# Candidate 004 — internal pre-freeze security review

Date: 2026-08-01

Scope: the exact Hub and Position source published in the Candidate 004
verification package. This is an internal engineering review, not an
independent external audit.

## Build identity

- Hub build hash: `772C71E02C4E3ECA48F833DF87081EA834480DE4731D0D566F3A903F9D46F0ED`
- Position build hash: `9D866933AA705065DCCA5E5314B1E4A981E53B72A1387AEDD1C4DC26AD9437C3`
- Published source is byte-for-byte identical to the Candidate 004 source in
  the repository.
- Published compiled artifacts are byte-for-byte identical to the fresh build.
- The current source-archive SHA-256 is published separately in
  `verification.json`, avoiding a circular checksum inside the archive itself.

## Automated controls

- Repository syntax/check suite: passed.
- JavaScript test suite: 157 passed, 0 failed.
- Tolk format and static checks: passed.
- Tolk contract suite: 47 passed, 0 failed across 8 files.
- Fresh contract compilation: passed and reproduced both published hashes.

## Authority review

- Hub-code replacement requires the fixed upgrade-controller wallet and is
  rejected after `upgradesFrozen` becomes true.
- Position-code replacement must be requested by the same upgrade controller
  through the Hub. A Position accepts replacement code only from its Hub.
- `FreezeMainnetUpgrades` is one-way in the reviewed code. There is no message
  that clears `upgradesFrozen`.
- The Guardian can pause or reopen new deposits. Freezing upgrades does not
  remove this operational role.
- Official USDT initialization is Guardian-only, verifies the derived Jetton
  wallet and can execute only once.

## Funds and payout review

- No generic administrator, Guardian, deployer or upgrade-controller
  `withdraw all`, `sweep` or arbitrary-recipient pool-transfer message exists
  in Candidate 004.
- Developer-fee payout can queue only the amount already accrued by the fixed
  5% accounting rule and always uses the fixed fee-collector recipient.
- Referral payout can queue only the balance recorded for the requesting
  wallet and always returns to that wallet.
- User, fee, referral and refund payouts share the serialized on-chain queue.
  A dispatcher supplies execution gas but cannot change the stored recipient
  or amount.
- User payouts reserve and then deduct pool accounting only after the expected
  Jetton receipt path. Queued debt remains recorded if dispatch cannot finish.
- The accounting getter requires total received to equal the sum of accounted
  pool, all fee states, refunds, pending deposits and completed payouts.

## Position review

- Only the Hub can credit a deposit to a Position.
- Only the Position owner can request claim, retry or full reinvest.
- Deposits are limited to 10–100,000 USDT and total external deposits and
  Mining Power are capped at 100,000 USDT per Position cycle.
- The rate is fixed per external deposit tier: 3%, 4% or 5% daily accounting.
- Accrual uses completed hours; normal claims have an 8-hour cooldown and a
  1 USDT minimum net amount except for the final cap-closing claim.
- Normal claims reinvest 10%; full reinvest is owner-initiated.
- Wallet payout commitment is capped at 300% of external deposits for the
  cycle. Reinvest does not increase that cap.

## Known and disclosed residual risks

- Candidate 004 is not immutable while `upgradesFrozen = false`; the upgrade
  controller can replace Hub code and request Position-code upgrades.
- The Guardian remains able to pause or reopen deposits after a future freeze.
- Contract correctness does not ensure pool solvency. Payouts depend on
  available USDT liquidity, and queued debt can remain unpaid.
- A fixed code hash proves code identity, not the absence of every defect.
- No independent external audit has been completed or claimed.

## Decision gate

The code is ready to be presented at the irreversible freeze decision gate.
Before signing that transaction, repeat the live code-hash, Position-hash,
accounting and payout-queue snapshot. Do not construct or broadcast a freeze
transaction without a new explicit owner authorization after the warning.