# Finding Matrix

| ID | Severity / status | Exact location | Exploit / condition | Disposition and regression | Residual risk |
|---|---|---|---|---|---|
| P2-BOND-001 | **Medium — fixed** | `v3-src/contracts/bonds/AccountabilityBondV3Safe.sol:176-205`; validation at `:185-190`; regression `v3-src/test/bonds/AccountabilityBondLifecycleExpiryV3.t.sol:21-36` | Before the fix, a relayer holding valid mutual signatures could create terms after `activePeriodStart`; the company could then fund and activate an already-running or already-ended accountability bond. The old validation required only `activePeriodEnd > activePeriodStart`. | Require `activePeriodStart > block.timestamp` at creation, before signature nonces and `nextBondId` are consumed. Regression proves `BadTerms`, unchanged ID, and unconsumed company/counterparty nonces. Fixed in `a04597fca57676be06382c4669937c5b08b7c4f1`. | There is no separate signed-submission deadline: the active-period start is now the submission boundary. Parties that intentionally delay start must choose a future start or re-sign new terms. |
| P2-OBS-001 | **Informational / release-gate observation — open** | `v3-src/script/BasePilotForkSimulation.s.sol:17` (`BasePilotForkBootstrap`) | The unfiltered repository size command reports `BasePilotForkBootstrap` runtime size 111,466 bytes, above the 24,576-byte EIP-170 runtime limit. It is a fork-simulation/bootstrap script artifact, not a production contract in the deployable-contract size run. | No contract change in this Phase 2 bond audit. The deployable-only size command excluding `test/**` and `script/**` exits 0, including all audited deployable contracts. The unfiltered command remains exit 1 and must not be represented as passing. | Anyone intending to deploy this bootstrap contract directly must refactor it; it cannot be deployed as currently compiled. This is an operational/release-engineering concern, not a verified bond-funds exploit. |
| P2-V2-001 | **Release blocker — open, pre-existing** | `baseline/check_v2_abi_package.py`; `legacy/v2/manifest.json` `blockedDeployedContracts` | Strict V2 ABI provenance validation reports one deployed name (`VaultfireTrustAttestation`) without a traceable ABI. | The strict gate remains exit 1; no V2 source, manifest, or provenance was altered by this review. The frozen V2 runtime-bytecode manifest gate passes for 134 hashes. | V2 ABI/package compatibility cannot be fully attested until the ABI is traceably acquired and independently checked. |
| P2-VAL-001 | **Validation blocker — open** | `test/fork/base/BasePilotDeploymentRollbackV3.t.sol`; supported-chain fork availability tests | No configured `BASE_RPC_URL`, `ARB_RPC_URL`, `AVAX_RPC_URL`, or `POLYGON_RPC_URL` was available. Tests print explicit skip messages; the all-local suite's aggregate `0 skipped` result does not convert missing live-fork validation into a pass. | No RPC call, deployment, or state change was attempted. | Base/V2 rollback behavior is only locally/source-gate supported in this package; independent fork runs with pinned RPC/block evidence remain required. |

## Review conclusion

One material bond-primitive issue was identified and minimally remediated. No additional material exploitable issue was identified in the reviewed source paths. This conclusion is bounded by the stated scope and evidence; tests, Slither, and size output are supporting signals rather than a proof of security.
