Security audit

Ctrl’s launchpad contracts were reviewed by V12. The updated report contains one High-severity finding with a validity status of Fixed.

​

Audit record

Source locations in the report cover CtrlLaunchHookV2, CtrlFeeVault, protocol security documentation, and architecture documentation.

​

#228865 — Treasury Rotation Redirects Accrued Bounty Reserves

​

Description

Pre-graduation bounty fees accumulate in launch.bountyAccrued and reservedBountyEthForToken, but those records do not retain a fallback-recipient identity. When a graduation swap has no beneficiary, the hook reads the vault’s current treasury and releases the complete reserve to that address. If the vault owner changes the treasury after bounty accrual but before graduation, the fallback recipient changes for bounty value that accrued under the previous treasury.

​

Root cause

The bounty reserve stores amounts without snapshotting the treasury active at accrual. A zero-beneficiary graduation resolves its fallback recipient from mutable treasury state at release time.

​

Reported impact

A replacement treasury can become entitled to a token’s earlier pre-graduation bounty reserve. Once the reserve is released, the previous treasury has no claimable entry for that amount.

​

Proof of concept

The supplied report includes a Foundry proof of concept that:

1. accrues a bounty reserve through a generic V4 buy with empty hook data;
2. rotates the vault treasury;
3. crosses the graduation threshold with another zero-beneficiary buy; and
4. verifies that the replacement treasury receives the earlier reserve.

The export records a successful test run against the in-scope V2 ERC-1967 hook harness and local Uniswap V4 and PositionManager mocks. It was not a Robinhood mainnet fork.

​

Remediation included in the report

The report proposes snapshotting each token’s fallback bounty by the treasury active when the bounty accrues. On a zero-beneficiary graduation, each snapshotted portion is released to its original treasury. Explicit beneficiaries continue to receive the complete bounty under the existing behavior. The proposed patch affects:

• src/interfaces/ICtrlProtocol.sol
• src/CtrlFeeVault.sol
• src/v2/CtrlLaunchHookV2.sol

The report also includes validation output where the original proof-of-concept assertion fails after the patch because the previous treasury receives its historic fallback reserve.

​

How to interpret this audit

• An audit is a point-in-time review and does not guarantee the absence of vulnerabilities.
• The export does not identify its exact audited commit or audit date.
• Acknowledged records the report’s validity status; production remediation must be verified independently.
• Future code, deployments, or configuration changes may alter the security assumptions described here.