Search results

[H15] [MEDIUM] subgraph/networks.json duplicates every deployer address from LibProdDeploy.sol with no enforced sync

auditAudit pass labelAudit pass label

mediumAudit severity: mediumAudit severity: medium

pass6Audit pass labelAudit pass label

Status: Open.

#220 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H14] [LOW] OracleRegistryBeaconSetDeployer factory signature drifts from SPEC §9; spec/code drift hazard with no contract test

auditAudit pass labelAudit pass label

lowAudit severity: lowAudit severity: low

pass6Audit pass labelAudit pass label

Status: Open.

#219 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H13] [LOW] BasePythOracleAdapter uses sequential storage with mutable subclass slots; subclass-vs-base layout drift footgun on upgrade

auditAudit pass labelAudit pass label

lowAudit severity: lowAudit severity: low

pass6Audit pass labelAudit pass label

Status: Open.

#218 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H12] [LOW] LibProdDeploy contains hand-curated re-deployment dates and run numbers as Solidity comments; rotting documentation hazard

auditAudit pass labelAudit pass label

lowAudit severity: lowAudit severity: low

pass6Audit pass labelAudit pass label

Status: Open.

#217 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H11] [INFO] No enumeration test asserts ICorporateActionsV1 sentinel handling matches upstream; same shape as the live LibCorporateActionsPause bug

auditAudit pass labelAudit pass label

infoAudit severity: infoAudit severity: info

pass6Audit pass labelAudit pass label

Status: Open.

#216 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H9] [LOW] Deployment suite name strings duplicated between manual-sol-artifacts.yaml and Deploy.sol; typo silently routes to revert

auditAudit pass labelAudit pass label

lowAudit severity: lowAudit severity: low

pass6Audit pass labelAudit pass label

Status: Open.

#214 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H8] [MEDIUM] ProdFork skip modifiers cause whole-test silent vacuous-pass when fork env vars are missing or addresses are zero

auditAudit pass labelAudit pass label

mediumAudit severity: mediumAudit severity: medium

pass6Audit pass labelAudit pass label

Status: Open.

#213 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H7] [MEDIUM] IAggregatorV3 is a hand-typed copy of an external Chainlink interface; nothing detects upstream drift

auditAudit pass labelAudit pass label

mediumAudit severity: mediumAudit severity: medium

pass6Audit pass labelAudit pass label

Status: Open.

#212 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H6] [LOW] BEACON_INITIAL_OWNER duplicated in LibProdDeploy, AGENTS.md, and CLAUDE.md without enforced sync

auditAudit pass labelAudit pass label

lowAudit severity: lowAudit severity: low

pass6Audit pass labelAudit pass label

Status: Open.

#211 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H5] [MEDIUM] Manual log-parse → PR → review pipeline for prod addresses; replace with workflow output and PR-bot

auditAudit pass labelAudit pass label

mediumAudit severity: mediumAudit severity: medium

pass6Audit pass labelAudit pass label

Status: Open.

#210 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H4] [MEDIUM] Unified deployers hardcode sub-deployer addresses from LibProdDeploy; sub-deployer redeploy silently strands the union

auditAudit pass labelAudit pass label

mediumAudit severity: mediumAudit severity: medium

pass6Audit pass labelAudit pass label

Status: Open.

#209 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026

[H3] [MEDIUM] Production address registry split across LibProdDeploy and ProdFork.t.sol; ORACLE_REGISTRY duplicated by hand

auditAudit pass labelAudit pass label

mediumAudit severity: mediumAudit severity: medium

pass6Audit pass labelAudit pass label

Status: Open.

#208 In ST0x-Technology/st0x.oracle;

· hardyjosh opened on May 10, 2026