Trading opens only once the settlement contract has been reviewed by people other than its author. This page is the record: who looked, at which exact bytes, what they found, and what nobody has looked at yet.
Two fingerprints matter here The version the blind reviews examined (1eadfdf1…) and the corrected version now in service (fa749192…). Both are named below, and what separates them is exactly the corrections those reviews produced.
Counted, not claimed
Two blind reviews, zero overlap
On September 1 and 2, 2026, two independent reviews examined the
same frozen version (1eadfdf1…, 6,136 bytes) without knowing of
each other, without access to the project's notes, and without knowing what had
already been found. Each first proved, by byte-identical recompilation, that what
it was reading is what is published on chain.
What the reviews attest is that exact version, and it is kept
verifiable. The instance they examined, application 770843923 on the test network,
is deliberately left standing: anyone can still compare its program to the
1eadfdf1… fingerprint. The corrections that came out of
these reviews are engraved in the version now in service,
fa749192… (6,429 bytes, application 770868027 on the
test network), which carries eight corrections proven by bench tests that fail on the
old version and pass on the new one.
What this means, and it is not a weakness. Two competent reviews of the same object, with the same time, found entirely different things. Either one alone would have looked like reasonable coverage. Together they prove that the coverage of any single review is far narrower than it appears, and that this project measured its own review coverage instead of assuming it. It is also why trading stays closed: the rule here is that nothing opens while the search for defects is still producing finds.
SHA-256 of the compiled program
The version engraved after the reviews, carrying their eight corrections, application 770868027 on the test network. Listed here so the trail says both what was reviewed and what now runs.
Execution on its own test instance, application 770802760. Six findings on a version whose source was later lost, then recovered from the chain, making the findings verifiable again.
Twenty scripted attack scenarios against a live test instance, with proofs kept on disk.
Adversarial audit of the settlement path. Its archived copy is being restored from the chain.
A review made with full knowledge of the project notes, to catch what blind reviews structurally miss.
Eleven executed scenarios; its test instance was deliberately left standing as the living demonstration of one finding.
Blind: no project notes, no other reviews. Found the deposit refunded on a position never closed, measured with a control account.
Blind, independent of the September 1 review. Found the offer path missing the clawback/freeze guard, and a deposit charged several times; both measured on instance 770850604.
Each fingerprint names an archived copy of the exact program reviewed, kept in the project's version archive. The two blind reviews' full reports exist on disk and will be published with the frozen contract.
Fixed with proof, or assumed with a reason
Findings are never just closed. Each one ends in one of two states: corrected, with a bench test that fails on the old version and passes on the new one, or assumed, with the reason written down. A correction that has not yet refused anything on chain is counted as written, not as done.
Among the corrections decided from the latest reviews: the offer path now applies the same clawback/freeze guard as the two other entry paths; deposit accounting was reworked so nothing is refunded twice or withheld; and bundles paid in a token were bounded to two pieces after measuring the real worst-case compute budget (686 of 700 units on the heaviest branch, a branch no single review had measured).
What no review had seen is recorded too: a defect in a currency's floor price that could have made the market impossible to close, found by the project's own measurements between the reviews. It is part of why the record shows the rule working: reviews narrow the risk, measurement at the extremes narrows it further, and nothing opens while either is still finding things.
Nothing here asks to be believed
Every fingerprint on this page is the SHA-256 of a compiled program. Recompile the published source and compare bytes. The test instances named here live on the Algorand test network and can be inspected by anyone, at any time, in any explorer. The rules the site announces (commission, floors, bundle sizes) are read from the contract source at build time, never copied by hand, and the build refuses to run if a bound appears that the site does not know.
Page last verified against the archive on September 2, 2026.
