DOC-06 · SECURITY

Audit Readiness

PRE-ENGAGEMENT PACK · TWO AUDITS · CODE FREEZE HASH PENDING

Two independent audits stand between this code and the MARC launch gate. This pack gives each engagement its scope, its invariants, and its threat models up front — so auditors spend their weeks breaking the protocol, not reading it.

01Engagements

#	SCOPE	CONTRACTS	EST. LOC	RISK TIER	WEEKS
A	Capital contracts	Escrow · SettlementBatcher · MARC token + VestingVault	≈ 1,080	CRITICAL	3 + 2 remediation
B	Consensus contracts	VerifierRegistry · QuorumElection · SlashExecutor · EmissionsDistributor	≈ 1,200	CRITICAL	3 + 2 remediation

Both engagements audit against commit freeze — no scope drift mid-review. Frozen hash recorded on-chain at engagement start; any post-freeze change reopens that contract's review.

02Escrow — invariants & threat model

Holds every task's USDC until proof or ruling. Immutable, no upgrade path, no admin withdrawal. This is the contract users actually trust with capital, so its invariant list is short and absolute:

INVARIANT	MUST HOLD	TEST
I-E1	Funds move only on matched quorum proof, or signed ruling inside fraud window	invariant test: no code path bypasses both
I-E2	Σ escrowed per-task balances == contract USDC balance at all times	stateful fuzz: random op sequences
I-E3	settle() is idempotent — double-settle pays once	replay fuzz
I-E4	No role, key, or pause can freeze escrow beyond one ruler signature + window	admin-key simulation: zero authority paths

ATTACK	PRECONDITION	IMPACT	MITIGATION	STATUS
Reentrancy on settle hook	attacker-controlled token callback	double-release	CEI order + nonReentrant; USDC has no hooks	COVERED
Ruling replay across rails	same domain on two chains	double refund on second rail	chainId in EIP-712 domain; per-rail nullifiers	COVERED
Fraud-window timestamp squeeze	miner-aligned block times	ruling after honest window	window measured in blocks, not seconds	COVERED
Commit griefing	bond-free commits	escrow lock DoS	commit bond forfeited on TTL	OPEN — bond rate under calib.
Fee rounding accumulation	many tiny tasks	dust accounting drift vs I-E2	floor-fee minimum 0.01 USDC	COVERED

03Settlement batcher

Posts Merkle roots every 30s; receipts carry inclusion proofs. Batching exists to amortize L1 fees, not to custody anything — the failure mode is withholding, not theft:

ATTACK	PRECONDITION	IMPACT	MITIGATION	STATUS
Root forgery by compromised batcher	batcher hot key leaked	false receipts anchored	2-of-3 multisig + epoch key rotation; slashable bond	COVERED
Withholding / liveness failure	batcher offline	anchoring stalls	anyone may force-batch after 2 missed windows (permissionless)	COVERED
MEV on batch inclusion	public mempool	root front-running	private relay; anchor is append-only so front-run gains nothing	COVERED

EXCLUSION

The USDC token contract itself is out of scope — including its own upgradeability risk, which the threat register tracks separately as an external dependency assumption.

04MARC token & vesting

Fixed supply, no mint authority, vesting locked to network epochs — not wall clocks — per the tokenomics design:

INVARIANT	TEST
I-T1 totalSupply == 1e9 forever; mint() does not exist in bytecode	bytecode grep + symbolic exec
I-T2 vested(t) is monotone non-decreasing; epochs never tick backwards	epoch oracle fuzz
I-T3 paused network ⇒ paused vesting; no insider accrues stalled time	epoch-freeze state machine test

ATTACK	IMPACT	MITIGATION	STATUS
Epoch oracle manipulation to fast-forward cliffs	early insider unlock	oracle = epoch counter on settlement rail, not gov-settable	COVERED
approve/transferFrom race (ERC-20 classic)	allowance double-spend	OZ ERC20 with increaseAllowance guidance in SDK	COVERED
Snapshot timing at epoch boundary	claim twice on boundary reorg	claims settle at epoch+1 state	OPEN — formal boundary proof pending

05Quorum election

The election decides who verifies — bias here is bias everywhere. Determinism is the defense: the same seed must yield the same quorum on every recompute:

ELECTION — DETERMINISM SPEC (AUDITOR-REPRODUCIBLE)UTF-8

seed     = keccak(blockhash(epoch_start - 2))          // past, not future
score(i) = bond_i × acc_i² × (0.75 + u_i × 0.5)         // u_i from seed
quorum   = top-3 by score, bond ≥ 25,000, not jailed
 
caps:    weight_ratio(quorum) ≤ 67%                     // whale capture bound
jail:    open challenge ⇒ cannot unbond or re-elect
 
fixtures: 40 election scenarios w/ expected quorums
          shipped in /test/fixtures/elections.json

ATTACK	PRECONDITION	IMPACT	MITIGATION	STATUS
Validator blockhash bias	rail validator manipulates seed block	steer quorum selection	past-block seed + commit-reveal fallback	COVERED
Sybil grinding pre-epoch	cheap identities in candidate pool	crowd out honest seats	bond floor + accuracy decays to 0 on new identity	COVERED
Weight overflow / rounding steer	huge bond input	election capture via arithmetic	mulDiv 512-bit math; weight cap 67%	OPEN — formal check pending

06Slash executor

ATTACK	IMPACT	MITIGATION	STATUS
Evidence replay — same proof, double slash	verifier bled twice	nullifier per evidence hash; consumed on first use	COVERED
Challenge griefing	challenges spam-locked to stall unbonds	challenger posts bond, slashed on frivolous proof	COVERED
Escalating slash DoS	epoch where many proofs arrive	slash cap per epoch; FIFO challenge queue with timeouts	OPEN — cap value under calib.
False-evidence by compromised verifier	honest voter burned	challenged vote re-executed in fresh quorum before burning	COVERED

KNOWN RESIDUAL RISK

Collusion detection is heuristic (linked stake signatures + voting correlation). A perfect colluder leaves no trace; the mitigation is economic (100% bond at risk) plus challenges by any watcher. Auditors should attack this explicitly — it is the protocol's hardest problem.

07Cross-contract systemic threats

SURFACE	EXPOSURE	POSITION
Multi-rail replay	tasks and rulings replicated across rails	domain-separated chainIds in every signature
USDC upgradeability	proxy changes under escrow	external dependency in threat register; custody never relies on USDC internals
MEV on verdict transactions	ruling params visible pre-inclusion	signed rulings are payload-bound; front-running gains nothing
Governance floor capture	MARC holders steer fee/quorum params	phase gates: foundation till V1.0, bounded vote, timelock 7d
Deterministic-sandbox divergence	spec executes differently in verify than in work	same WASM runtime, pinned version hash, frozen syscall table

08Process, rubric & remediation SLA

SEVERITY	DEFINITION	EXAMPLE HERE	SLA
CRITICAL	loss of user funds or escrow invariants broken	I-E1/I-E2 violation	fix + re-audit before any deployment
HIGH	network-wide liveness or trust compromise	election capture, slash-grief	fix before gate #3 completes
MEDIUM	bounded loss or degraded correctness	rounding drift, boundary snapshot	fix before V0.3
LOW / INFO	hardening, clarity, gas	event indexing, natspec	rolling backlog

Coverage targets: 100% line coverage on Escrow and SlashExecutor (invariant-driven Foundry suite), ≥ 95% on all other contracts, plus 40 deterministic election fixtures and 12 slashing scenarios shipped as reproducible fixtures inside each engagement's repo.

ENGAGEMENT TIMELINEUTF-8

W1  ENG-A kickoff — capital contracts, freeze hash anchored
W3  ENG-A report — triage within 48h
W4  remediation window A (+ re-audit of patches)
W6  ENG-B kickoff — consensus contracts
W8  ENG-B report — triage within 48h
W9  remediation window B → launch gate #3 evaluation
    rule: no gate #3 until every CRITICAL and HIGH is closed

AUDIT CONTACT: HELLO@MACHINARC.COM · REPORTS PUBLISHED IN FULL — VERIFIERS DESERVE TO READ WHAT THEY BOND AGAINST.

PREVTokenomics NEXTManifesto

MACHINARC LABS · DOCS V0.2 · ERRATA VIA GITHUB