Audit Findings Tracker

KerneVault rate-limit bypass on updateHedgingReserve and updateL1Assets when prior value was 0

Rate-limit now enforced on first writes. Paired with KernePrime free-collateral faucet closure in the same commit.

KernePrime accounting-only ledger could be wired to mint/burn kUSD without a backing check

KernePrime free-collateral faucet patched alongside the rate-limit bypass.

KerneStaking lock-bypass via partial-unstake-then-restake path

Source patched same-day with 7 regression tests. Deployed bytecode at 0x032A...D582 has not been re-verified to confirm the fix is on-chain; treat as partial until verified.

InsuranceFund.checkAndInject targets degraded vault totalSupply

Duplicate of TOP-3 in the audit's framing; tracked as a separate item because the source-level fix and the operational mitigation differ.

KerneVault.setFactory race window enables clone hijack

Factory not currently used for deploys; closing the race before any factory-driven vault is deployed.

KerneZINRouter.onFlashLoan accepts any lender with attacker-chosen calldata

ZIN router not currently in deploy path. Patch before re-enabling.

KerneIntentExecutor V1 lacks the V2 hardening and remains callable

V2 closed the equivalent class of bugs. V1 SOLVER_ROLE still ungated; pause + revoke needed before V1 sees production use.

KerneVault.emergencyExit drains entire balance to arbitrary recipient

Requires DEFAULT_ADMIN_ROLE + paused state, so blast radius is Safe-bound; still worth pinning recipient to treasury + adding a 24h delay.

RFQ /quote endpoint signs arbitrary EIP-712 orders with strategist key, no auth

Bot is offline as of 2026-05-12 (HL-only restart 2026-05-13 with the RFQ surface still disabled). Attack surface inert; patch is still required before the RFQ endpoint is re-enabled.

BotOrchestrator.deploy_instance writes raw private keys to /tmp env files

Bot is single-instance HL-only; the orchestrator multi-container path is inactive. Patch required before orchestrator-style deploys are re-enabled.

Opal cron /api/opal/cron/accrue accepted spoofable x-vercel-cron header as auth

Constant-time Bearer comparison against CRON_SECRET shipped 2026-05-11 (commit 35c05ec1). ACCRUE_SECRET legacy fallback dropped from source and removed from Vercel env 2026-05-21, closing the audit's rotation sub-task. CRON_SECRET is now the sole credential. Production probe with no Bearer returns 401; cron fires hourly on schedule.

KerneVault pause path requires Safe co-sign; no on-chain pauser holds PAUSER_ROLE

Bot's pre-flight pause simulation (commit 80c676aa) prevents the loop-spam failure mode, but a live solvency event still requires manual Safe co-sign to pause. Safe co-sign is out of scope for current ranked action plan.

KerneInsuranceFund.checkAndInject is permissionless and computes target against degraded vault totalSupply

Mitigated today by the vault's degraded-state UI guard (deposits gated); the on-chain primitive remains callable by anyone. Requires source patch + Safe AUTHORIZED_ROLE strip.

Database port on the ops host is reachable from the public internet

Open, and named here rather than papered over. The public reachability is deliberate: it serves a live product surface. Closing it means removing that reachability entirely, which is a scoped project and not a configuration toggle, because an hourly job and several read paths depend on the current transport. Compensating controls, verified on-box 2026-07-29: the firewall rate-limits new connections per source; the database refuses unencrypted connections at the host-based access layer, so TLS 1.3 is mandatory; and authentication is scram-sha-256. Sustained automated probing from distributed sources is visible across the current log retention window, and every attempt terminated at the TLS requirement or failed authentication, with none establishing an authorized session. The exact port and firewall-rule syntax are withheld from this page on purpose; the severity is not.

Leaked OpenRouter API key committed in bot/solver

Source was patched in the 2026-05-11 audit pass (commit 35c05ec1). This row is closed on 2026-07-30, but the closure corrects a bookkeeping drift rather than reporting new remediation, and the distinction is worth stating plainly: the key was already established as dead on 2026-05-17, recorded in the internal tracker at docs/security/COMPREHENSIVE_AUDIT_2026-05-11.md (row 5 and B5) as 'NEUTRALIZED, owning OpenRouter account no longer exists'. That conclusion was never propagated here, so this public row went on asserting for ten weeks that an operator rotation was still outstanding when the internal record already said it was not required. Re-verified from scratch on 2026-07-30 rather than taken on trust: the key was recovered from git history, presented to OpenRouter's key endpoint, and rejected with HTTP 401 'User not found', byte-identical to the response for a deliberately invalid control key issued in the same pass. A key that cannot authenticate cannot be billed against. Two related credentials from the same committed file were checked in the same pass and are recorded here because the original finding named only one: the Basescan key is likewise dead (Etherscan v2 returns 'Invalid API Key', identical to the control), and the committed CEX and Discord values were never live at all, being the literal placeholders 'your_api_key', 'your_secret' and 'your_discord_webhook_url'. One credential from that file remains outstanding and is deliberately named rather than folded into this row's closure: a Resend mail key, whose provider-side state could not be determined without an operator login. It is not this finding's subject, it is confirmed NOT to be the key production sends mail with, and its revocation is the one open item in docs/security/CREDENTIAL_ROTATION_2026-07-30.md.

VPS SSH posture: remote root login accepted password authentication

Closed on-box 2026-07-29. Remote root access is now key-only: password and keyboard-interactive authentication are both refused by the daemon, and root login is restricted to public key. Verified against the running daemon from a separate connection rather than by reading the config file, because a distribution drop-in was silently overriding the main file and the file on its own would have misreported the state. One correction to the original finding text, which was wrong on a point of fact: fail2ban was already active on this host and had been banning brute-force sources throughout. Operator console recovery is deliberately retained so the host cannot be locked out of. No closing commit is cited because this is a host configuration change and has no corresponding source commit.

Opal /api/opal/balance/[address] IDOR with write-on-read

Removed the INSERT-on-GET path; balance reads are now read-only.

kUSD.burnFrom callable via permit2 chain by any contract with allowance

burnFrom is now gated behind BURNER_ROLE. The permit2-then-burnFrom primitive is closed.

Postgres opal-pg TLS connection used rejectUnauthorized: false

35c05ec1 flipped to rejectUnauthorized: true with pinned CA cert. 982996d9 (2026-05-14) added explicit CN verification when the connection hostname (localhost.) does not match the cert's CN (134.209.46.179), which had been silently failing every Vercel cron invocation since 2026-05-11 23:00:50 UTC and froze the fragment ledger for 66 hours.

Bot used 5% slippage on every Hyperliquid order

Tightened to 0.3% with TWAP fallback for sizes over 5 ETH.

All bot on-chain txs used legacy gasPrice instead of EIP-1559

panic.py + oracle_updater are on EIP-1559. ~12 other call sites (chain_manager, risk_engine, por_attestation, etc.) still use legacy gasPrice; pending a canonical helper rollout.

KerneYieldDistributor merkle root is updated without a 24h timelock window

Distributor is currently inactive (0 KERNE in flight). Add timelock before any first distribution.