Audit and Security Posture

Timeline

The full chronological record. Most recent first.

Independent Security Review, June 2026

In June 2026 a three-person independent security research team reviewed Kerne's core contracts on their own initiative, not under a paid engagement, and sent eight written findings to our disclosure inbox. We assessed every finding against the live, source-verified bytecode on Base mainnet, not just repository source, and sent the team a full per-finding response. The anonymized summary and our response are published in the public contract registry at audits/INDEPENDENT_REVIEW_2026-06.md.

This was a researcher-initiated review, not a completed third-party firm audit, and we describe it as exactly that. The external firm engagement (Hexens, fieldwork from July 13, 2026, final report published July 31, 2026) is tracked separately under External Audit Posture below.

Result: no finding is exploitable on the live deployment. Four describe real bug classes Kerne had already identified and fixed in its May to June internal audit cycle, confirmed present in the deployed verified source; the submitted proofs were written against a pre-fix snapshot and do not reproduce on chain. Three do not match the deployed code at all, meaning the quoted vulnerable code is not what is live. One is a genuine, currently-inert pre-launch accounting item that independently confirms a finding from our own May 8 internal audit: in the vault outflow path, on-chain tracked assets are decremented before the matching off-chain or bridged bucket is credited, so a deposit inside that reconciliation window could over-mint. It is inert because the vault is empty: totalSupply is 0, its WETH balance is 0, and no third party has ever held a share. Being precise about the second half of that sentence, because we got it wrong here until July 25, 2026: the deposit interface was closed in the app, but the on-chain deposit gate we wrote for this was never deployed, so the live contract accepted deposits from any address. That is closed as of July 30, 2026: the Safe called setWhitelistEnabled(true) in transaction 0x0be06e9a4a4ce3545fdea6af8e83ed1663e8d0ce35cb28a211836ab83a57579e, so maxDeposit() now returns 0 for every address while withdrawals stay open. The deposit gate itself still ships at the next vault redeployment. The full deployed-versus-audited map is at /security/deployed-vs-source. Each ruling was checked against the live Foundry invariant suite (five invariants, 512 runs by 65,536 calls, zero reverts) and on-chain reads.

An independent team reaching four of the same conclusions we had already reached, on its own, is the signal worth having: evidence the internal audit cycle found the real issues. We would rather show that with the findings and our response attached than assert it. If the researchers consent to be named, this section and the published summary will be updated to credit them.

Comprehensive Multi-Surface Audit, May 11, 2026

Eight agents ran concurrently across the full protocol surface: all 80 Solidity contracts, the Python trading bot, the Next.js frontend (kerne.fi and app.kerne.fi), the VPS infrastructure, and the Postgres ledger backing the Opal fragment system. This audit followed the May 8 adversarial pass and targeted the operational and infrastructure layers that the Solidity-focused pass did not cover. The full report is preserved at docs/security/COMPREHENSIVE_AUDIT_2026-05-11.md in our internal security repository and is not published on the open web, because it names live infrastructure and gives working exploitation detail for findings that are not yet remediated. It goes to counterparties on request under NDA.

Result: 22 new Critical findings surfaced and triaged. Top issues included Opal cron endpoint lacking authentication (any caller could trigger hourly fragment accrual), KerneVault removeLiquidity missing the whenNotPaused modifier (race condition allowing LP drain against a Safe pause), insurance fund lacking a firewall preventing protocol-side misuse, and the Postgres instance missing verify-full TLS on the connection string. Additional High, Medium, and Low findings across the Python bot and frontend surfaces.

Remediation status. The YieldAMM pause bypass (removeLiquidity whenNotPaused) was patched pre-deploy (contract never deployed). The PSM unit-mismatch, fee-routing drift, and exposure floor-reset were each fixed in source (riding the PSM v3 redeploy). The Opal cron authentication gap was addressed 2026-06-04. Remaining items queued per triage order. Live per-finding status at /security/findings-tracker.

Adversarial Audit, May 8, 2026

An internal red team ran a 10-auditor parallel adversarial review of every Solidity file insrc/, applying a 20 to 30 vector adversarial checklist per cluster (reentrancy, oracle manipulation, share inflation, flash-loan price manipulation, MEV, replay, ERC-4626 invariants, access control, cross-chain bridge attacks, role boundary violations). The full report is preserved at docs/security/ADVERSARIAL_AUDIT_2026-05-08.md in our internal security repository and is not published on the open web, for the reason given above. Live status for every NAMED finding, open items included, is published at /security/findings-tracker; that tracker carries the named subset of this corpus rather than all 201 rows.

Result: 201 findings surfaced, classified, and triaged across 80 contracts (36 Critical, 51 High, 51 Medium, 37 Low, 26 Info). The audit identified the root cause of the live degraded WETH vault (KerneVault bucket-transition asymmetry:sweepToExchangeand three sibling functions decrement_trackedOnChainAssetsbut do not atomically incrementoffChainAssets, collapsingtotalAssets()between strategist updates and triggering the ERC-4626 1-wei-inflation case on the next deposit). It also catalogued cross-chain bridge triple-mint primitives, OFT V1/V2 single-key mint backdoors, withdrawal-queue stale-asset payment, KerneYieldStripper PT/YT pool insolvency, KerneVerificationNode threshold defaults to 1, KernePrime accounting-only ledger, KernePriceOracle slot0 fallback, six contracts with single-key recoverTokens or emergencyWithdraw drains, init front-run on factory clones, attacker-supplied calldata patterns on aggregator harvest paths, DarkPool RFQ permitting self-swap, ZINRouter pocketing surplus over minAmountOut, InsuranceFund socializeLoss with no cap or cooldown, Airdrop emergencyWithdraw draining locked balances, esKERNE vesting math broken on second emission, and the RWA adapter convertToShares round-trip ignoring receipt.

Remediation cadence. The audit's§1.18KerneStaking lock-bypass was patched in source the same day. Seven regression tests intest/unit/KerneStaking.t.soldemonstrate the exploit is now blocked (forge test reports 25 of 25 staking tests passing includingtest_stake_cannotShortenExistingLock_attackBlocked). The remaining findings are queued per the audit's§3triage order: Phase 1 live-exploitability items first (vault bucket atomicity, KernePrime ledger wiring, IntentExecutor V1 SOLVER_ROLE, OFT mint backdoor, oracle slot0 fallback), then Phase 2 launch-blocking (bridge replay, verification node threshold, yield system insolvency, attestation forgery, adapter clone init, RWA depeg surface), then Phase 3 capital-protective hardening, then Phase 4 code hygiene.

We commit to keeping the open finding count public until it converges to zero, and to engaging a professional external auditing firm before any TVL scaling beyond the Genesis Window phase. Rather than rely on a periodic manual update, the findings tracker at /security/findings-tracker is the live per-finding status surface and moves with each remediation commit; the remediation-posture summary at the top of this page is derived from the same data.

Internal Security Assessment, April 9, 2026

Slither v0.11.3 (Trail of Bits) was run against the entire codebase, producing 692 total findings across all severity levels. Foundry test suite reports 949 of 951 tests passing. Of the 7 high-severity findings, 5 affect contracts that are not deployed on mainnet (KerneDarkPool, KerneMigrationRouter, KerneZINPool) and are flagged for pre-deployment review only. The two high-severity findings on deployed contracts (KerneVault, KerneFlashArbBot) are protected by role-based access control and were assessed as low actual risk after review.

No critical vulnerabilities were identified in deployed production contracts. This represents automated tooling output and internal analysis. It does not constitute a professional third-party security audit, and we are committed to engaging a professional auditing firm before scaling TVL beyond the genesis phase.

Security Sprint, April 17, 2026

Triggered by an internal incident in which 787 USDC was sent to a homoglyph vanity address (the visually similar but distinct address that had been hardcoded as the Hyperliquid bridge in the bot). The sprint produced 13 commits and eradicated five classes of bug across the bot, the Solidity surface, and the deployment scripts.

• Address-literal drift. The HL bridge fix, plus wstETH and cbETH homoglyphs in solver Python, plus a dead-EOA Aerodrome router constant, plus a wrong Uniswap router constant.
• Unchecked send paths. Receipt-status guards added on six call sites that had been logging success on tx hash return without verifying on-chain success.
• Server-supplied safeTxHash trust. Client-side recompute before Trezor signing; the RFQ server zero-byte signature fallback returns HTTP 503 instead of a fake signature.
• Over-permissive approvals. capital_router infinite approvals replaced with exact-amount approvals to an allowlisted Li.Fi Diamond; Hyperliquid withdrawals gated by an env-driven destination allowlist.
• Contract-level hardening. skUSD ERC-4626 inflation-attack mitigation via _decimalsOffset = 6, LayerZeroRelay refund routed to msg.sender for AA/EIP-7702 safety, IntentExecutor V1 and V2 typed revert if post-swap balance is insufficient.

The 787 USDC is unrecovered and treated as paid tuition. Every other instance of the same bug class was eliminated in the same sprint, plus a pre-commit secret scanner (gitleaks with two Kerne-specific rules) was added to prevent regression.

Frontend Security Audit, April 18, 2026

White-box static analysis plus live HTTP probe of both kerne.fi and app.kerne.fi. Verdict: 17 PASS, 5 WARN, 0 FAIL.

All 17 PASS items: no .env or .git/config exposed in production, HSTS plus subdomains delivered, X-Frame-Options DENY, X-Content-Type-Options nosniff, tight Permissions-Policy, strict Referrer-Policy, full CSP, no eval or innerHTML in the terminal app, only one dangerouslySetInnerHTML site-wide (sanitized, fed by static data), no open-redirect pattern, no client-side secret env exposure, contract addresses match the canonical registry exactly, OFAC sanctions coverage complete, geo-block enforced server-side, JSON.parse of untrusted data try-catch guarded, localStorage holds no sensitive data.

The 5 WARN items are documented accepted trade-offs: Next.js App Router CSP requires unsafe-inline and unsafe-eval for hydration, the marketing sanitizer is regex-based but only fed static repo data, /api/apy and /api/apy/history use Access-Control-Allow-Origin star for cross-site read, /api/stats falls back to public Base RPC if the env var is unset, and Ukraine is blocked at the country level as a Crimea proxy because Vercel does not expose region-level headers.

Orphan Role Revocation, April 17 to 18, 2026

The original deployer EOA at 0x57D400cED462a01Ed51a5De038F204Df49690A99was delegated to a drainer contract under EIP-7702 and could no longer sign transactions, but it still held six operational roles across four contracts. All six were revoked through the 2-of-3 Safe at Safe nonces 6 through 11.

• KerneVault PAUSER_ROLE (nonce 6)
• KerneToken PAUSER_ROLE (nonce 7)
• KerneInsuranceFund MANAGER_ROLE (nonce 8)
• KerneFlashArbBot EXECUTOR_ROLE (nonce 9)
• KerneFlashArbBot SENTINEL_ROLE (nonce 10)
• KerneVault STRATEGIST_ROLE (nonce 11; flagged post-sprint and revoked April 18)

Verified on chain at block 44,883,093. The drainer EOA now holds zero AccessControl roles across every Kerne contract.

Source Verification Status

14 of 18 deployed Kerne contracts have their source verified on both BaseScan and Sourcify. The remaining 4 are tracked with documented reasons and resolution paths. Statuses re-checked 2026-06-11 against both explorers.

The redeem-legacy module above still custodies the USDC that backs residual external kUSD. That balance is read live rather than printed here as fixed text, because it moves and a number typed into a page does not: read it on BaseScan. Until August 4, 2026 this page stated it as "~117 USDC reserve", which had drifted 36% above the real balance while our own /api/stats and /transparency were already serving the correct figure. Do not take it from us: the same balance is readable directly on BaseScan.

Verification proves the deployed bytecode matches a published source file. It does not by itself tell you whether that deployed source is the newest source in the repository. The three places where live bytecode lags current source are disclosed, with mitigations and operating rules, at /security/deployed-vs-source.

External Audit Posture

Kerne has completed its first external smart-contract audit. Fieldwork ran from July 13, 2026, Hexens delivered its initial report on July 20, 2026, and the final report published on July 31, 2026. It is committed in full, unedited, in the public contract registry: read the report. Ten findings: none critical, two high, two medium, four low and two informational. Eight were fixed and two were acknowledged without a code change, with the reasoning published rather than summarised, and all ten sit in KerneVault. Our response to each one is at every finding and our response, and the finding table itself, each id with its severity, disposition and our answer beside it, is at /security/hexens-2026. The report pins its scope to five contracts at commit 0912c870: kUSD, skUSD, KUSDPSM, KerneVault and esKERNE. Reviewed source and deployed bytecode are separate facts, and the gap between them is stated in full at /security/deployed-vs-source. The auditor-facing scope document is public: Tier 1 covers the deployed risk-bearing contracts, Tier 2 the full deployed verified surface. See audits/SCOPE.md in the public contract registry. The internal adversarial audit above (201 findings disclosed, full triage published) remains the largest finding set Kerne has published, and the operating commitment is to keep the open finding count public until it converges to zero.

This engagement is confirmed publicly by Hexens itself. Hexens stated it from its own account on July 10, 2026, noting Kerne's place in their Builder Support Program. That is a third-party source for the engagement, Hexens rather than Kerne, not a claim Kerne makes about itself. It confirms the engagement, not the outcome. The outcome is now published and readable above, and a completed audit is still not a certificate that the code is safe.

How a finding of any severity is triaged, remediated, and disclosed, including the triage timeline, severity handling, and the commitment to publish the full report whatever it contains, was pre-committed on the findings-response protocol page, published before fieldwork began. That protocol still governs anything raised from here on.

With the engagement closed, the bug bounty program is the standing external verification channel, alongside the completed Hexens review published on July 31, 2026.

Past Incidents