# CWA-01...CWA-82 Remediation Register

**Updated:** 2026-10-05
**Repository baseline:** `a24dbe89c503fb34df1997f041be558bde0e8406`

This is the authoritative public status register for the seven Collateral Web3 Open
Audits reports. Publishing a finding does not mean it has been remediated. A finding
moves to **Fixed and verified** only after its change is integrated and the required
verification evidence passes. 56 findings currently meet that standard.

## Status Summary

| Disposition | Count | Meaning |
| --- | ---: | --- |
| Fixed and verified | 56 | A remediation is merged and covered by current verification evidence. |
| Governance or owner gated | 8 | The next action requires governance, a repository owner setting, key custody work or a future contract version. |
| Accepted or monitored | 2 | The condition is explicitly accepted for the current dormant configuration and must be reviewed before activation or redeployment. |
| Open actionable | 5 | Repository, documentation or operations work remains and can be handled without an on-chain governance action. |
| Informational, no action | 11 | The item records methodology, context or an optional improvement and has no required remediation. |

| Severity | Count |
| --- | ---: |
| Critical | 0 |
| High | 3 |
| Medium | 29 |
| Low | 34 |
| Informational | 16 |

The corrected aggregate is **0 Critical / 3 High / 29 Medium / 34 Low / 16 Informational**.
The consolidated PDF contains an explicit editorial note explaining the correction to
the original summary arithmetic; no individual finding text or severity label changed.

- [Download the consolidated CWA report (PDF)](IFR_Protocol_CWA_Consolidated_Audit_Report_2026-09-14.pdf)
- PDF SHA-256: `c174d7dccd1233e45d79fc09f8974470c19b12b6346690f583484c6764a3605d`
- Corrected contract deep-audit SHA-256: `ff16962322b59ea596eeacee48955e1e60918edb7837da6cc5cc68cc357588a3`
- Corrected content-coherence-audit SHA-256: `78c884bd1f79c7cb6f31f35100420324c6ea864558b1ea41e33ac21370ee3902`
- [Audit series index](README.md)
- [Current functionality and test evidence](../CURRENT_FUNCTIONALITY_STATUS.md)

## Canonical Test Evidence

These are the current repository evidence counts referenced by the status surfaces. They
do not convert an open audit finding into a verified fix.
Contract evidence: CI run `37998031908`, 9 October 2026, source
`d095ff4b73ea78466b3aa45ff10e7621f5d2eb57`: 693 + 7 FeeRouter parity tests = 700;
the separate Mocha serializer selfcheck is excluded. Browser counts are retained T-274
evidence (6 October 2026, `eead5086`), not a fresh browser run.

| Suite | Current evidence |
| --- | ---: |
| Smart contracts | 700/700 |
| Generator Engine | 30/30 |
| IFR SDK | 36/36 |
| Landing/Wiki browser | 26/26 |
| Web3 browser | 85/85 |
| Benefits physical device/wallet matrix | 1/10 |

## Finding-by-Finding Status

| Finding | Severity | Disposition | Owner / gate | Next action | Verification required | Source |
| --- | --- | --- | --- | --- | --- | --- |
| **CWA-01** LendingVault activation price risk | High | Governance or owner gated | Governance and contract engineering | Keep borrowing disabled; specify and audit a bounded, fresh price path with borrow caps and emergency controls before activation. | Oracle and cap regression tests, independent review, governed activation and post-execution chain checks. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-02** FeeRouterV1 IFR fees are stranded | Medium | Fixed and verified | Governance and contract engineering | Keep InfernoToken.poolFeeReceiver on the recoverable BuybackController. The IFR held by FeeRouterV1 was recovered to the Treasury Safe (CWA-02 batch); disclose it as unallocated Treasury IFR, not as lost and not as a budget. Permanently lost IFR is only CV-01. | Governance proposal #21 setPoolFeeReceiver(BuybackController) executed by the Treasury Safe on 2026-10-05 07:25:23 UTC, block 26124660, tx 0x8de48b47dfa8f17b631fb744bc4deef9bbb68271f8b700b422cdd3abb739ca26; read-only check: InfernoToken.poolFeeReceiver() = BuybackController 0x1e0547D50005A4Af66AbD5e6915ebfAA2d711F7c. New IFR pool fees are recoverable through governed BuybackController.withdrawIFR. The 734,545.074097347 IFR held by FeeRouterV1 as of block 26124660 (no sweep function) were recovered to the Treasury Safe on 2026-10-07 23:28:23 UTC by one governed Treasury Safe batch (Proposal #22, FeeRouterV1.swapWithFee, Proposal #23), block 26143797, tx 0x5dc641c7414f4d0f83cd53fbf2dce782cb9bbffd8393ab8246f3ac47932e2881 (status 1; IFR Transfer FeeRouterV1 -> Treasury Safe 734545074097347 raw); read-only check at block 26151369: FeeRouterV1 IFR balance 0, Treasury Safe 734,545.074097347 IFR (unallocated). Permanently lost IFR is now only CV-01 (26,418,467.994338353 IFR). Proposal generator and fork proof: scripts/pool-fee-receiver-proposal.cjs, scripts/test-pool-fee-receiver-proposal.cjs, test/fork/PoolFeeReceiverFork.test.js (block 26119897); runbook docs/POOL_FEE_RECEIVER.md. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-03** CommitmentVault price-conditioned locks cannot unlock | Medium | Governance or owner gated | Governance and contract engineering | Keep price-conditioned locks disabled and design a lock guard or governed rescue path for a future version. | Negative lock tests, recovery tests, independent review and governed deployment evidence. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-04** Points SIWE verification lacks domain binding | Medium | Fixed and verified | Points backend | Keep SIWE domain, URI origin, configured chain and server-issued nonce checks coupled as authentication evolves. | PR #107 / a8e80c7e; Points 54/54; exact-head and exact-main CI; live Points health after the fail-closed deployment. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-05** Points lock proof defaults to Sepolia | Medium | Fixed and verified | Points backend | Keep production pinned to Ethereum mainnet, the server-managed HTTPS RPC and the canonical IFRLock, with the startup bytecode probe enabled. | PR #107 / a8e80c7e; fail-closed configuration tests; live chain 1 and canonical IFRLock bytecode probe; Points env mode 0600. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-06** Voucher signer overlaps a Safe owner key | Medium | Fixed and verified | Key custody owner | Keep the voucher signer a dedicated least-privilege key outside the Safe signer set. Based on the reviewed backend configuration, no Safe-owner key rotation is required by this voucher-signer change. Owner confirmation that the key was not otherwise exposed remains pending. | Governance proposal #18 FeeRouterV1.setVoucherSigner(0x790D99c320dafA03d83bEa152178A6523b49CA0d) executed by the Treasury Safe on 2026-10-05 07:17:47 UTC, block 26124623, tx 0x40a856b9f994a17390c042abe851c5ff99ca86289eb86316eb119f465cd89679; read-only check: FeeRouterV1.voucherSigner() = 0x790D99c320dafA03d83bEa152178A6523b49CA0d. Mainnet execution was performed by the Safe signers. Backend activation was performed by owner-authorized automation, according to the operator report. The points backend activated the same signer in the same minute (reported active signer = on-chain signer) through scripts/ops/rotate-voucher-signer.sh activate. Tests: scripts/test-voucher-signer-rotation-proposal.cjs, scripts/test-rotate-voucher-signer.sh, test/fork/VoucherSignerRotationFork.test.js; runbook docs/VOUCHER_SIGNER_ROTATION.md. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-07** Branch protection does not enforce advertised gates | Medium | Governance or owner gated | Repository owner | Require the canonical CI checks on main and enable enforcement for administrators. | Read-only branch-protection API evidence showing required checks and admin enforcement. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-08** LendingVault pre-activation configuration gaps | Low | Governance or owner gated | Governance and future contract engineering | Set a valid fee receiver and address collateral-return and loan-expiry behavior before any borrow activation or redeploy. | Full lending lifecycle, expiry, receiver and hostile-recipient regression tests. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-09** Guardian powers are concentrated in one EOA | Low | Fixed and verified | Governance and key custody owner | Keep every mutable guardian on the Treasury Safe; the immutable BuybackVault and BuybackController guardian (pause only, no fund movement) stays the deployer EOA until a redeployment. | Guardian migration complete (docs/GUARDIAN_MIGRATION.md): IFRLock, PartnerVault and Vesting moved in blocks 26108025-26108029, Governance via Treasury Safe tx in block 26108062, and Governance proposals #19/#20 setGuardian(Treasury Safe) on LiquidityReserve 0xdc0309804803b3a105154f6073061e3185018f64 and BurnReserve 0xaa1496133b6c274190a2113410b501c5802b6fcf executed in one Treasury Safe tx on 2026-10-05 07:22:47 UTC, block 26124647, tx 0xa432f061d42d3cbf306e44cf27394da5f70443d8d765cb1cfea66e17be19df27. Read-only check 2026-10-05: guardian() of Governance, IFRLock, PartnerVault, Vesting, LiquidityReserve and BurnReserve = Treasury Safe 0x5ad6193eD6E1e31ed10977E73e3B609AcBfEcE3b. Tests: scripts/test-guardian-migration-proposal.cjs; fork proofs test/fork/GuardianMigrationFork.test.js (block 26108024) and test/fork/GuardianQueuedExecutionFork.test.js (block 26119897). Operational evidence: scripts/deploy-mainnet-continue.js::main rejects Sepolia and, on chain 1, aborts unless TREASURY_ADDRESS, COMMUNITY_ADDRESS, TEAM_BENEFICIARY, VOUCHER_SIGNER_ADDRESS and GUARDIAN_ADDRESS are set and differ from the deployer (scripts/test-deploy-mainnet-continue-gate.cjs); update-stats.yml and post-deploy.yml no longer receive a deployer private key (scripts/test-workflow-permissions.cjs). | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-10** Web3 host lacks hardening headers | Low | Fixed and verified | Web3 operations | Keep the repository header contract synchronized with Web3 resource changes and repeat serving-layer probes after each deployment. | PR #109 head b4dc9b95 passed 23/23 checks; main cbaf4bcb passed seven runs including Pages; live nginx, root, app, asset and health header probes; browser page, wallet-chooser and Copilot-embed smoke. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-11** Copilot health endpoint discloses configuration | Low | Fixed and verified | AI Copilot backend | Preserve the exact minimal public health shape while keeping detailed diagnostics private. | PR #109 head b4dc9b95 passed 23/23 checks; main cbaf4bcb passed seven runs including Pages; spawned response-shape regression; live public response exactly {"status":"ok"} and healthy container. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-12** Copilot aggregate cost guard is warn-only | Low | Fixed and verified | AI Copilot backend | Keep the fail-closed aggregate daily budget enforced with its observable UTC reset as Copilot models and pricing evolve. | PR #111 head 1df488cc merged as main 5000417f with exact-main CI green; fail-closed daily budget tests cover exhaustion, concurrency, UTC reset, release/settlement and confirm no model call runs once the budget is closed. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-13** Bootstrap vote accepts unsigned wallet identity | Low | Fixed and verified | AI Copilot backend | Keep the historical vote write permanently retired; any future voting requires a newly reviewed signed design. | PR #112 head e86f6fcc merged as main 2c68ca98; the retired Bootstrap POST is fail-closed and the live exact-main deployment returns HTTP 410 with Cache-Control no-store and writes nothing. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-14** Voucher issuance does not redeem points and validation leaks wallet identity | Low | Fixed and verified | Points backend | Keep the released remediation in place; re-verify after any change to this service. | `apps/points-backend/src/__tests__/points.test.ts` (point consumption on issuance, rollback on signer failure, single issuance under concurrency, below-threshold rejection, wallet-free public validation) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): points-backend RELEASE_SHA a24dbe89, `https://points-api.ifrunit.tech/health` 200. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-15** LiquidityReserve cap is governance-mutable | Low | Fixed and verified | Protocol documentation | Keep the LiquidityReserve cap described as a Governance parameter (setMaxWithdrawPerPeriod, 48h timelock) with only the period immutable. | PR #124 merged as main e4a1a75f; README, llms.txt, Security/Contracts Wiki and TRANSPARENCY.md are asserted against LiquidityReserve.sol in `npm run test:cwa-content` (Docs Validator). | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-16** Reserve contracts use single-step ownership transfer | Low | Governance or owner gated | Future contract engineering and Governance | Use two-step ownership transfer in future contract versions and migration plans. | Ownership transfer acceptance and cancellation tests before deployment. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-17** LP Reserve Safe is not fee exempt | Low | Governance or owner gated | Governance | Decide whether LP operations should remain taxed or receive a narrowly documented exemption. | Governance rationale, proposal simulation and post-execution fee behavior check. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-18** FeeRouter zero-address setters and dead maxUses field | Low | Accepted or monitored | Future contract engineering | Keep documented for the dormant V1 path and reassess before any FeeRouter replacement or voucher activation. | Future version must add zero-address and voucher-use regression coverage. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-19** Dormant buyback path hardening notes | Low | Accepted or monitored | Future contract engineering | Reassess reentrancy, ERC-20 return handling and MEV controls before funding or replacing the dormant path. | Future funded-path adversarial tests and independent review. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-20** Documentation drift cluster | Informational | Fixed and verified | Protocol documentation | Keep component, Safe, test-count, coverage, tier, vesting, rate, custody and fee-exemption statements aligned with canonical sources whenever those sources change. | PR #125 merged as main 4bb4b383 (component, Safe, test-count, coverage and app-inventory claims, `npm run test:docs-truth`); PR #124 merged as main e4a1a75f (vesting start, PartnerVault rewardBps/throttle, Community Safe custody, fee-exempt table and burn qualifier chain-read at block 26,065,893, `npm run test:cwa-content`); tiers covered by the CWA-77 shared-tier configuration. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-21** License statements are inconsistent | Informational | Fixed and verified | Repository owner | Keep new source files on SPDX MIT and public copyright wording aligned with LICENSE. | Owner decision 2026-09-30: MIT. Root LICENSE (MIT) added; README and the Landing/Web3 footers reference it instead of "All rights reserved"; every Solidity source declares SPDX MIT. Passed `npm run test:license-privacy`. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-22** Security reporting process gaps | Informational | Fixed and verified | Repository security operations | Keep security.txt, private reporting guidance and the no-bounty status current and truthful. | PR #124 merged as main e4a1a75f; RFC 9116 docs/.well-known/security.txt (advisory contact, no bounty promise) validated by `npm run test:security-reporting` (Docs Validator). | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-23** Mainnet deployment manifest is incomplete | Informational | Fixed and verified | Deployment documentation | Keep deployments/mainnet.json in lockstep with the DEPLOYMENTS.md Mainnet table; unknown provenance stays explicitly null. | PR #124 merged as main e4a1a75f; deployments/mainnet.json lists all 14 Mainnet contracts and `npm run test:cwa-content` asserts address, source, ABI and null-provenance parity with docs/DEPLOYMENTS.md. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-24** Copilot trusts hourly live Wiki HTML | Informational | Fixed and verified | AI Copilot backend | Keep the bounded trusted-content policy and the reviewable last-known-good knowledge snapshot as Wiki sources change. | PR #111 head 1df488cc merged as main 5000417f with exact-main CI green; bounded live-Wiki policy tests cover allowed origins, redirect and lookalike rejection, stale-if-error, timeout and cache retention. | [Report](CWA_IFR_Protocol_Audit_2026-09-14.md) |
| **CWA-25** Mainnet Governance predates the W1 source fix | Medium | Governance or owner gated | Governance and contract engineering | Keep the corrected public status and bundle a Governance redeploy with a separately reviewed migration. | Bytecode/source match, migration tests, timelock proposal and post-deploy verification. | [Report](CWA_IFR_Contracts_Deep_Audit_2026-09-14.md) |
| **CWA-26** Mainnet BuybackVault predates the W3 bounds fix | Low | Governance or owner gated | Governance and contract engineering | Include bounded setParams behavior in any future BuybackVault redeploy. | Parameter-boundary tests and deployed bytecode/source verification. | [Report](CWA_IFR_Contracts_Deep_Audit_2026-09-14.md) |
| **CWA-27** Bytecode verification classification | Informational | Informational, no action | Audit record | Retain the deployment-era toolchain and verification limitation as provenance. | No remediation required; re-evaluate only when reproducing historical bytecode. | [Report](CWA_IFR_Contracts_Deep_Audit_2026-09-14.md) |
| **CWA-28** Creator Gateway legacy wallet auth mints arbitrary JWTs | High | Open actionable | Creator Gateway backend | Remediation merged in #124 (e4a1a75f); the Creator Gateway has no production service, so release means a first reviewed deployment; release to production and live-verify. | `apps/creator-gateway/src/__tests__/auth.test.ts` and `security.test.ts` on main; no production runtime exists to verify. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-29** Creator Gateway OAuth binds an attacker-chosen wallet | High | Open actionable | Creator Gateway backend | Remediation merged in #124 (e4a1a75f); the Creator Gateway has no production service, so release means a first reviewed deployment; release to production and live-verify. | `apps/creator-gateway/src/__tests__/oauth-binding.test.ts` (state binding, tampering, replay, wallet substitution) on main; no production runtime exists to verify. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-30** Creator Gateway SIWE lacks domain binding | Medium | Open actionable | Creator Gateway backend | Remediation merged in #124 (e4a1a75f); the Creator Gateway has no production service, so release means a first reviewed deployment; release to production and live-verify. | `apps/creator-gateway/src/__tests__/siwe.test.ts` (domain, URI, chain, nonce, time window) on main; no production runtime exists to verify. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-31** Telegram verification nonce is weak and unthrottled | Medium | Fixed and verified | Telegram verification service | Keep the released remediation in place; re-verify after any change to this service. | `apps/telegram/telegram-bot/test/nonce-store.test.js` and `api-rate-limit.test.js` on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): telegram-bot RELEASE_SHA a24dbe89 (verify-api nonce store and rate limits live). | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-32** Telegram verification code enables first-come takeover | Medium | Fixed and verified | Telegram verification service | Keep the released remediation in place; re-verify after any change to this service. | `apps/telegram/telegram-bot/test/verify-command.test.js` and `verify-api-flow.test.js` (private-chat code, /unverify) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): telegram-bot RELEASE_SHA a24dbe89 (code binding to the requesting account live). | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-33** One wallet can bind unlimited Telegram accounts | Medium | Fixed and verified | Telegram verification service | Keep the released remediation in place; re-verify after any change to this service. | `apps/telegram/telegram-bot/test/verify-api-flow.test.js` and `verification-store.test.js` (one wallet per account, 409 on conflict) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): telegram-bot RELEASE_SHA a24dbe89 (one wallet per account binding limit live). | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-34** Telegram status endpoint exposes wallet linkage | Medium | Fixed and verified | Telegram verification service | Keep the released remediation in place; re-verify after any change to this service. | `apps/telegram/telegram-bot/test/verify-api-status-route.test.js` (status route returns 404 without wallet or tier) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): `https://verify-api.ifrunit.tech/api/verify/status/*` returns 404 live. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-35** Benefits read-only seller signatures are replayable during TTL | Low | Fixed and verified | Benefits backend | Keep the released remediation in place; re-verify after any change to this service. | `apps/benefits-network/backend/tests/sellerAuth.test.ts` (one-time read nonces, replay and concurrent duplicate rejection) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): benefits backend+frontend at a24dbe89, `https://shop.ifrunit.tech/api/health` {"status":"ok","chainId":1}. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-36** Benefits seller authorization omits domain and chain | Low | Fixed and verified | Benefits backend | Keep the released remediation in place; re-verify after any change to this service. | `apps/benefits-network/backend/tests/sellerAuth.test.ts` (domain, chain ID, scope, expiry) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): benefits backend at a24dbe89 refuses to start in production without SELLER_AUTH_DOMAIN (observed live 2026-10-02; configured shop.ifrunit.tech); shop /api/health ok, chainId 1. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-37** Benefits attest attempts can be griefed | Low | Fixed and verified | Benefits backend | Keep the released remediation in place; re-verify after any change to this service. | `apps/benefits-network/backend/tests/attest.test.ts` (no attempt consumption before an eligible wallet is proven) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): benefits backend at a24dbe89 live, shop /api/health ok. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-38** Telegram privilege fallbacks are unsafe | Low | Fixed and verified | Telegram bot | Keep the released remediation in place; re-verify after any change to this service. | `apps/telegram/telegram-bot/test/signer-fallback.test.js` and `topic-gate-admin.test.js` (missing-env and RPC-outage fail closed) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): telegram-bot RELEASE_SHA a24dbe89 (signer fallback hardening live). | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-39** Telegram verification CORS uses substring matching | Low | Fixed and verified | Telegram verification service | Keep the released remediation in place; re-verify after any change to this service. | `apps/telegram/telegram-bot/test/verify-cors.test.js` (exact-origin allowlist, lookalike and malformed origins) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): live CORS probe: Origin `https://ifrunit.tech` allowed; `https://ifrunit.tech.evil.example` and `https://evil.example/ifrunit.tech` get no Access-Control-Allow-Origin. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-40** Telegram protected-topic guard runs after commands | Low | Fixed and verified | Telegram bot | Keep the released remediation in place; re-verify after any change to this service. | `apps/telegram/telegram-bot/test/topic-gate-admin.test.js` (guard before protected commands) on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): telegram-bot RELEASE_SHA a24dbe89 (protected-topic guard before commands live). | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-41** Creator Gateway embeds Google access token in JWT | Low | Open actionable | Creator Gateway backend | Remediation merged in #124 (e4a1a75f); the Creator Gateway has no production service, so release means a first reviewed deployment; release to production and live-verify. | `apps/creator-gateway/src/__tests__/auth.test.ts` and `security.test.ts` (minimal JWT claims, server-side Google tokens) on main; no production runtime exists to verify. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-42** Creator Gateway JWT and network defaults are insufficiently pinned | Low | Open actionable | Creator Gateway backend | Remediation merged in #124 (e4a1a75f); the Creator Gateway has no production service, so release means a first reviewed deployment; release to production and live-verify. | `apps/creator-gateway/src/__tests__/security.test.ts` (HS256 pinning, required JWT_SECRET, consistent chain/contract pair) on main; no production runtime exists to verify. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-43** Benefits GET rate-limit and write-on-read notes | Informational | Informational, no action | Benefits maintenance | Retain as hardening guidance and reassess if route exposure or load changes. | No mandatory remediation in the current register. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-44** Telegram tier staleness and temporary wallet-map storage | Informational | Informational, no action | Telegram operations | Retain as operational guidance for future persistence and refresh work. | No mandatory remediation in the current register. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-45** Telegram Markdown and channel content trust notes | Informational | Informational, no action | Telegram maintenance | Retain the content-trust boundary and reassess before expanding automated posting. | No mandatory remediation in the current register. | [Report](CWA_IFR_Surfaces_Supplement_2026-09-14.md) |
| **CWA-46** Copilot LendingVault decoder uses a shifted ABI | Medium | Fixed and verified | AI Copilot backend | Keep the complete Loan tuple decode covered by ABI fixture and API response tests when LendingVault interfaces change. | PR #112 head e86f6fcc merged as main 2c68ca98 with exact-main AI Copilot, Contracts, Docs, Security and Pages runs green; canonical-order ABI fixture and API response tests; live LendingVault zero-address read returns the canonical activeLoans array. | [Report](CWA_IFR_Web3_Integration_Audit_2026-09-14.md) |
| **CWA-47** WalletConnect provider loads from a runtime CDN | Low | Fixed and verified | Web3 frontend | Keep the released remediation in place; re-verify after any change to this service. | `npm run test:web3-wallet-runtime` (artifact SHA-256, no-remote-import scan), `npm run test:web3-headers` (CSP) and `tests/browser/wallet-connect.spec.js` pass on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): web3 verify at a24dbe89: vendored ethers 6.17.0 and WalletConnect provider 2.25.0 served same-origin, CSP matches infra/web3, no esm.sh/jsdelivr in /web3/. | [Report](CWA_IFR_Web3_Integration_Audit_2026-09-14.md) |
| **CWA-48** IFRState fallback reports failed reads as finalized zero state | Low | Fixed and verified | Web3 frontend | Keep the released remediation in place; re-verify after any change to this service. | `npm run test:web3-wallet-runtime` (scripts/test-ifr-state-unavailable.cjs) and `tests/browser/wallet-connect.spec.js` unavailable-state checks pass on main. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): web3 verify at a24dbe89 (web3-release.json sha a24dbe89; IFRState fail-closed fallback live). | [Report](CWA_IFR_Web3_Integration_Audit_2026-09-14.md) |
| **CWA-49** WalletConnect project ID is public by design | Informational | Informational, no action | Web3 operations | Keep Reown origin restrictions monitored; no secret treatment is required. | No code remediation required; verify allowlisted production origins operationally. | [Report](CWA_IFR_Web3_Integration_Audit_2026-09-14.md) |
| **CWA-50** Money-critical views should prefer direct chain reads | Informational | Informational, no action | Architecture guidance | Retain as a design rule for new financial surfaces. | No mandatory remediation in the current register. | [Report](CWA_IFR_Web3_Integration_Audit_2026-09-14.md) |
| **CWA-51** README allocation custody rows diverge from chain state | Medium | Fixed and verified | Repository documentation | Keep current custody and original allocation intent described separately and re-verify custody figures against chain reads when balances move. | PR #124 merged as main e4a1a75f; README custody rows (chain-verified at block 26,065,893) are asserted by `npm run test:cwa-content`. | [Report](CWA_IFR_README_Audit_2026-09-14.md) |
| **CWA-52** README claims a fee flywheel that is not active | Medium | Fixed and verified | Repository documentation | Keep the README describing the FeeRouterV1 sink state and update it only when a governed fee flow is actually activated. | PR #124 merged as main e4a1a75f; `npm run test:cwa-content` forbids the BuybackVault/BurnReserve accumulation claim, requires the FeeRouterV1 sink wording and fails if FeeRouterV1 gains an IFR exit function. | [Report](CWA_IFR_README_Audit_2026-09-14.md) |
| **CWA-53** README overstates automatic secret detection | Low | Fixed and verified | Repository documentation and AI Copilot frontend | Keep secret-handling claims limited to the controls each Copilot surface actually ships. | PR #124 merged as main e4a1a75f; `npm run test:cwa-content` forbids the automatic-detection claim in README and apps/ai-copilot/README.md and ties the remaining wording to the shipped IFRCopilot SAFETY_WORDS check and the unchecked served widget. | [Report](CWA_IFR_README_Audit_2026-09-14.md) |
| **CWA-54** README test tables are historical and disclaimed | Informational | Informational, no action | Repository documentation | Preserve the dated snapshot and keep the canonical current-status link visible. | No remediation required while the historical disclaimer and current link remain. | [Report](CWA_IFR_README_Audit_2026-09-14.md) |
| **CWA-55** On-chain component count lacks a published counted list | Informational | Informational, no action | Repository documentation | Prefer linking a generated component inventory when the count is next revised. | No mandatory remediation in the current register. 2026-09-27: counted list published in docs/DEPLOYMENTS.md (14 protocol contracts + 3 Gnosis Safes); see DOCS_TRUTH_MATRIX_2026-09-27.md and `npm run test:docs-truth`. | [Report](CWA_IFR_README_Audit_2026-09-14.md) |
| **CWA-56** Builder products table can be confused with registry state | Informational | Informational, no action | Repository documentation | Keep product availability clearly separated from on-chain BuilderRegistry activation. | No mandatory remediation while the canonical functionality status remains linked. | [Report](CWA_IFR_README_Audit_2026-09-14.md) |
| **CWA-57** Advertised 15-bps voucher cannot execute | Medium | Fixed and verified | Points and protocol documentation | Keep issuer defaults at or below the deployed FeeRouter fee and update the cap if Governance changes that fee. | Passed `npm run test:cwa-content`: issuer emits 5 bps, contract bound and current public copy agree. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-58** Lending yield uses the wrong asset and destination in copy | Medium | Fixed and verified | Protocol documentation | Preserve IFR-denominated interest and the lender/protocol-receiver split in current product copy. | Passed `npm run test:cwa-content`: LendingVault source and maintained copy markers agree. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-59** Protocol plan describes an unimplemented buyback and refill mechanism | Medium | Fixed and verified | Protocol documentation | Keep BuybackController, BuybackVault, IFR transfer-fee custody and PartnerVault refill descriptions separated. | Passed `npm run test:cwa-content`: invented refill/fee-flow claims are absent from maintained canonical surfaces. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-60** Contracts page uses mainnet addresses in the Sepolia column | Medium | Fixed and verified | Protocol documentation | Maintain Sepolia addresses in the canonical testnet registry instead of duplicating them across contract cards. | Passed `npm run test:cwa-content`: affected cards link to the canonical network-specific registry. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-61** Governance proposal history is inaccurate | Medium | Fixed and verified | Governance documentation | Append future proposal records with full transaction targets and hashes. | Passed `npm run test:cwa-content`: corrected proposal ledger markers and full-hash href guard. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-62** Timelock claims omit the guardian exception | Medium | Fixed and verified | Governance documentation | Retain the owner-only guardian-rotation exception wherever the 48-hour proposal delay is summarized. | Passed `npm run test:cwa-content`: exception and guardian cancellation markers are present. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-63** Tokenomics denies an active deployer fee exemption | Medium | Fixed and verified | Tokenomics documentation | Update the disclosure if Governance revokes or changes the Deployer exemption. | Passed `npm run test:cwa-content`: active Proposal #7 exception and address are disclosed. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-64** Role and ownership references have drifted | Low | Fixed and verified | Protocol documentation | Keep the canonical deployment role table synchronized with source and future chain changes. | Passed `npm run test:cwa-content`: PartnerVault admin and BuybackController owner markers match the role registry. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-65** Transparency supply table and custody claims are false | Medium | Fixed and verified | Transparency documentation | Refresh the dated block-pinned table as balances change while preserving exact reconciliation. | Passed `npm run test:cwa-content`: named plus residual balances equal supply and supply plus burned equals 1B at block 26013776. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-66** LP strategy arithmetic is wrong by orders of magnitude | Medium | Fixed and verified | Liquidity documentation | Use reserve-based constant-product calculations and label all examples as curve-only estimates. | Passed `npm run test:cwa-content`: exact bigint checks reproduce 2.97 ETH and 148.5 ETH examples. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-67** P0 denomination is inconsistent | Low | Fixed and verified | Protocol documentation | Keep P0 in canonical wei-per-IFR units and date any external fiat conversion. | Passed `npm run test:cwa-content`: LP and CommitmentVault pages use 300,000,000 wei per IFR. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-68** Developer API references do not match compiled interfaces | Medium | Fixed and verified | Developer documentation | Update examples and fragment targets together with ABI, route or section changes and retain the source-signature guard. | Passed `npm run test:cwa-content`: documented PartnerVault, IFRLock, SIWE and FeeRouter signatures match current source, and the Creator Gateway and E2E fragment targets resolve. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-69** Wiki status and phase labels conflict | Low | Fixed and verified | Protocol documentation | Use the canonical roadmap and proposal ledger for future status changes. | Passed `npm run test:cwa-content` and `npm run test:roadmap-status-sync`. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-70** Public component, test, page and wallet counts drift | Low | Fixed and verified | Protocol documentation | Change counts only with their canonical inventory or test evidence. | Passed `npm run test:cwa-content`, status baseline and Wiki inventory guards. 2026-09-27 re-check: 644/644 contract tests reproduced and landing component list completed; see DOCS_TRUTH_MATRIX_2026-09-27.md. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-71** Landing fallbacks and mechanism summaries are stale | Low | Fixed and verified | Landing documentation | Refresh static fallbacks whenever their live source or deployment status changes. | Passed `npm run test:cwa-content`: current supply, burn, fee custody and planned-governance fallbacks are pinned. T-158: the Landing On-Chain Transparent Team Vesting, IFR Burned and CommitmentVault cards no longer carry static current values; they render only the shared live snapshot and fail closed to loading/stale/unavailable (`npm run test:landing-wiki-ui`). | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-72** Bootstrap page contains contradictory figures | Low | Fixed and verified | Bootstrap documentation | Preserve the V1/V3 timeline and the chain-backed 144.75M + 50M + 5.25M funding sequence alongside the 100M claim and 100M LP allocations. | Passed `npm run test:cwa-content`: three full transaction hashes, 200M total funding, timeline, 100M claim formula and focused test count agree. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-73** Mechanism and UX wording overstates implementations | Low | Fixed and verified | Protocol and product documentation | Keep implementation claims bounded to shipped code and mark planned experiences explicitly. | Passed `npm run test:cwa-content`: latch, hero, Copilot, dead-DOM, score and planned-governance claims are guarded. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-74** Unverifiable but plausible process notes | Informational | Informational, no action | Audit record | Retain as context and avoid promoting unverified process claims to protocol facts. | No mandatory remediation in the current register. | [Report](CWA_IFR_Content_Coherence_Audit_2026-09-14.md) |
| **CWA-75** Copilot wiki failure destroys the last-good cache | Medium | Fixed and verified | AI Copilot backend | Keep stale-if-error serving with refresh outside the chat request path; failed refreshes must never replace last-known-good data. | PR #111 head 1df488cc merged as main 5000417f with exact-main CI green; Wiki outage, timeout, concurrent-chat, cache-retention and single-flight tests pass. | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |
| **CWA-76** Copilot crawler follows off-origin HTML | Medium | Fixed and verified | AI Copilot backend | Keep crawler discovery restricted to explicitly allowed IFR origins and reject every foreign host. | PR #111 head 1df488cc merged as main 5000417f with exact-main CI green; off-origin, redirect and lookalike-host rejection tests pass against local fixtures. | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |
| **CWA-77** Copilot teaches conflicting tier systems | Medium | Fixed and verified | AI Copilot and product configuration | Keep the single canonical tier configuration imported into prompts, knowledge and API checks. | PR #112 head e86f6fcc merged as main 2c68ca98 with exact-main runs green; shared-tier contract tests; live Copilot renders Basic >=500, Premium >=2,000 and Pro >=10,000 without placeholder. | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |
| **CWA-78** Advertised premium on-chain context is not implemented | Medium | Fixed and verified | AI Copilot product and backend | Keep the documentation-only Copilot boundary in place and regression-guard the Landing, Agent Wiki, Roadmap and RAG against any reintroduced wallet, balance, lock or tier context claim. | PR #113 final head 3f1f1cb2d6a98c7592925655a68dd22cf68297a2 merged as main 2fbf07e5b519f9505081065f08a9cf9ef71411b3; exact-main CI green (AI Copilot 35516880564, Contract Tests 35516880597, Security Audit 35516880566, Docs Validator 35516880562, Pages 35516880211); public Landing, Agent Wiki and Roadmap now state the Copilot is documentation-only and receives no wallet, balance, lock or tier context; retired vote POST returns HTTP 410 with no-store; 36 static RAG documents loaded and 36 live Wiki pages refreshed; runtime healthy with zero restarts. | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |
| **CWA-79** Copilot static knowledge contains stale rows | Low | Fixed and verified | AI Copilot knowledge maintenance | Keep the static and RAG knowledge refreshed against the canonical supply, test, proposal and registry sources whenever those sources change. | PR #113 final head 3f1f1cb2d6a98c7592925655a68dd22cf68297a2 merged as main 2fbf07e5b519f9505081065f08a9cf9ef71411b3; exact-main CI green (AI Copilot 35516880564, Contract Tests 35516880597, Security Audit 35516880566, Docs Validator 35516880562, Pages 35516880211); exact-main runtime hashes verified; 36 static RAG documents loaded and 36 live Wiki pages refreshed; runtime healthy with zero restarts. | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |
| **CWA-80** Copilot policy and UX limits contradict each other | Low | Fixed and verified | AI Copilot backend and frontend | Keep address policy, the 20-message cap, ABI mutability and retired vote actions aligned across prompts, server and widget. | PR #112 head e86f6fcc merged as main 2c68ca98; prompt policy, 20-message boundary and retired vote-state assertions pass in the exact-main correctness test and the stale checkHealth view fragment is absent from the server ABI. | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |
| **CWA-81** AI anchors and Web3 sitemap contain defects | Low | Fixed and verified | Web and AI-discovery documentation | Keep the released remediation in place; re-verify after any change to this service. | `npm run test:sitemap-anchors` (same-host sitemaps, canonical, JSON-LD, lastmod) passes on main for docs/ and infra/web3. Released to production at a24dbe89 on 2026-10-02 (exact-SHA release scripts): web3.ifrunit.tech/sitemap.xml lists only web3.ifrunit.tech URLs and robots.txt points to its own sitemap (live 2026-10-02). | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |
| **CWA-82** Optional AI anchor completeness notes | Informational | Informational, no action | AI-discovery policy | Keep the crawler policy explicit; optional anchors can be added only when they have maintained content. | No mandatory remediation in the current register. | [Report](CWA_IFR_AI_Readiness_Audit_2026-09-14.md) |

## Change Rule

Every status change must update the JSON source, regenerate this file, identify the exact
remediation commit or governance evidence, and pass `npm run test:cwa-register`. Historical
audit reports remain dated evidence; editorial corrections are disclosed with old and new
hashes in the audit index.