Security & audits
What has been done to break this system, what could still go wrong, and who holds which keys.
No external audit yet. Everything below is internal work by the ro0t team and independent review agents. An external audit and a public bug bounty are planned before mainnet deployment. Until then, treat the contracts as unaudited.
Internal adversarial rounds
Before and during implementation, the design was attacked in rounds. In each round an independent agent with no shared context received the spec, simulator, fork scripts and evidence ledger and tried to break them. Every finding was reproduced on a mainnet fork or by calculation, then accepted or rejected in writing, and the spec or code was revised. Rounds continued until one came back with zero Critical and zero High findings, then again for the code. The full log is docs/ADVERSARIAL.md in the repository.
| Round | Target | Critical | High | Main fixes |
|---|---|---|---|---|
| 1 | Spec v0.9 | 1 | 2 | Free price moves in an empty pool → mint liquidity during warming; pre-bond third-party LP risk documented; contract-counterparty block restored |
| 2 | v0.10 | 0 | 2 | Free price moves out of range and tick-density gas griefing; gateway context on every transfer to it; balance delta checks |
| 3 | v0.11 | 0 | 1 | Nonce-skip denial of service → blockhash salt; dust band; wording fixes |
| 4 | v0.12 | 0 | 1 | Same-block front-running of warm slots → reuse uninitialised pools; collect before finalize; staking notify rules; atomic RO0T launch |
| 5 | v0.13 | 0 | 1 | 60 day fallback excluded for warmed slots; demand ×0.5 stress axis; constants, permissions, wording |
| 6 | v0.14 | 0 | 0 | Seeded distribution for yearly figures; LAUNCH fee kind; evidence ledger (docs only → v0.15) |
| 7 | Implementation (contracts/) | 0 | 0 | Medium 0, Low 4: deploy script, warm queue clamp, residual wei carry, flash-loan wording |
| 8 | Code v0.17 (auto-settle, allowance exemption) | 0 | 0 | Medium 0, Low 3: block transferFrom(from = 0), allowance view for the gateway, settleOutcome view so quotes match settling trades |
Two accepted, documented limitations came out of these rounds. First, a third party can add a WHYPE-only position inside a pre-bond pool below the current price and earn a slice of fees on trades passing through it; contracts cannot prevent this and it does not affect bond accounting. Second, anyone can force a token to bond for about 4 HYPE of fees using a flash loan and a constructor-bundled contract; this releases escrow early and lifts the gate, but is not a profitable path; the spec calls for the site to label such bonds.
Tests
| Suite | What it covers |
|---|---|
| Unit tests | FeeSplitter splits, escrow, bonus waterfall; staking streams and pendingPot; registry; RO0T vesting and bootstrap formula |
| Fork tests (real HyperSwap bytecode on a mainnet fork) | Warming, launch, buy, sell, bond, unlock, collect, every known bypass attempt (router buys and sells, position manager mints, gateway donations), the round 7 and 8 proofs of concept, gas measurement over 100 runs, the RO0T launch |
| Invariant tests (3 suites, 64 runs × depth 40) | FeeSplitter: balance always covers every bucket, bonus ≤ 1 HYPE and zero before bonding. Staking: balance covers earned + pot + stream. Launch (on fork): context always closed, zero successful bypasses while gated, gateway holds nothing between trades, pool price ≥ P0, progress ≤ routed net buys, supply conserved, state only moves forward, locker always holds the NFT |
At the time of writing the repository contains 89 test functions and 14 invariants. Measured on the fork: a launch costs about 250k gas (521k with a 1 HYPE opening buy, 95th percentile), a warm slot about 5.6M, a full self-bond round trip loses the creator 0.90 HYPE, and a buy at second 0 delivers 51% of its HYPE to the pool, matching the 49.51% effective fee.
A testnet deployment has been through an end-to-end run: warm, launch with opening buy, buy, sell, collect, flush, and an RO0T launch rehearsal with staking and bootstrap emission. See contracts/README.md.
Admin powers
| Role | Who | Can | Cannot |
|---|---|---|---|
| Guardian | One key, meant for fast response | Pause new launches and slot warming, immediately | Touch trading, claims, collects, bonding, unlocking, payouts, liquidity or fees of any existing token; unpause |
| Timelock | 3-of-5 multisig, every action delayed 48 hours | Add a new contract version to the registry; unpause; call the RO0T launcher once; set the staking configurator once | Change any fee, split, target or address of an existing deployment; withdraw anything |
| Treasury | Multisig, receives flushTreasury | Spend what it receives | Pull anything from the FeeSplitter or the locker |
| Creator payout | Per token | Change its own payout address | Anything else |
On the current testnet deployment the Guardian, Timelock and Treasury roles are all held by the deployer key, since there is nothing of value to protect. Mainnet will use the multisig and timelock described above, and the addresses will be published on Contracts.
What is immutable
- Fee rates and splits, the sniper guard curve, the bond target, the 10 minute, 30 day and 60 day timers, the opening buy cap, the escrow and bonus rules.
- The locker: no function exists to transfer, decrease or withdraw a position.
- InitToken: no owner, no mint, no tax, no blacklist. The transfer gate has a fixed allow-list and switches itself off at bond, unlock, or 60 days.
- RO0T: no owner, no mint. Vesting and bootstrap schedules are constructor parameters.
- Nothing is upgradeable. A new version is a new deployment, appended to the registry after the timelock, and never affects tokens created under an older version.
Known risks that remain
- Unknown bugs. The code is young and unaudited.
- HyperSwap protocol fee: the HyperSwap factory owner can enable a fee of up to 1/4 of pool fees on any pool, reducing what the locker collects.
- Pre-bond third-party liquidity and forced bonding, as described above.
- Tick-density griefing: someone can lay many tiny WHYPE bands across a pool so that large trades need more gas than a small block allows; the front end splits such trades automatically.
- Warm queue exhaustion: an attacker can drain the warm queue for about 0.6 HYPE per 30 slots, delaying launches by up to a minute per refill. Availability only; no funds at risk.
- Front-end and infrastructure risk: the site, indexer and RPC are ordinary web services. The contracts do not depend on them, and every action is possible from any explorer.
External audits
| Firm | Scope | Date | Report |
|---|---|---|---|
| to be announced | init contracts | before mainnet | link will appear here |
| to be announced | RO0T launcher, vesting, bootstrap | before TGE | link will appear here |
Reporting a vulnerability
If you find a security issue, please do not exploit it on testnet or mainnet and do not post it publicly. Contact [security contact email]. A bug bounty with published scope and rewards will be announced before mainnet.
Next: Whitepaper →