Security reviews
Three independent reviews of the v1 contracts, one behavioural fix, every report public.
The Ascnt v1 contracts have been through three independent security reviews. Every report, the finding-by-finding response, and the accepted-risk register are published in the public repository: github.com/ascntlabs/v1-core. No review guarantees the absence of bugs.
Completed reviews
| Reviewer | Scope | Date | Report |
|---|---|---|---|
| Olympix — automated BugPoCer scan with human-verified findings | v1 core, tag audit-2026-08-18 | 2026-08-24 | Report |
| Vulsight — one-day manual review | v1 core, tag audit-2026-08-18 | 2026-08-27 | Report |
| LeftClaw — review #680 | v1 core, tag audit-2026-08-18 | 2026-09-04 | Report |
Outcome
No finding identified a path to loss of LP funds. One behavioural change resulted: the maximum fee a pool can be configured with is now strictly below 100%, so a swap against a saturated pool can never be rejected by the fee alone; the v1.0.1 hook later lowered that ceiling to 50%. Every other finding was either a documentation correction or an accepted, analysed behaviour — each is written up with its mechanism and reasoning in the repository's review response and known-issues register.
Scope
AscntGovernance— authority registry: owner, timelock, pauser, and pool-deployer lanes; protocol-fee and treasury state; subscriber registry.HookFactory— CREATE2 deployment and hook verification/deprecation flags.AscntBaseHook— authority gates, the per-swap protocol-fee take, pause and JIT hooks.SimHook— the dynamic-fee pricing, one-time pool configuration, and JIT block-lock.- Internal libraries — swap simulation, fee math, and safe casting.
All three reviews covered the code-frozen tree tagged audit-2026-08-18. The release tree adds the fix above plus documentation and tests, and is supported by an extensive test suite (fuzz, invariant, and differential testing against the live v4 engine). The exact release commit is published with the deployment.