High / Finding status
Not confirmedNo ordinary-user High asset loss confirmed.
DeFi Audit / 2026-10-06
Low/Medium for the historical accounting observation; a separate Critical candidate was rejected. The report keeps the two dispositions separate.
The reviewed hypothesis did not support a confirmed Critical.
Low/Medium for the historical accounting observation; a separate Critical candidate was rejected. The report keeps the two dispositions separate.
No ordinary-user High asset loss confirmed.
A separately examined Critical candidate was falsified.
No entry is documented for this filter.
Documentation of 6 October 2026 mapped deployed Clarity code on Stacks separately from historical repository content. Independent counterreview examined a bounded slice, not the whole Bitflow offering.
Economic review considered the direction and beneficiary of the accounting difference. A different result alone did not establish loss of third-party reserves. Accounting effect and alleged asset loss required separate evidence.
The example separates a fee assumption from a net amount using subtraction. Its values are invented and it is not a Bitflow formula. It illustrates why comparing two numbers requires their calculation assumptions.
def net_amount(gross, fee):
assert 0 <= fee <= gross
return gross - fee
assert net_amount(100, 2) == 98
assert net_amount(100, 0) == 100
Line numbers refer to this excerpt. Choose a note to highlight its range.
The second fixture changes allocation while preserving the total. Within the model it rejects the inference that every differing net amount necessarily means reserve loss. Historical counterreview examined actual artifacts; this example does not reproduce the private mechanism.
expected = {"user": 98, "beneficiary": 2}
observed = {"user": 100, "beneficiary": 0}
assert sum(expected.values()) == sum(observed.values())
assert expected != observed
# Allocation changed; a reserve-loss claim needs separate evidence.
Line numbers refer to this excerpt. Choose a note to highlight its range.
Source mapping kept deployed variants distinct. The hash comparison illustrates that principle without asserting a real contract count. A repository name did not replace mapping the code actually reviewed.
import hashlib
artifacts = [b"fixture-a", b"fixture-a", b"fixture-b"]
family_ids = {hashlib.sha256(x).hexdigest() for x in artifacts}
assert len(family_ids) == 2
Line numbers refer to this excerpt. Choose a note to highlight its range.
The historical accounting observation received a conditional Low/Medium classification. A separate candidate for Critical reserve loss was rejected. Those dispositions must not be combined into a confirmed High or Critical finding.
Fresh economic assessment requires current sources and state assumptions. These results concern the historical examined slices. This report did not assess subsequent remediation or current security of other Bitflow components.
The links provide project context. The judgment rests on the evidence described in the audit. Review models and actual tool excerpts are labelled separately.
Bitflow · Documentation ↗Bitflow · GitHub ↗The historical accounting observation received a conditional Low/Medium rating. The separate Critical candidate was rejected. This does not establish High/Critical reserve loss.
Start a conversation