals the balance delta (fee-on-transfer); vesting is monotone and bounded; claims pay only vested-minus-claimed to the beneficiary; revoke splits the amount exactly; a shrink edit cannot go below claimed; staircases never outrun the continuous curve.
Positions
One escrow per position; release is time-gated and pays only the stored beneficiary; reclaim is creator-only, revocable-only, and impossible after release; pushed-in NFTs without a lock record are refused.
Tools
Factory fixed supply, multisender batch atomicity, Merkle double-claim prevention and sweep deadlines, presale cap/refund accounting, and router liquidity shares.
Not covered by a proof
Rebasing tokens are not modelled; blacklists can block a claim; tokens with transfer hooks can re-enter the accounting (SR-01 in the self-review); no formal verification has been performed. The invariant suite is evidence, not a proof.
| Contract | Address (Robinhood Chain) | Owner |
|---|---|---|
| LockVault | 0xe410d0a21C1376992874a9bEEeE0d623A50D4a34 | none |
| PositionLock | 0xfC9A43c90e0E0d548D95cEf3C77fce802806CbA9 | none |
| PinkLockAdapter | 0x16e02A106fE6E978fB98F76756B3a06b4995a7A6 | none |
| OakenLauncher | 0x1d7561fC331594820382E8dd64582645EbafD873 | none |
| TokenFactory | 0xc0A3AD1428EeB70cAF88bb89c3B17D0191E1Bd34 | none |
| MultiSender | 0x1f380ef5eFF9113314Ee175dCE4F226DFd75A50C | none |
| OakenAirdrop | 0x17E9910cDC37BdA5531414012aeA5b0862C22066 | none |
| PresaleFactory | 0xAC070cf2ed45aEcb9f5299d4C670fFfCE6387724 | none |
| LockVault · v4 (proxy) | 0x5221A10B772D5e2d51B60E8e3dd5DA9338b04ab0 | 2-of-3 + 48h |
| PinkLockAdapter · v4 (proxy) | 0xA2898528eb4Aea0bDAf47202A5BA3bA4f58F831c | 2-of-3 + 48h |
| OakenLauncher · v4 | 0x9600f22d2f629904B44c7dA2d958f5AfB3a1e5Ff | none |
| Upgrade multisig · v4 | 0xCb847B572352156be50c90FBc752cfd032114666 | 2-of-3 owners |
| Delayed proxy admin · v4 | 0xDB998916A34b87c7DA337d922bC1219970FA0319 | 48h delay |
| LockVault · v3 | 0xd4064d8E73AAB53D7d9efd8A6E8DBE2003d1de4B | none |
| PinkLockAdapter · v3 | 0x6022DA059FAa0673E3058ADECEef375c2Abfb4A1 | none |
| OakenLauncher · v3 | 0x4488C369116D0C6FEA84162313c3840976D5A9a5 | none |
| LockVault · v2 | 0xbC511F31967D9EBF775d203661a2BEfF6AA42615 | none |
| PinkLockAdapter · v2 | 0xDBE1f3dc1d6E6759355E1B164231748f0589cb41 | none |
| OakenLauncher · v2 | 0x0d7cCEA7BabC5e3b4849267740D8fBBe6C4FDa58 | none |
For a vulnerability report, include the chain/address, function, a minimal reproduction and whether funds are at risk. Do not post exploit details publicly before a fix is live. There is no paid bounty program at this time; do not assume a payout or scope until an official program page exists.