# Vaultfire V3 — Audit Scope

## 1. In scope
All V3 Solidity under `v3-src/contracts/**`:

- Signatures / mandate: `EIP712BaseV3`, `SignatureVerifierV3`, `MandateRegistryV3`.
- Identity: `IERC8004IdentityRegistry`, `ERC8004IdentityAdapterV3`, `LegacyKYAAdapterV3`.
- Bonds: `BondStateV3`, `BondMathLibV3`, `PullPaymentsV3`,
  `RewardProgramV3`, `PartnershipBondV3Safe`,
  `AccountabilityBondV3Safe`, `SafeBondFactoryV3`,
  `PartnershipBondFactoryV3`, and `AccountabilityBondFactoryV3`.
- Reputation: `StreetCredV3`, `ERC8004ValidationRegistryV3Safe`.
- Escrow / vault / mutual aid: `TaskEscrowV3`, `MutualAidPoolV3`, `VaultfireBIPVaultV3`.
- Governance: `MultisigGovernanceV3`.

Off-chain artifacts consulted (not audited but reviewed for consistency):

- `baseline/deployments.json`, `baseline/x402-route-registry.json`.
- `pr7/registry/**`, `pr7/api/v3/**`, `pr7/sdk/v3/**`, `pr7/indexer/**`, `pr7/tests/x402/**`.
- `v3-src/test/invariants/**` — 15 invariants.

## 2. Out of scope
- All deployed V2 contracts (immutable).
- V2 API routes.
- V2 SDKs.
- Front-end / Vercel deploy pipeline.

## 3. Threat model
- **Signer/operator compromise** — mitigated by multisig + timelock.
- **Signature replay across chains and forks** — chain-id rebind + nonces.
- **Self-bonding / self-reporting** — `SelfBondForbidden`, `isSameIdentity` cross-check.
- **First-depositor donation on ERC-4626** — virtual shares/assets in `VaultfireBIPVaultV3`.
- **Reward inflation from principal** — `RewardProgramV3` sponsor-funded and disjoint from principal.
- **Locked slashed stake** — caller-bound treasury withdrawal credit after slash.
- **Reentrancy on external transfers** — pull-payment pattern via `PullPaymentsV3`.
- **Governance/oracle key conflation** — independently rotatable
  `oracleAttestor` role on both bond implementations.
- **Reorg-driven state leaks in indexer** — safe/finalized labels only in APIs.

## 4. Property tests to run in CI
- Foundry invariants #1–#15. All have concrete fixtures and assertions.
- ERC-4626 property tests against `VaultfireBIPVaultV3`, including
  donation resistance, zero-share prevention, fee-on-transfer rejection,
  delegated withdrawals, and preview rounding.
- Factory deployment-gate, final-owner, and oracle-role rotation tests.
- Selector-scan bytecode check on every deployed V3 address (mirrors baseline scan for compromised deployer).

## 5. Fuzz targets
- `SignatureVerifierV3.recoverAndVerify` — malleability, ERC-1271 behavior, mismatched chainId.
- `MandateRegistryV3.registerMandate` — replay, expiry, revocation.
- `PartnershipBondV3Safe.createBond` — cross-signer confusion, deadline abuse.
- `TaskEscrowV3.forceRefund` — permissionless refund preserves accounting.
- `RewardProgramV3.commit/issue` — cannot exceed funded amount.

## 6. Deliverables to auditor
- Full source tree at commit hash (this branch).
- Threat model above.
- 15 invariants with mapped tests.
- Deployment plan (`baseline/MIGRATION_PLAN.md`) + monitoring runbook.
- V2 access-control matrix + baseline compatibility matrix.

## 7. Success criteria
- Zero unmitigated High findings before pilot enable.
- All 15 invariants and the ERC-4626 suite green under high-depth local
  fuzzing and a separately recorded Base-fork run.
- No unbounded loops (invariant #12) validated via `forge inspect --gas`.
- Selector-scan report clean on every V3 deployment.
