High / Finding status
Not confirmedThe updated assessment does not support High.
DeFi Audit / 2026-10-09
The assessment of 9 October 2026 separates model evidence from demonstrated operational conditions. Low is established; Medium remains conditional.
The conclusion depends on the evidenced operating state.
The assessment of 9 October 2026 separates model evidence from demonstrated operational conditions. Low is established; Medium remains conditional.
The updated assessment does not support High.
No persisted ordinary-user attack established.
No entry is documented for this filter.
The review assessed Abyss Vaults reward accounting under conditions documented on 9 October 2026. It connected the Move package lineage, historical events and operation at that time.
The isolated check established the examined relationship in the model. It did not show that a regular user could create the required operational condition and carry out a persistent attack. That unresolved prerequisite determined the rating.
The artificial balance below shows a basic control: the expected result should pass and the deliberately differing closing balance should fail. It illustrates a test property, not Abyss code or production loss.
def check_balance(opening, incoming, outgoing, closing):
values = (opening, incoming, outgoing, closing)
assert all(type(v) is int and v >= 0 for v in values)
return opening + incoming - outgoing == closing
assert check_balance(100, 20, 15, 105)
assert not check_balance(100, 20, 15, 106)
Line numbers refer to this excerpt. Choose a note to highlight its range.
The relevant module content was unchanged within the examined package lineage. Package names alone would therefore not establish different behaviour. The hash block illustrates byte comparison using invented inputs.
import hashlib
def artifact_id(content):
return hashlib.sha256(content).hexdigest()
assert artifact_id(b"model-v1") == artifact_id(b"model-v1")
assert artifact_id(b"model-v1") != artifact_id(b"model-v2")
Line numbers refer to this excerpt. Choose a note to highlight its range.
Historical events did not show that the same operational condition regularly existed at sampling time. Not every observed difference could be uniquely attributed to one cause. The model therefore separates isolated evidence from a production claim.
record = {"isolated_check": True, "production_reachability": False}
def supports_production_claim(evidence):
return evidence["isolated_check"] and evidence["production_reachability"]
assert not supports_production_claim(record)
Line numbers refer to this excerpt. Choose a note to highlight its range.
Alternative candidates were assessed separately, either rejected or classified as limited hardening questions. The updated assessment remained Low for the historical state; Medium applied only under changed economic conditions. High and Critical were not established.
Reassessment requires fresh package and operational evidence. These results date to October 2026; this report includes no fresh state review.
The links provide project context. The judgment rests on the evidence described in the audit. Review models and actual tool excerpts are labelled separately.
Abyss Vaults · GitHub ↗The 9 October state remains rated Low. Model evidence does not establish a persistent attack by regular users; High and Critical are not confirmed. Medium describes changed prerequisites, not the historical state.
Start a conversation