# VELLIN distribution security — 15 October 2026

Status: source verified and controlled integration passed on public Robinhood Chain Testnet (46630), distributor `0x1005bBf1bDC1d85777Ab0Ca28A1688061568D4A9`. Real UTC-day automation acceptance is pending the 15 October close. No mainnet token/distributor is deployed; this is internal verification, not an independent audit or mainnet approval.

## Trust boundaries

Developer/owner controls trading capital, approves net-P&L/expense evidence, publishes holder snapshot/root, funds ETH, rotates keeper and can pause funding/buybacks. Merkle proofs prove membership in that committed allocation, **not truth of the submitted balances/accounting**. Malicious or incorrect operator input can misallocate/lock funds. Once funded, a root cannot be corrected. Published artifacts contain all source balances, policy and evidence references for review before funding.

Token, V2 router/path, team and eligibility-policy hash are immutable. Real code/address/pool verification is mandatory before deployment; third-party token/market behavior is an external trust dependency. Standard non-rebasing ERC20 transfer semantics are required. Burn means transfer to dead address.

## Protections and evidence

- Domain-bound, double-hashed OpenZeppelin StandardMerkleTree leaves: chain, distributor, UTC day, account, amount. Tested wrong account/amount/day/deployment and duplicate submissions.
- Exact deposit and immutable 30/30/40 split. No admin reserve withdrawal, upgrade or rescue path. Direct deposits revert; forcibly sent surplus ETH is not an entitlement and can remain locked.
- Checks/effects/interactions and OpenZeppelin ReentrancyGuard. Push uses bounded gas and no returndata copy. Failed recipient preserves credit; user-controlled redirect is authenticated by beneficiary sender. Reentrancy/rejection/return-bomb and team-rejection tests pass.
- Funding/day monotonicity, no duplicate epochs, maximum 50 recipients per batch. CLI defaults to plan-only and checks configured chain, runtime code hash, immutable fields, policy and matching funded root. Only explicit broadcast mode loads a signer.
- Independent buyback reserve, restricted executor, nonzero min output, bounded deadline, actual dead-address balance delta. Swap failure rolls back reserve spending and leaves funded holder access intact.
- Pause does not freeze existing holder payments. Ownership changes require two-step acceptance; renunciation is disabled to avoid accidental abandonment.
- Snapshot tool checks chain/block boundary, confirmations, all reconstructed balances, total supply and final block hash. Historical RPC errors and unsupported token semantics stop it; no latest-balance fallback.
- Frozen policy, full-source artifact commitment and deterministic reconstruction reject altered allocation files. Local file approval is operator attestation, not a cryptographic independent audit.
- Preparation rechecks that serialized holder balances sum exactly to the verified `totalSupply`, including excluded addresses. A `verified` label alone cannot bypass this consistency check.

## Expanded internal review — 15 October

38 Solidity tests passed. Three fuzz tests ran 4,096 seeds each; the interleaving test executes 96 operations per seed (393,216 randomized operations plus initial funding/final draining). An independent cash/entitlement model checks every operation: actual paid balances, per-epoch remaining entitlements, individual deferred credits, holder/buyback reserve isolation, burn output, solvency and conservation. Rejection, retry, redirect, duplicates, loss days, pause, unauthorized actions and failed swaps are interleaved across epochs. Unit cases also cover two-step ownership, disabled renunciation, role rotation, chain-domain proofs, numeric extremes and authenticated router reentrancy.

34 operational tests passed, including snapshot supply/identity, pinned historical balances, missing archive, changed runtime/roles/policy/path, UTC finality, reorg, resumability, immutable artifacts and queue locks. 2,000 integer-allocation cases conserve every wei. Coverage (separate instrumentation, 64 fuzz seeds) is 130/130 source lines, 196/197 statements, 20/21 branches and 21/21 functions. Uncovered branch/statement and instrumentation limitations remain; line coverage does not prove safety.

Maximum batch stress: all 50 recipients exhaust their entire 50,000-gas push allowance. Delivery consumes 8,219,809 local EVM gas; every credit survives and authenticated redirect recovery succeeds. The test's 10m-gas regression budget is not a production-chain gas-limit guarantee. Default keeper batches remain 40; live gas estimation/limits and actual holder proof sizes still need checking at launch. A preliminary 8m test budget was exceeded, then calibrated to the measured bound; the contract was not changed to hide the cost.

Slither analyzed 15 production/dependency contracts with 102 detectors and emitted 13 findings, all retained in `research/pre-mainnet-2026-10-15/slither.json`. Internal dispositions:

| Finding | Disposition and evidence |
| --- | --- |
| High / `reentrancy-balance` in buyback | Guarded entry points and reserve effects precede router interaction. An authorized-keeper router callback is rejected specifically with `ReentrancyGuardReentrantCall`; actual burn delta and protected holder reserve are checked. **Token/router trust is still a launch gate**: malicious or rebasing token balance reporting is not made safe by this test. |
| Three low / timestamps | Intentional UTC-day closure, hourly retry and short swap deadline; production tools recheck the confirmed UTC boundary. Chain timestamp assumptions remain. |
| Six informational / costly loops | Explicit 50-account cap and 40-account keeper default; maximum hostile batch measured and all credits recovered. Estimate against actual chain limits before launch. |
| Informational / assembly | Bounded call with zero return-data copy; rejection, return bomb, gas exhaustion and reentrancy covered. |
| Informational / low-level withdrawal call | Caller owns the credit, effects precede call, `nonReentrant`; failed redirect rolls back the whole claim. |
| Informational / `WETH` naming | Required external Uniswap V2 interface name. |

The scanner's high label is not erased or advertised as “zero findings.” No independent reviewer has signed off. A fresh npm advisory check reports zero known vulnerabilities for the pinned dependency tree; that is not a dependency audit.

## Open risks / required prelaunch work

No actual VELLIN token, market/router, developer/team/keeper or finalized eligibility list has been supplied. On 15 October the user explicitly confirmed these are absent and that test tVELLIN must not be carried to mainnet. Mainnet is blocked even if the testnet daily run passes. No external contract review, actual production market integration or live distributions are verified. Official mainnet RPC returned the correct pinned block/hash on a standard ethers read, but historical balance/runtime calls failed; archival state access must be established. Current sniper net profit remains unreconciled outside this code task, so automatic net-profit sourcing is not enabled.

Spot quotes alone are not sufficient MEV protection. Keeper requires a fresh independent floor/cap; operator controls its configuration and key. Public mempool buybacks can still be sandwiched within the bound. Gas, router availability and keeper downtime can delay delivery. Failed wallet credits remain recoverable.

Dependencies pinned; npm audit after a compatible uuid 11.1.1 override reports 0 vulnerabilities. This is one registry advisory check, not proof of safety. Foundry lints about trusted timestamps/casts/external payments are reviewed against checks and role boundaries; compiler warnings are not silently equated with a full security audit.