All issues

[Hardening] Consolidated audit tail: latent truncation, defence-in-depth asymmetries, gratuitous mint authorities, 128B mint over-allocation, CI gaps, dead artifacts

#184

· 0x-SquidSol opened

on Aug 30, 2026

[LOW] ReconcileBurnedNft abandons the NFT mint and ExtraAccountMetaList PDA — ~0.0068 SOL per NFT, unrecoverable (the #102 leak, on the path added later by #138)

#182

· 0x-SquidSol opened

on Aug 30, 2026

[MEDIUM] GetPositionValue documents fail-CLOSED on stale state in four places but reads no staleness field; the transfer hook and the valuation disagree on seven portfolio states

#180

· 0x-SquidSol opened

on Aug 30, 2026

[MEDIUM] NFT PDA close paths never reassign the account, so a permissionless ReconcileBurnedNft + same-tx lamport credit permanently bricks the (portfolio, market_id) mint slot

#178

· 0x-SquidSol opened

on Aug 30, 2026

[HIGH] Deployed mainnet percolator-nft trusts a devnet wrapper id that is unclaimed on mainnet; source is ungated (percolator-stake gates the identical allowlist)

#176

· 0x-SquidSol opened

on Aug 30, 2026

[HIGH] Marketplace-CPI transfers leave last_holder at the seller; ReconcileBurnedNft then releases the escrowed portfolio to a party who already sold the NFT

#174

· 0x-SquidSol opened

on Aug 30, 2026

L-2: EmergencyBurn still wedges on present-but-undecodable escrowed portfolio (#110B)

#162

· v1ktorrr0x opened

on Jun 24, 2026

L-1: Post-#105 dead weight: portfolio/nft_pda still marked writable in transfer-hook extra-metas

#161

· v1ktorrr0x opened

on Jun 24, 2026

M-1: Vendored portfolio layout lacks runtime validation; false claims about LiteSVM test

#160

· v1ktorrr0x opened

on Jun 24, 2026