Audit and Security Posture

Timeline

The full chronological record. Most recent first.

Independent Security Review, June 2026

In June 2026 a three-person independent security research team reviewed Kerne's core contracts on their own initiative, not under a paid engagement, and sent eight written findings to our disclosure inbox. We assessed every finding against the live, source-verified bytecode on Base mainnet, not just repository source, and sent the team a full per-finding response. The anonymized summary and our response are published in the public contract registry at audits/INDEPENDENT_REVIEW_2026-06.md.

This was a researcher-initiated review, not a completed third-party firm audit, and we describe it as exactly that. The external firm engagement (Hexens, selected, not yet started) is tracked separately under External Audit Posture below.

Result: no finding is exploitable on the live deployment. Four describe real bug classes Kerne had already identified and fixed in its May to June internal audit cycle, confirmed present in the deployed verified source; the submitted proofs were written against a pre-fix snapshot and do not reproduce on chain. Three do not match the deployed code at all, meaning the quoted vulnerable code is not what is live. One is a genuine, currently-inert pre-launch accounting item that independently confirms a finding from our own May 8 internal audit: in the vault outflow path, on-chain tracked assets are decremented before the matching off-chain or bridged bucket is credited, so a deposit inside that reconciliation window could over-mint. It is inert because the vault is empty and the deposit interface is not open, it is now fixed in source with an added on-chain deposit gate, and it ships at the next vault redeployment. Each ruling was checked against the live Foundry invariant suite (five invariants, 512 runs by 65,536 calls, zero reverts) and on-chain reads.

An independent team reaching four of the same conclusions we had already reached, on its own, is the signal worth having: evidence the internal audit cycle found the real issues. We would rather show that with the findings and our response attached than assert it. If the researchers consent to be named, this section and the published summary will be updated to credit them.

Comprehensive Multi-Surface Audit, May 11, 2026

Eight agents ran concurrently across the full protocol surface: all 80 Solidity contracts, the Python trading bot, the Next.js frontend (kerne.fi and app.kerne.fi), the VPS infrastructure, and the Postgres ledger backing the Opal fragment system. This audit followed the May 8 adversarial pass and targeted the operational and infrastructure layers that the Solidity-focused pass did not cover. Full report at docs/security/COMPREHENSIVE_AUDIT_2026-05-11.md.

Result: 22 new Critical findings surfaced and triaged. Top issues included Opal cron endpoint lacking authentication (any caller could trigger hourly fragment accrual), KerneVault removeLiquidity missing the whenNotPaused modifier (race condition allowing LP drain against a Safe pause), insurance fund lacking a firewall preventing protocol-side misuse, and the Postgres instance missing verify-full TLS on the connection string. Additional High, Medium, and Low findings across the Python bot and frontend surfaces.

Remediation status. The YieldAMM pause bypass (removeLiquidity whenNotPaused) was patched pre-deploy (contract never deployed). The PSM unit-mismatch, fee-routing drift, and exposure floor-reset were each fixed in source (riding the PSM v3 redeploy). The Opal cron authentication gap was addressed 2026-06-04. Remaining items queued per triage order. Live per-finding status at /security/findings-tracker.

Adversarial Audit, May 8, 2026

An internal red team ran a 10-auditor parallel adversarial review of every Solidity file insrc/, applying a 20 to 30 vector adversarial checklist per cluster (reentrancy, oracle manipulation, share inflation, flash-loan price manipulation, MEV, replay, ERC-4626 invariants, access control, cross-chain bridge attacks, role boundary violations). The full report is preserved at docs/security/ADVERSARIAL_AUDIT_2026-05-08.md in our internal security repository. Live status for every finding is published at /security/findings-tracker.

Result: 201 findings surfaced, classified, and triaged across 80 contracts (36 Critical, 51 High, 51 Medium, 37 Low, 26 Info). The audit identified the root cause of the live degraded WETH vault (KerneVault bucket-transition asymmetry:sweepToExchangeand three sibling functions decrement_trackedOnChainAssetsbut do not atomically incrementoffChainAssets, collapsingtotalAssets()between strategist updates and triggering the ERC-4626 1-wei-inflation case on the next deposit). It also catalogued cross-chain bridge triple-mint primitives, OFT V1/V2 single-key mint backdoors, withdrawal-queue stale-asset payment, KerneYieldStripper PT/YT pool insolvency, KerneVerificationNode threshold defaults to 1, KernePrime accounting-only ledger, KernePriceOracle slot0 fallback, six contracts with single-key recoverTokens or emergencyWithdraw drains, init front-run on factory clones, attacker-supplied calldata patterns on aggregator harvest paths, DarkPool RFQ permitting self-swap, ZINRouter pocketing surplus over minAmountOut, InsuranceFund socializeLoss with no cap or cooldown, Airdrop emergencyWithdraw draining locked balances, esKERNE vesting math broken on second emission, and the RWA adapter convertToShares round-trip ignoring receipt.

Remediation cadence. The audit's§1.18KerneStaking lock-bypass was patched in source the same day. Seven regression tests intest/unit/KerneStaking.t.soldemonstrate the exploit is now blocked (forge test reports 25 of 25 staking tests passing includingtest_stake_cannotShortenExistingLock_attackBlocked). The remaining findings are queued per the audit's§3triage order: Phase 1 live-exploitability items first (vault bucket atomicity, KernePrime ledger wiring, IntentExecutor V1 SOLVER_ROLE, OFT mint backdoor, oracle slot0 fallback), then Phase 2 launch-blocking (bridge replay, verification node threshold, yield system insolvency, attestation forgery, adapter clone init, RWA depeg surface), then Phase 3 capital-protective hardening, then Phase 4 code hygiene.

We commit to keeping the open finding count public until it converges to zero, and to engaging a professional external auditing firm before any TVL scaling beyond the Genesis Window phase. Rather than rely on a periodic manual update, the findings tracker at /security/findings-tracker is the live per-finding status surface and moves with each remediation commit; the remediation-posture summary at the top of this page is derived from the same data.

Internal Security Assessment, April 9, 2026

Slither v0.11.3 (Trail of Bits) was run against the entire codebase, producing 692 total findings across all severity levels. Foundry test suite reports 949 of 951 tests passing. Of the 7 high-severity findings, 5 affect contracts that are not deployed on mainnet (KerneDarkPool, KerneMigrationRouter, KerneZINPool) and are flagged for pre-deployment review only. The two high-severity findings on deployed contracts (KerneVault, KerneFlashArbBot) are protected by role-based access control and were assessed as low actual risk after review.

No critical vulnerabilities were identified in deployed production contracts. This represents automated tooling output and internal analysis. It does not constitute a professional third-party security audit, and we are committed to engaging a professional auditing firm before scaling TVL beyond the genesis phase.

Security Sprint, April 17, 2026

Triggered by an internal incident in which 787 USDC was sent to a homoglyph vanity address (the visually similar but distinct address that had been hardcoded as the Hyperliquid bridge in the bot). The sprint produced 13 commits and eradicated five classes of bug across the bot, the Solidity surface, and the deployment scripts.

• Address-literal drift. The HL bridge fix, plus wstETH and cbETH homoglyphs in solver Python, plus a dead-EOA Aerodrome router constant, plus a wrong Uniswap router constant.
• Unchecked send paths. Receipt-status guards added on six call sites that had been logging success on tx hash return without verifying on-chain success.
• Server-supplied safeTxHash trust. Client-side recompute before Trezor signing; the RFQ server zero-byte signature fallback returns HTTP 503 instead of a fake signature.
• Over-permissive approvals. capital_router infinite approvals replaced with exact-amount approvals to an allowlisted Li.Fi Diamond; Hyperliquid withdrawals gated by an env-driven destination allowlist.
• Contract-level hardening. skUSD ERC-4626 inflation-attack mitigation via _decimalsOffset = 6, LayerZeroRelay refund routed to msg.sender for AA/EIP-7702 safety, IntentExecutor V1 and V2 typed revert if post-swap balance is insufficient.

The 787 USDC is unrecovered and treated as paid tuition. Every other instance of the same bug class was eliminated in the same sprint, plus a pre-commit secret scanner (gitleaks with two Kerne-specific rules) was added to prevent regression.

Frontend Security Audit, April 18, 2026

White-box static analysis plus live HTTP probe of both kerne.fi and app.kerne.fi. Verdict: 17 PASS, 5 WARN, 0 FAIL.

All 17 PASS items: no .env or .git/config exposed in production, HSTS plus subdomains delivered, X-Frame-Options DENY, X-Content-Type-Options nosniff, tight Permissions-Policy, strict Referrer-Policy, full CSP, no eval or innerHTML in the terminal app, only one dangerouslySetInnerHTML site-wide (sanitized, fed by static data), no open-redirect pattern, no client-side secret env exposure, contract addresses match the canonical registry exactly, OFAC sanctions coverage complete, geo-block enforced server-side, JSON.parse of untrusted data try-catch guarded, localStorage holds no sensitive data.

The 5 WARN items are documented accepted trade-offs: Next.js App Router CSP requires unsafe-inline and unsafe-eval for hydration, the marketing sanitizer is regex-based but only fed static repo data, /api/apy and /api/apy/history use Access-Control-Allow-Origin star for cross-site read, /api/stats falls back to public Base RPC if the env var is unset, and Ukraine is blocked at the country level as a Crimea proxy because Vercel does not expose region-level headers.

Orphan Role Revocation, April 17 to 18, 2026

The original deployer EOA at 0x57D400cED462a01Ed51a5De038F204Df49690A99was delegated to a drainer contract under EIP-7702 and could no longer sign transactions, but it still held six operational roles across four contracts. All six were revoked through the 2-of-3 Safe at Safe nonces 6 through 11.

• KerneVault PAUSER_ROLE (nonce 6)
• KerneToken PAUSER_ROLE (nonce 7)
• KerneInsuranceFund MANAGER_ROLE (nonce 8)
• KerneFlashArbBot EXECUTOR_ROLE (nonce 9)
• KerneFlashArbBot SENTINEL_ROLE (nonce 10)
• KerneVault STRATEGIST_ROLE (nonce 11; flagged post-sprint and revoked April 18)

Verified on chain at block 44,883,093. The drainer EOA now holds zero AccessControl roles across every Kerne contract.

Source Verification Status

14 of 16 deployed Kerne contracts have their source verified on both BaseScan and Sourcify. The remaining two are tracked with documented reasons and resolution paths. Statuses re-checked 2026-06-11 against both explorers.

Verification proves the deployed bytecode matches a published source file. It does not by itself tell you whether that deployed source is the newest source in the repository. The three places where live bytecode lags current source are disclosed, with mitigations and operating rules, at /security/deployed-vs-source.

External Audit Posture

Kerne has selected Hexens for its first external smart-contract audit. As of June 24, 2026 the engagement has not yet started and no report has been published; this page updates when the engagement begins and when the report lands. The auditor-facing scope document is public: Tier 1 covers the four deployed risk-bearing contracts (kUSD, skUSD, KUSDPSM, KerneVault, roughly 960 normalized SLOC), Tier 2 the full deployed verified surface. See audits/SCOPE.md in the public contract registry. The internal adversarial audit above (201 findings disclosed, full triage published) is the current authoritative finding set, and the operating commitment is to keep the open finding count public until it converges to zero. The Hexens report will be published in the public contract registry once it lands.

In the interim, the bug bounty program is the primary external verification channel.

Past Incidents