Security and transparency

GENE's audit status, admin powers, trust assumptions, known limitations, threat model, the evidence behind the RC4 candidate and the scope notes for the external audit.

#Audit status

• Frozen for external audit. The RC4 contracts are code-frozen at tag rc4-audit-candidate, commit aca5fcd, since 2026-10-07. Any change would make a new candidate.
• Through the full internal gate. The production suites (unit, fuzz, manipulation, adversarial, long-hold, mainnet fork, launch rehearsal, invariants) ran 5,920 tests: 0 failed, 0 skipped, on the frozen logic (the freeze changed only the VERSION number). The production attack matrix ran 53,929 attack scenarios; in every one the protocol ended at or above its no-attack baseline (0 TRANSFER, 0 SELFFUNDED). The internal verdict is "ready for external audit". The one limitation it lists, the thin-market all-time-low ratchet, is described under Known limitations.
• External audit is the next step. No external report has been published yet. When one exists, it will be linked here in full.
• The code is the source of truth. Where an older design note differs from the code, the code wins.

#Scope of the audit package

#Focus areas requested of auditors

1. _newBlock and the all-time-low rule: any path that moves the all-time low on an empty-liquidity print, or places a protocol buy above it.
2. Net-flow accounting: any address-, router- or split-dependent way to fund a budget twice, or above the fee its flow paid.
3. Unlock-callback actions: the ERC-6909 claims accounting and the PlacementSkipped path, which must consume no reserve, cap or budget.
4. R1: that the caller cannot steer the REGENERATION allotment, and that repeated partial calls cannot exceed the caps.
5. Evolution gates and IMMUNITY's two-epoch confirmation.
6. Asks above min(spot, ATH) and GENE-side placement.
7. Deployment: hook permission bits from the CREATE2 address, the launch sequence and the genesis position.

#Scope notes for the external audit

These are the specific questions the external audit is asked to settle, beyond the focus areas above. Each comes from reading the frozen source. Notes 2 and 11 also draw on local experiments on an unmodified copy of the RC4 source or the frozen bytecode; those experiments are not part of the RC4 test suite. None is a confirmed finding.

#Immutability and admin powers

No party can change GENE after deployment.

The launcher. One address, fixed in the constructor, may call launch() once (GeneHook.sol:163, 252-255). Before launch it alone decides whether and when the pool opens; the whole supply sits in the hook until then, and nobody else can initialize the pool (GeneHook.sol:233, 332-334). After launch it has no power.

What GENE does not control. The Uniswap v4 PoolManager, the Uniswap protocol fee (set by Uniswap governance), and the routing lists of the Uniswap interface and other services, which affect discoverability rather than whether the pool can be traded.

The same immutability applies to the code itself: after deployment, no one can patch it.

#Trust assumptions

#Known limitations

The audit package's own text is published verbatim at /limitations/. In brief:

• §0 The all-time-low ratchet. RC4 accepts a block start as the all-time low only where the pool has active liquidity, which closes the free permanent disable of the earlier design. A paid, liquidity-backed ratchet remains: an attacker can sell through every protocol position and hold a block start there, moving the all-time low, and with it every later protocol buy, lower. Measured cumulative attacker cost in a thin market (about 30 ETH per epoch of organic trades, falling): 0.014 / 0.057 / 0.23 / 1.35 / 2.8 ETH for a 10% / 20% / 40% / 80% / 90% move of the all-time-low price. The attacker never profits in the tests (test/grief/AtlRatchet.t.sol), and the protocol ends with more Permanent Mass than an un-ratcheted control. Nothing in RC4 bounds how far below spot future protocol support can sit. Persistent or lagging anchors and a separate deployment reference were tested and rejected, because each produced a profitable, third-party-funded placement sandwich.
• §1 Falling markets. Every METABOLISM, churn and IMMUNITY bid sits at or below the all-time-low block-start price (GeneHook.sol:484, :498-499, :516), and REGENERATION's buyback pays at most about 1% above it (GeneHook.sol:574-577). In every falling regime tested, protocol ETH reachable from spot within 5%, 10% and 25% is 0 / 0 / 0, with the all-time low between 44.6% and 86.2% below spot.
• §2 IMMUNITY in sell-offs. RC4 places 0.3-0.8 ETH by S+7, none within 25% of spot. Price-restoring round trips create no IMMUNITY budget.
• §3 REGENERATION on the genesis curve. About 0.05-0.1 ETH of book sits within its price limit per call, so the limit binds before the call cap. Under R1 the cooldown cannot be used to lock it out.
• §4 Young markets. Near launch, 150 ETH of buys funds about 0.23 ETH of bids. The part of the revenue metric not funded by net buying sizes the churn tier, so those fees can still be committed as Permanent Mass, within the shared epoch bid cap and the ETH reserve (GeneHook.sol:526-539).
• §5 Positive "assisted" cells. 0 SELFFUNDED and 0 TRANSFER cells across 53,929 matched rows. Positive "assisted" cells exist: up to +1.03 ETH, and +116 / +14.45 ETH in the intra-block-wick families 6 and 8. In each, the protocol ends above its matched counterfactual, and third-party traders in the harness pay the attacker's extra.
• §6 Coverage. 228 cells cannot execute; the dense 50-tick pump sweep was not run; the grid maxima are observed bounds.
• §7 Carried from RC3. An epoch with no flow places no ETH in the next epoch (asks from geneReserve are not budgeted, GeneHook.sol:541-543); with more than 8 pending epochs, ETH placement waits for evolve(); the first metabolize() needs a prior evolve(); epoch-dependent views update at the new epoch's first touch; a launcher with code is accepted on chain; route discovery needs a live pool.

#Threat model

Only entries valid for the RC4 code are listed. Earlier designs are superseded and not repeated here.

#Verification

Anyone can check a deployment against the frozen source; the full procedure, including the steps that need an address after deployment, is in verify the deployment. The committed genome hash is:

0x39c130f616c32abfb40f8ab51eb54544cffd3e0d99602c71dc336bc8083c36ae

The frozen bytecode hashes to compare against include the GeneHook runtime with immutables zeroed: 23,389 bytes, sha256 17e1418e1ec5689bcdce02aeec08aeaf89aba182136a917d728cd854e084b4d4. Each gene expression carries an evidence hash that can be recomputed from stored epoch records: verify evidence hashes.

#Evidence

Counts from the RC4 internal gate.

How a matrix cell is classified. "Assisted" is the attacker's P&L with the protocol acting, minus the matched PURE run in which the protocol only evolves. NONTRANSFER: the protocol ends no worse than in PURE, so the attacker's extra came from third parties. SELFFUNDED: only the attacker's own flow funded the budgets, and the gain is no more than the fees paid. TRANSFER: anything else; this is the blocking class.

Cases that cannot execute. Two figures are reported, in different units:

• 228 cells (known limitations §6): high-wash churn cells at 5,000 and 20,000 ETH/day that buy the pool's entire remaining GENE and fail with PriceLimitAlreadyExceeded. They are excluded, not counted as passes.
• 129 forge tests in 24 files of the production matrix fail by design: 107 with PriceLimitAlreadyExceeded and 22 with SwapAmountCannotBeZero. They have no matched PURE row and are neither passes nor classified.

Test inventory:

Log integrity hashes and the re-run commands ship with the audit package (tag rc4-audit-package).

#Disclosure

No security contact or bug bounty is published yet.