Security

Design properties#

• Oracle-free minting. Shares are minted from the smallest relative increase in holdings, so price manipulation cannot mint cheap shares or dilute holders.
• Holdings tracked in storage. The vault counts what it bought, not its token balance, so tokens sent directly to the hook cannot skew accounting.
• Reentrancy guards (transient storage) on every state-changing path.
• Per-leg 3% price impact guard on every basket trade.
• User minimum output on every ape and redeem through the router.
• In-kind fallback so a failing pool cannot block a redeem.
• Timelocks on listings, weight changes, fee routing changes and switching on user-built indexes.
• Keeper-only locker reward conversion with a size cap, a once per block limit and a minimum output.
• Buyback wallet. The buyback share accrues to a dedicated public buyback wallet set at deploy; changing it requires a 48h timelock. MTF buybacks start once MTF launches (TBA).
• Seed apes with a minimum share output so a new index's first mint cannot be sandwiched.
• Ape limits. Each ape is between 0.01 ETH and 5 ETH; there is no cap on total deposits.
• Non-upgradeable contracts. The code that is deployed is the code that runs.

Verification#

Automated tests

583

559 unit, audit and stress tests plus 24 mainnet fork tests, all passing

Invariant calls

1,024,000

8 invariants, random call sequences

Audit regression tests

58

one or more per fixed review finding

Scale test

50 indexes × 10 tokens

Fork round trip

1.19% to 1.22%

real mainnet pools

• Unit tests for the hook, router, factory, registry tiers, fee splitter, locker, metadata and the user index switch.
• Fuzz tests over ape and redeem sizes and basket compositions.
• Stateful invariant suites: 8 invariants checked over 1,024,000 random calls (256 runs × 500 calls deep per suite), covering vault solvency, redeems always working, and locker and fee accounting always adding up.
• Scale test with 50 indexes × 10 tokens, plus extreme value and gas tests.
• Mainnet fork tests on the real MEME500 pools: round trip cost 1.19% to 1.22%; with the live limits, a 5 ETH ape redeemed in full returned 4.94 ETH (98.8%), and ten 5 ETH apes in a row (50 ETH) all went through, and full redeems returned 49.4 ETH.
• Static analysis with Slither, with every result triaged.

Review#

An internal security review of the trading core, factory, registry, fees and locker identified issues that are now fixed and covered by 58 regression tests. This was an internal review, not an independent external audit. A public bug bounty is planned.