TW / Independent
← Research audits

DeFi Audit / 2026-10-09

Abyss Vaults: Low in the historical state

The assessment of 9 October 2026 separates model evidence from demonstrated operational conditions. Low is established; Medium remains conditional.

Scope
Vaults and reward accounting
Method
Retrospective research audit
Evidence
Version binding, local controls, operational context
Finding

Low at the snapshot. Medium only conditionally.

The conclusion depends on the evidenced operating state.

Assessment at the snapshotLowApplies to the snapshot described here.
Historical snapshot / 2026-10-09

Low at the snapshot. Medium only conditionally.

The assessment of 9 October 2026 separates model evidence from demonstrated operational conditions. Low is established; Medium remains conditional.

High / Finding status

Not confirmed

The updated assessment does not support High.

Critical / Finding status

Not confirmed

No persisted ordinary-user attack established.

Findings and counterchecks

The list also includes rejected candidates and counterchecks.

3 entries
LowReward accounting at the snapshotABY-01 / Historically evidenced
Observation
LOW · Historical snapshot. The updated assessment rates the finding Low in the state observed then. Medium applies only conditionally under changed economic circumstances; High and Critical are explicitly unsupported.
Impact
Bounded accounting impact in the historical state.
Evidence
Updated 9 October report; source evidence and non-persistent simulation.
Limit
The update supersedes the earlier stronger interpretation.
Next review step
Bind package lineage and current operational state before reassessment.
MediumChanged prerequisitesABY-02 / Conditional / verify assumptions
Observation
Medium is a conditional structural assessment, not the historical snapshot rating.
Impact
Changed economic or operational prerequisites can change the assessment.
Evidence
Explicit limitation in the updated assessment.
Limit
No claim about present exploitability.
Next review step
Establish new prerequisites rather than importing them from the model.
CriticalNo upgrade to High or CriticalABY-03 / Not confirmed
Observation
HIGH / CRITICAL · Not established. Stronger technical reproduction did not change the severity rating. No successful persisted ordinary-user attack was demonstrated.
Impact
No supported upgrade from the stronger model.
Evidence
Historical reachability and prerequisite checks.
Limit
Simulation is not a successful persisted transaction.
Next review step
Keep impact and reachability as separate evidence obligations.

Question and review date

The review assessed Abyss Vaults reward accounting under conditions documented on 9 October 2026. It connected the Move package lineage, historical events and operation at that time.

What the model evidence establishes

The isolated check established the examined relationship in the model. It did not show that a regular user could create the required operational condition and carry out a persistent attack. That unresolved prerequisite determined the rating.

Balance check and countercheck

The artificial balance below shows a basic control: the expected result should pass and the deliberately differing closing balance should fail. It illustrates a test property, not Abyss code or production loss.

pythonCheck integer accounting · illustrative defensive model, not vendor codeDefensive model
def check_balance(opening, incoming, outgoing, closing):
    values = (opening, incoming, outgoing, closing)
    assert all(type(v) is int and v >= 0 for v in values)
    return opening + incoming - outgoing == closing

assert check_balance(100, 20, 15, 105)
assert not check_balance(100, 20, 15, 106)
Read the code

Interactive review model

Balance model

Invented integer units, not token balances.

Local example model. No connection to a protocol, sample or live service.

Version comparison

The relevant module content was unchanged within the examined package lineage. Package names alone would therefore not establish different behaviour. The hash block illustrates byte comparison using invented inputs.

pythonIdentify a model artifact · illustrative defensive model, not vendor codeDefensive model
import hashlib

def artifact_id(content):
    return hashlib.sha256(content).hexdigest()

assert artifact_id(b"model-v1") == artifact_id(b"model-v1")
assert artifact_id(b"model-v1") != artifact_id(b"model-v2")
Read the code

Interactive review model

Check source binding

Different revisions do not support an identical conclusion.

Local example model. No connection to a protocol, sample or live service.

History and activity at sampling time

Historical events did not show that the same operational condition regularly existed at sampling time. Not every observed difference could be uniquely attributed to one cause. The model therefore separates isolated evidence from a production claim.

pythonKeep evidence levels separate · illustrative defensive model, not vendor codeDefensive model
record = {"isolated_check": True, "production_reachability": False}

def supports_production_claim(evidence):
    return evidence["isolated_check"] and evidence["production_reachability"]

assert not supports_production_claim(record)
Read the code

Interactive review model

Gross versus net

Simplified countercheck with fictional fees.

Starting value 100. Two modelled steps. No real market prices or execution costs.

Local example model. No connection to a protocol, sample or live service.

Alternatives and rating

Alternative candidates were assessed separately, either rejected or classified as limited hardening questions. The updated assessment remained Low for the historical state; Medium applied only under changed economic conditions. High and Critical were not established.

What reassessment requires

Reassessment requires fresh package and operational evidence. These results date to October 2026; this report includes no fresh state review.

Findings at a glance

  • What the model evidence establishes
  • Balance check and countercheck
  • Version comparison

Review limits

  • As of 9 October 2026. Model evidence and operational reach are assessed separately.

References

The links provide project context. The judgment rests on the evidence described in the audit. Review models and actual tool excerpts are labelled separately.

Abyss Vaults · GitHub ↗
Final assessment

Conclusion

Conclusion: Low, Medium only under changed conditions

The 9 October state remains rated Low. Model evidence does not establish a persistent attack by regular users; High and Critical are not confirmed. Medium describes changed prerequisites, not the historical state.

Next steps

  • Check the current package and operational conditions.
  • Base reassessment only on newly evidenced prerequisites.
Basis of this judgmentAssessment of the documented state dated 2026-10-09. No fresh validation.
Vaults and reward accounting
← All research audits

Start a conversation

Discuss your project.

Start a conversation