This page lists the audit reports published with house-markets/contracts and the limitations that the contracts’ own NatSpec documents at commit 0ebbc89a. Each limitation links to the NatSpec that states it.

Audits

The contracts repository at 0ebbc89a contains no audit report file.

Known limitations

Rebalance limits across calls

rebalanceSegments checks each call on its own (How the reference price increases). Any cumulative limit on curve changes across calls is part of the rebalance keeper’s (REBALANCER) policy, off chain. NatSpec: “V12A-M06 residual”, ReferenceCurve_v1.sol#L616-L619.

Unbacked-draw flag and ceiling

ReserveManager_v1 writes the unbacked-draw flag at initialization and changes the unbacked-draw ceiling only through executeUnbackedDrawCeilingChange. Only the ReserveManager_v1 implementation enforces the flag and the ceiling. A beacon upgrade can replace that implementation and remove the check. Beacon upgrades go through Governor_v1, whose timelock period is at least 48 hours, or 600 seconds on chain ID 412,346 (Authority). No non-upgradeable contract enforces the flag or the ceiling. When a ceiling change executes, the reserve manager records as the ceiling base the lower of the virtual collateral supply at queueing and at execution. NatSpec: “Accepted residual” and “V12A-M02 residual”, ReserveManager_v1.sol#L134-L169.

Pending elevation payments

A splitter records value pending for its elevation treasury share against the destination address it was offered to (Fees and routing). If that destination never pulls, for example a contract without fetchFunds or a treasury whose Safe is lost, the value stays reserved on the splitter. No function moves pending value to another address. The NatSpec names an off-chain admission review of each elevation destination as the control for this case. NatSpec: “V12A-M09 residual”, SplitterTreasury_v1.sol#L508-L514.

Freeze guardian

MarketFreezeGuardian_v1 lists these residuals (Authority):
  • The freeze check sits in each module. A module beacon upgrade can remove that check. The guardian’s own rules do not change.
  • The recovery Safe can replace lost authorities after the recovery delay.
  • An address that controls the emergency Safe can freeze every market whose guardian lists that Safe, with one call per market.
  • Time-based logic keeps running during a freeze. No clock pauses.
  • The guardian has no proxy and no self-destruct. If isFrozen reverts, every guarded call of the market reverts.
Within one freeze epoch, a reopen approval that was cancelled or that expired can be approved again by a relayed copy of the same signed transaction. That approval still waits the full reopen delay and needs the approval Safe’s executeReopen. NatSpec: “Residuals the design accepts”, MarketFreezeGuardian_v1.sol#L47-L56; approveReopen, IMarketFreezeGuardian_v1.sol#L240-L243.

Token compatibility

The contracts below state in @custom:token-compatibility that they are not compatible with fee-on-transfer tokens or rebasing tokens. With a fee-on-transfer token, the amount received differs from the amount the code records. With a rebasing token, balance changes from rebases are not recorded. The NatSpec limits collateral and issuance tokens to standard ERC-20 tokens. The periphery routers revert when a token pull delivers a different amount from the one requested (Connected markets). Source: house-markets/contracts at 0ebbc89a (branch integration/v12-post-qa).