Audit

The historical findings below do not cover CreditTopUp, the finalized-payment settlement worker, or the topup database migration. Independent review of the new payment flow is pending.

AgentPass has an internal self-audit of the legacy contracts. The single-membership upgrade and new credit ledger are not covered by that historical report. An independent external audit is not complete.

Status

The self-audit was written by the team that wrote the contracts. It is not independent and does not replace an external review.

Historical self-audit scope

• AgentPass
• PassRenderer
• RewardDistributor
• TaxSplitter
• AirdropVesting
• AgentPassProxy
• ReentrancyGuardUpgradeable

Out of scope:

• The four.meme token contract.
• Safe multisig.
• Frontend, API, indexer, and AI credit ledger.
• Agent ID registry, USDT, Chainlink, PancakeSwap, and WBNB.

Historical test results

The single-membership verification on 3 November recorded 243 passing tests: 203 Solidity and 40 Node.js tests, with 5 fork tests skipped in the default run. Storage validation passed for AgentPass to AgentPassSingle. A local testnet fork rehearsal and the existing-proxy testnet upgrade preserved the original NFT, owner, weight, and reward balance. Two further testnet mints confirmed repeated minting and distinct $5 credit grants. These are historical results, not an external security audit.

Current topup verification

The 5 November verification recorded 254 passing contract-suite tests: 214 Solidity and 40 Node.js tests. Five historical RPC fork tests were skipped in the default run. Credit ledger, inference, finalized-payment settlement, and local end-to-end checks also passed in the topup release record.

The active testnet deployment was verified with BNB and mock USDT payments, exact permanent credit grants, and replay/restart checks. Migration retained existing balances and legacy claim records. The repository evidence is in docs/28-onchain-topups.md and docs/30-testnet-treasury-redeployment.md. These checks do not extend the historical self-audit's coverage or replace independent review.

Self-audit findings

Most important findings

H-01: Airdrop token transfer tax

The airdrop token is a four.meme TaxToken. If it taxes ordinary transfers from AirdropVesting, users receive less than their allocation while the contract records the gross amount.

This must be verified before mainnet. Possible fixes:

• Whitelist the vesting contract in the token.
• Use a non-tax token for the airdrop.
• Credit only the net amount received.

M-01: Just-in-time mint dilution

A wallet can mint just before a reward deposit and capture a share of that deposit. Existing holders are diluted.

Possible fixes:

• Snapshot total weight per epoch.
• Use a time-weighted weight.
• Deposit more frequently with smaller amounts.

M-03: Upgrade validation gap

The Hardhat validation covers AgentPass and RewardDistributor. TaxSplitter and AirdropVesting are covered by Foundry tests but not by the automated validation script.

External audit

The external audit is not started. The audit package includes:

• Contracts.
• Tests.
• Deploy scripts.
• Architecture and threat model.
• Testnet rehearsal.
• Self-audit.
• Request for proposal.

The full self-audit report is available to auditors on request.

Recommendation

Do not deploy to mainnet until:

• H-01 is resolved or proven not to apply.
• M-01 has an accepted mitigation.
• M-03 is fixed.
• An independent audit is complete.
• Critical and high findings are fixed and retested.