Question: What is the trust/threat model for Creator vault → ShareOFT → lottery → gauges → ve4626 on Base, and what residual risks remain after the ODA 2026-07-22 batch?
Use this brief as SOURCE OF TRUTH for links + dispositions. Synthesize architecture and residual risk. Do not re-audit full Solidity line-by-line. Do not use github.com/wenakita/CreatorVault or private wenakita/4626.
| Field | Value |
|---|---|
| Repo | https://github.com/4626fun/4626 |
| Tag | audit/oda-2026-07-22 |
| Commit | 423e0e3 |
| Tree | https://github.com/4626fun/4626/tree/audit/oda-2026-07-22/contracts |
Stale-pin note: Private remediations (Critical/High/Medium/Low) landed after this pin. Treat pin as the audited snapshot; call out “fixed privately / pin stale” where relevant (esp. lottery adminModuleCall → onlyOwner, High DoS fixes).
Lottery/VRF · CreatorOVault + CoreModule · ShareOFT + Wrapper · DeploymentBatcher · Registry · Charm + Ajna strategies · Creator/Agent gauges · ve4626 + bribes.
| Job | System | Status | Report |
|---|---|---|---|
| 460 | Lottery probe | complete | IPFS |
| 461 | Lottery stack | complete | IPFS |
| 462 | CreatorOVault | stuck accepted |
— |
| 463 | ShareOFT + Wrapper | stuck accepted |
— |
| 464 | DeploymentBatcher | complete | IPFS |
| 465 | Registry | complete | IPFS |
| 466 | Charm + Ajna | complete | IPFS |
| 467 | CreatorGauge | complete | IPFS |
| 468 | ve4626 + bribes | complete | IPFS |
| 480 | CreatorOVault resubmit | pending (replaces 462) | — |
| 481 | ShareOFT/Wrapper resubmit | pending (replaces 463) | — |
- Lottery:
return(0,0)nonReentrant brick; pause-before-grace; replay namespacing; payout isolation; pricing/decimals; VRF/AMOE hardening; renounce disabled. - Gauge: bridged ShareOFT unwrap DoS → jackpot fold; TWAP floor; fee-tier whitelist; lotteryManager revoke-to-0.
- Batcher: first-writer registry squat guard; codeId bytecode hash pin; Phase3
vault.asset()match; deposit bounds by decimals. - Registry: canonical wallet proof; LZ live overlay; creator clear wallet; factory codehash at call.
- Charm/Ajna: stale-oracle+debt fail-closed; vault/pool validation; bankrupt LP→0; adapter maxWithdraw cap.
- ve/bribes: emergency-reset freeze window; whitelist/vault/boost timelocks; renounce/permit/CEI guards.
- Registry multi-factory first-writer bindings (trust model).
- Charm spot NAV / rebalance sandwich (CLM residual).
- 464 finalize redesign (F-03/F-04) deferred.
- 466 spot Charm withdraw mins (documented SKIP).
- 465-8 cross-namespace OFT uniqueness skipped (EIP-170).
- 466-10 oracle rewire: owner-gated instant (24h timelock dropped for size).
- 468-M3 trust-model SKIP.
- Executive summary (≤10 bullets)
- Architecture / value flow (vault ↔ ShareOFT ↔ lottery ↔ gauges ↔ ve)
- Trust boundaries (owner, factories, oracles, LZ, VRF, keepers)
- ODA findings map (cite job IDs; note 480/481 pending)
- Residual risks after FIXED items
- Launch-readiness recommendations (ops + pin republish)
Generated for LeftClaw research · 2026-07-23