Security Audits

The six Zxo contracts on PulseChain are exact-match verified on Sourcify and built from the audited source. Nine pools launched in the enforced order on LibertySwap, and a live reward claim was reproduced to the last wei. The open items are operational, including a single-wallet owner.

First review of the live deployment, up from 8.5/10. The five contracts on Arbitrum One are exact-match verified and built from the reviewed source, and a live reward claim was reproduced to the last wei. One accepted item was added: the owner is a single wallet until the planned multisig.

The five Zxo contracts on Arbitrum One are exact-match verified on Sourcify and differ from the reviewed files only in the license header, library import and chain settings. 58 transactions were reviewed, all the team's own mainnet testing. Three operational items remain open.

Remediation pass, up from 6.6/10 in the original review. Both High issues and every fixable Medium are resolved, and the pool health gate now also requires a 15-minute TWAP in range. The remaining Medium items are recorded as accepted design trade-offs.

Independent line-level review ahead of mainnet. No High or Critical issues were opened, and no path was found to seize another user's staked position. Every Medium and Low item was reviewed with the team and accepted or marked intended by design. Source-only review.

Follow-up pass that closes every remaining informational item and hardens the build tooling. The team confirmed the verification input reproduces the deployed bytecode. No open findings of any severity remain.

Full review of the farming contract, its libraries, the V3 deployer and the treasury. Every High and Medium finding that could be fixed in code is resolved, and no path was found that lets anyone take user principal. Two Medium items are accepted design trade-offs.