Security analysis

Status: threat model and controls. The contracts are deployed on Base Sepolia; Base Mainnet opens at the TGE (2026-10-23).

Latest audit: security audit of 2026-10-17 (scope, raw tool outputs, triage, findings and their status).

The allocation model changed on 2026-09-27 (11 allocations; the Ecosystem Reserve was removed). ARLAllocation, ARLToken, the deployment planner, deployer, verifier and rehearsal were changed with it. This is a new security-sensitive revision: evidence gathered for the previous model does not carry over and must be re-reviewed for this one.

Scope

contracts/src/ARLToken.sol (including ERC20Permit), ARLAllocation.sol, ARLVestingWallet.sol, ARLTimelock.sol, and their use of OpenZeppelin Contracts v5.6.1.

Assumptions

• OpenZeppelin v5.6.1 ERC20, VestingWallet, TimelockController and their dependencies are correct (see open-source.md).
• The Safe contract used for the treasury is a correctly configured 2-of-3 Safe.
• The treasury guardian is a separate, correctly configured Safe whose signers are disjoint from the treasury Safe's.
• Deployment passes correct, explicit timestamps and the intended holder addresses. The contracts validate ordering but cannot validate intent.
• Block timestamps are accurate to within seconds; vesting boundaries are not sensitive to small drift.

Threats and controls

Mutation checks

Each deliberate defect was introduced, the suite run, and the defect reverted:

Slither 0.11.6

• ARL code (--filter-paths "lib/|test/" --exclude-dependencies): 0 findings, 102 detectors. CI fails on any low-or-higher finding. The three timestamp comparisons in ARLMerkleDistributor (claim window open or closed) are suppressed inline: the window is days long, so block-timestamp drift of seconds cannot change an outcome that matters. The calls-loop findings in the CreateSafes deployment script (one Safe created and checked per role, 12 in total) are suppressed inline: it is a script, not a deployed contract.
• Including OpenZeppelin: 29 findings, all in upstream code and expected by design:

Semgrep (evaluated, not adopted)

The Decurity semgrep-smart-contracts rules report no findings on contracts/src, but they are licensed CC BY-NC-SA 4.0 (non-commercial), so they are not used in CI or relied on as evidence.

Mythril 0.24.8

Symbolic execution of the runtime bytecode of ARLToken, ARLTimelock, ARLMerkleDistributor and ARLVestingWallet: 9 findings, none exploitable. The one rated High (SWC-101 in the inherited onERC1155BatchReceived) is a decoder false positive, now covered by a test replaying Mythril's transaction and a fuzz test over arbitrary calldata. Full triage: docs/review-scope.md.

Staking rewards (ARLStakingRewards)

Ported from Synthetix StakingRewards via curvefi/unipool-fork (MIT). The reward-per-token and earned formulas are unchanged from the source; the ARL changes are about custody and accounting.

Privileged role. There is no owner. One address, rewardsDistribution, is fixed at deployment and can only: fund a period from its own balance (notifyRewardAmount), change the period length between periods (setRewardsDuration), and take back unallocated rewards between periods (returnUnallocated). It cannot withdraw or freeze principal, take allocated or reserved rewards, mint, pause, upgrade, replace itself or recover tokens. The contract cannot tell where reward tokens come from economically; script/ARLStakingVerify.sol enforces that the distributor is the plan's Community & Staking holder (recipients.communityStaking) and that ARL is both the staking and the reward token.

Accounting identity. rewardsFunded = accrued + reserved + unallocated + rewardsReturned, where reserved = rewardRate × (periodFinish − lastTimeRewardApplicable()). unallocated is the time elapsed with nothing staked plus the remainder of the rate division; the reserve of an active period is never part of it.

Tokens retained permanently (by design, no recovery function). (a) Tokens transferred directly to the contract, bypassing stake and notifyRewardAmount, are neither principal nor reward: never paid out, never returnable. (b) Reward-per-token rounding: with a large total stake and a small rate, per-checkpoint increments can round to zero; those rewards count as accrued but nobody can claim them. Both stay in the contract; test_DirectTransferIsRetained, test_RoundingDustIsRetained and the BalanceFullyExplained invariant show that principal and every claimable reward remain payable.

Dependency scan

CI runs scripts/audit.mjs at the root and in each app instead of a bare npm audit --audit-level=high. Any high or critical advisory fails the build unless .audit-allowlist.json lists its GHSA id with a reason and an expiry date. An expired entry fails, so every exception is reviewed again, and an entry that no longer matches anything fails, so it gets removed.

Compiler

solc 0.8.36. Its three known bugs (MisorderedNamedParametersInRequireWithCustomErrors, MemoryByteArrayElementDeleteClearsWholeWord, SpillSlotCollisionAcrossMutualRecursion) do not apply: no named arguments in require with custom errors, no delete on memory byte arrays, no via-IR. 0.8.37 (released 2026-09-10) was not chosen because it is too new to have a track record.

Known limitations

• Lost beneficiary keys cannot be recovered by the vesting wallet. Recovery depends on the beneficiary being a Safe and on its owners keeping a signing quorum.
• The Safe's threshold is not enforced by ARL contracts.
• Production deployment parameters (TGE date, holder Safe addresses, launch parameters) are not decided; Base Mainnet opens only at the TGE (2026-10-23T00:00:00Z) in the deployment tooling.
• ERC20Permit accepts EOA signatures only; smart-contract wallets use approve or Permit2.
• Compiler warnings from contracts/lib/ are silenced (ignored_warnings_from): upstream OpenZeppelin ECDSA uses error as an identifier, which solc 0.8.36 flags as a future keyword. ARL code still reports all warnings.
• Symbolic checks (Halmos) prove ten properties within bounded inputs; this is not full formal verification. Review scope: docs/review-scope.md.