What it cannot do.
Promises are cheap and audits are not proofs. The useful statements about a protocol are the ones about what the code makes impossible, so those come first and the audit status comes after.
Five properties, each one structural.
-
No admin withdrawal path
There is no function, on any contract, that moves assets out of a Crucible to an address that is not redeeming Ingots. Not gated, not timelocked — absent.
-
No upgradeability on core
Crucible, Ingot, Settlement and Registry have no proxy and no delegatecall. A new version is a new address, and moving to it is a decision each holder makes.
-
Redemption cannot be paused
Quench halts minting, rebalancing and routing. It is deliberately unable to halt redemption, because a stop that traps depositors protects the protocol from its users rather than the other way round.
-
Bounds are enforced at settlement
The settlement contract re-checks every signed bound against the actual fill. A solver that returns a worse price does not get a worse trade through; it gets a reverted transaction.
-
Fees cannot be raised on exit
Mint and redeem fees are compile-time zero, not zero-by-default. There is no governance action that makes leaving cost more than it did when you arrived.
Zero audits, and saying so is the point.
No external review has been carried out, because there is nothing deployed to review and a report on code that then changes is marketing. When contracts are frozen for deployment, the reports and the commit hash they cover are published together, including the findings that were not fixed and why.
Treat any pre-audit protocol as unaudited even when it says an audit is in progress. In-progress is not a finding.
- External audits complete
- 0
- Audits in progress
- 0
- Formal verification
- None
- Public testnet
- Not live
- Source published
- At deployment
- Immutable core
- By design
How to report something.
There is no contact address on this page yet, and inventing one would be worse than leaving it out — a security address that nobody reads is a vulnerability queue with no consumer. It appears here when there is someone on the other end of it.
- 01
Report privately
Never open a public issue for something exploitable. The window between disclosure and fix is the whole risk.
Channel: pending - 02
Acknowledgement
Within two working days, with a named person and a tracking reference.
Target: 2 days - 03
Assessment
Severity agreed with the reporter, not assigned to them. Disagreements are published alongside the finding.
Target: 10 days - 04
Publication
Fix, write-up and credit, on a date the reporter agrees to. No indefinite embargoes.
Public
The scale, when there is something to attack.
Published now so the numbers are not written after someone finds something. No programme is live — there is no deployment, so there is nothing to pay out against.
| Severity | Meaning | Planned |
|---|---|---|
| Critical | Depositor funds can be taken or permanently frozen | Up to 10% of value at risk |
| High | Bounds bypassed, or the exit path can be blocked | Fixed tier |
| Medium | Yield can be diverted or the range griefed at scale | Fixed tier |
| Low | Denial of service against a replaceable control contract | Fixed tier |
Deliberately no figures against the lower tiers. A number printed before a programme exists is a number that gets quietly revised down when it is time to pay.
The parts that are genuinely risky.
Not a disclaimer. These are the specific ways a careful user still loses money, and none of them is fixed by an audit.
-
Range drift is a real loss
A Crucible can be worth less than what was deposited into it after a large move, and fees may not cover the gap. This is a property of concentrated liquidity, not a bug in this implementation.
-
Alloy carries issuer risk in full
A tokenised share is a claim on its issuer. If they fail, are frozen, or refuse redemption, that loss lands entirely on the holder. Anneal routes to these; it cannot stand behind them.
-
Privacy ends at settlement
The settled trade is public. Someone reconstructing a batch from its inputs and outputs may narrow down who was in it, particularly in a thin batch. Small batches leak more than large ones.
-
A stalled rebalancer costs yield
The exit path does not depend on it, but nothing forces anyone to call it either. A Crucible nobody maintains earns worse than one that is maintained.
-
Immutability cuts both ways
Non-upgradeable means a bug found after deployment cannot be patched in place. The response is a new deployment and a migration people must actively choose — safer against capture, slower against mistakes.
Read the parameters next.
The bounds are where the guarantees on this page are actually made — or quietly given away.