V12 is your security agent for mission critical code. Start with $200 in free credits.

Open app

A V12 findings workspace and command-line audit running together on a movable desktop. On wide screens, finding rows, tabs, review status, and output sections are interactive.

Drag this title bar to move its window. With the title bar focused, use the arrow keys to move, Shift plus an arrow key to move farther, and Home to reset its position. On narrow screens, the windows move vertically while their fixed left rails stay anchored.

V12 Web

Finding rows, review status controls, view and artifact tabs, and output sections are interactive. Navigation, filters, search, and chrome icons are illustrative.

V12 audit findings demo ready.

PE Personal Runs Treasury v4 audit F-004 Reentrancy permits complete vault drain

Valid

Run details

CreatedJul 10, 2026 · 12:41 PM

StartedJul 10, 2026 · 12:42 PM

EndedJul 10, 2026 · 1:01 PM

Creatorsecurity@personal.dev

Run IDrun_4f29…a17c

Statistics

6Findings

18m 42sDuration

12Files reviewed

$8.42Total cost

Scope

Audit

Repositorytreasury-v4 / contracts

Solidity · 12 files · 2,841 lines of code

Filescontracts/Vault.solcontracts/OracleAdapter.solcontracts/LiquidityPool.sol

Findings

The audit identified one critical issue, two high-severity issues, two medium-severity issues, and one low-severity issue.

By severity

Critical 1

High 2

Medium 2

Low 1

By review status

Valid 3

Acknowledged 1

Invalid 0

Unreviewed 2

Issue categories

State management (2)Authorization (2)Price integrity (1)Accounting (1)

context.md 12 lines

Copy

1 # Run context

3 ## Audit intent

4 Review authorization boundaries and privileged role changes.

5 Treat documented invariants as requirements, not suggestions.

7 ## Attached documents

8 - threat-model.pdf — Trust boundaries and privileged roles

9 - protocol-spec.md — Expected state-transition invariants

11 ## Focus

12 Compare implementation behavior against the supplied threat model.

Criticals (1)

Highs (2)

Mediums (2)

Lows (1)

Low-confidence(3)

Likely incorrect(12)

Reentrancy permits complete vault drain

Description

Vault.withdraw() transfers assets before the caller’s balance is updated. A malicious receiver can re-enter the vault and repeat the withdrawal against the same balance.

41	`function withdraw(uint256 amount) external {`
42	`token.safeTransfer(msg.sender, amount);`
43	`balances[msg.sender] -= amount;`
44	`}`

Source

contracts/ Vault.sol 1

External call before state update 1 snippet

Vault.sol

41	`function withdraw(uint256 amount) external {`
42	`token.safeTransfer(msg.sender, amount);`
43	`balances[msg.sender] -= amount;`

Root cause

The function violates checks-effects-interactions and has no reentrancy guard.

Proof of concept

Complete

Reproduction steps

Deploy ReentrantReceiver against the vault.
Deposit 10 ETH and call attack().
Re-enter withdraw() from the receiver hook.

Test case

test-vault-reentrancy.sol

function test_drainsVault() public {

attacker.deposit{value: 10 ether}();

attacker.attack();

assertEq(address(vault).balance, 0);

}

Considerations

The harness exercises the concrete vulnerable call path against the pinned audit revision. It does not model unrelated integrations or changes introduced after this run.

Remediation

Complete

Update internal accounting before transferring assets and reject withdrawals that exceed the stored balance.

contracts/ Vault.sol +4 −2

41	41	`function withdraw(uint256 amount) external {`
42		`− token.safeTransfer(msg.sender, amount);`
43		`− balances[msg.sender] -= amount;`
	42	`+ uint256 balance = balances[msg.sender];`
	43	`+ if (amount > balance) revert InsufficientBalance();`
	44	`+ balances[msg.sender] = balance - amount;`
	45	`+ token.safeTransfer(msg.sender, amount);`
44	46	`}`

Disclaimer

Remediation code samples are intended to convey how an issue may be resolved (i.e., the idea), but they may not be functional or safe changes. These recommendations are not exhaustive, and we encourage our partners to consider them as a starting point for further discussion.

Oracle price can be manipulated within one block

Description

OracleAdapter.quote() uses the pool’s instantaneous spot price. A flash-loan trade can move that price long enough to overvalue collateral in the same transaction.

88	`function quote(address asset) external view returns (uint256) {`
89	`return pool.spotPrice(asset);`
90	`}`

Source

contracts/ OracleAdapter.sol 1

Spot price used as trusted oracle 1 snippet

OracleAdapter.sol

88	`function quote(address asset) external view returns (uint256) {`
89	`return pool.spotPrice(asset);`
90	`}`

Root cause

The adapter trusts a single-block AMM observation without a time-weighted window or deviation bound.

Proof of concept

Complete

Reproduction steps

Borrow 8M USDC through a flash loan.
Move the WETH/USDC spot price by 31%.
Open a position before restoring the pool.

Test case

test-oracle-manipulation.sol

function test_acceptsManipulatedPrice() public {

moveSpotPrice(31_40);

lending.openPosition(1_000 ether);

assertGt(lending.debtOf(attacker), safeDebt);

}

Considerations

The harness exercises the concrete vulnerable call path against the pinned audit revision. It does not model unrelated integrations or changes introduced after this run.

Remediation

Complete

Read a 30-minute TWAP and reject observations outside the configured deviation threshold.

contracts/ OracleAdapter.sol +2 −1

88	88	`function quote(address asset) external view returns (uint256) {`
89		`− return pool.spotPrice(asset);`
	89	`+ uint256 price = pool.twapPrice(asset, 30 minutes);`
	90	`+ return bounds.requireSafeDeviation(asset, price);`
90	91	`}`

Disclaimer

Signature replay bypasses withdrawal limits

Description

WithdrawalAuthorizer.authorize() validates an operator signature but never consumes its digest. The same signed withdrawal can therefore be submitted repeatedly.

126	`function authorize(bytes32 digest, bytes calldata sig) external {`
127	`signer.requireValidSignature(digest, sig);`
128	`vault.release(msg.sender);`
129	`}`

Source

contracts/ WithdrawalAuthorizer.sol 1

Verified digest remains reusable 1 snippet

WithdrawalAuthorizer.sol

126	`function authorize(bytes32 digest, bytes calldata sig) external {`
127	`signer.requireValidSignature(digest, sig);`
128	`vault.release(msg.sender);`

Root cause

Authorization digests are not bound to a nonce or recorded as used after successful verification.

Proof of concept

Complete

Reproduction steps

Obtain one valid 25,000 USDC withdrawal signature.
Submit the signed payload once.
Replay the identical calldata three more times.

Test case

test-signature-replay.sol

function test_replaysAuthorization() public {

authorizer.authorize(digest, signature);

assertEq(usdc.balanceOf(attacker), 50_000e6);

}

Considerations

The harness exercises the concrete vulnerable call path against the pinned audit revision. It does not model unrelated integrations or changes introduced after this run.

Remediation

Complete

Bind every authorization to a nonce and consume the digest before releasing funds.

contracts/ WithdrawalAuthorizer.sol +4 −2

126	126	`function authorize(bytes32 digest, bytes calldata sig) external {`
127		`− signer.requireValidSignature(digest, sig);`
128		`− vault.release(msg.sender);`
	127	`+ if (usedDigests[digest]) revert AlreadyUsed();`
	128	`+ usedDigests[digest] = true;`
	129	`+ signer.requireValidSignature(digest, sig);`
	130	`+ vault.release(msg.sender);`
129	131	`}`

Disclaimer

Stale allowance persists after role rotation

Description

AccessManager.rotateRole() assigns the replacement operator but leaves the outgoing operator’s allowance untouched, preserving withdrawal authority after rotation.

73	`function rotateRole(address oldOperator, address next) external {`
74	`operators[next] = true;`
75	`operators[oldOperator] = false;`
76	`}`

Source

contracts/ AccessManager.sol 1

Outgoing operator allowance not revoked 1 snippet

AccessManager.sol

73	`function rotateRole(address oldOperator, address next) external {`
74	`operators[next] = true;`
75	`operators[oldOperator] = false;`

Root cause

Role membership and delegated allowances are stored separately, but rotation only updates membership.

Proof of concept

Complete

Reproduction steps

Grant the operator a 5,000 USDC allowance.
Rotate the operator role to a new address.
Withdraw from the retired address using the stale allowance.

Test case

test-role-rotation.sol

function test_oldOperatorKeepsAllowance() public {

manager.rotateRole(oldOperator, nextOperator);

vm.prank(oldOperator);

vault.withdraw(5_000e6);

}

Considerations

The harness exercises the concrete vulnerable call path against the pinned audit revision. It does not model unrelated integrations or changes introduced after this run.

Remediation

Complete

Clear delegated allowances as part of the same role-rotation transaction.

contracts/ AccessManager.sol +3 −2

73	73	`function rotateRole(address oldOperator, address next) external {`
74		`− operators[next] = true;`
75		`− operators[oldOperator] = false;`
	74	`+ allowance[oldOperator] = 0;`
	75	`+ operators[oldOperator] = false;`
	76	`+ operators[next] = true;`
76	77	`}`

Disclaimer

Rounding favors the final liquidity provider

Description

LiquidityPool.redeem() rounds every partial redemption down but gives accumulated dust to the final liquidity provider, creating a withdrawal-order advantage.

211	`function redeem(uint256 shares) external returns (uint256 assets) {`
212	`assets = shares * totalAssets / totalSupply;`
213	`if (shares == totalSupply) assets = totalAssets;`
214	`}`

Source

contracts/ LiquidityPool.sol 1

Remainder assigned to last redeemer 1 snippet

LiquidityPool.sol

211	`function redeem(uint256 shares) external returns (uint256 assets) {`
212	`assets = shares * totalAssets / totalSupply;`
213	`if (shares == totalSupply) assets = totalAssets;`

Root cause

Division remainders are not tracked per share and are settled to the last account that exits.

Proof of concept

Complete

Reproduction steps

Create 1,000 equal LP positions.
Redeem 999 positions in sequence.
Redeem the final position and compare exchange rates.

Test case

test-redemption-rounding.sol

function test_lastRedeemerReceivesDust() public {

redeemFirstN(999);

uint256 finalAssets = pool.redeem(allShares);

assertGt(finalAssets, proRataAssets);

}

Considerations

The harness exercises the concrete vulnerable call path against the pinned audit revision. It does not model unrelated integrations or changes introduced after this run.

Remediation

Complete

Carry precision through a per-share accumulator and retain protocol dust below the minimum unit.

contracts/ LiquidityPool.sol +2 −2

211	211	`function redeem(uint256 shares) external returns (uint256 assets) {`
212		`− assets = shares * totalAssets / totalSupply;`
213		`− if (shares == totalSupply) assets = totalAssets;`
	212	`+ assets = Math.mulDiv(shares, accAssetsPerShare, 1e18);`
	213	`+ roundingDust += totalAssets - assets;`
214	214	`}`

Disclaimer

Emergency pause omits the rewards adapter

Description

RewardsAdapter.claimRewards() remains callable while the protocol is paused, allowing an external rewards hook to move tokens during incident containment.

58	`function claimRewards(address receiver) external {`
59	`rewards.claim(receiver);`
60	`}`

Source

contracts/ RewardsAdapter.sol 1

External token flow bypasses pause guard 1 snippet

RewardsAdapter.sol

58	`function claimRewards(address receiver) external {`
59	`rewards.claim(receiver);`
60	`}`

Root cause

The adapter is registered with the protocol but does not check the shared pause state.

Proof of concept

Complete

Reproduction steps

Pause the protocol through the guardian.
Call claimRewards() through an approved distributor.
Observe the transfer while paused.

Test case

test-rewards-pause.sol

function test_claimStillWorksWhenPaused() public {

guardian.pause();

adapter.claimRewards(receiver);

assertGt(reward.balanceOf(receiver), 0);

}

Considerations

The harness exercises the concrete vulnerable call path against the pinned audit revision. It does not model unrelated integrations or changes introduced after this run.

Remediation

Complete

Apply the shared pause modifier to every externally callable rewards path.

contracts/ RewardsAdapter.sol +2 −1

58	58	`function claimRewards(address receiver) external {`
59		`− rewards.claim(receiver);`
	59	`+ if (paused()) revert Paused();`
	60	`+ rewards.claim(receiver);`
60	61	`}`

Disclaimer

The V12 CLI introduces its commands, creates and watches an audit, lists its findings, marks a confirmed signature-replay issue as valid, and verifies the updated finding list.

V12 CLI

$ v12 findings update 42 11 --validity valid --reason "replay confirmed"
uid       11
title     Signature replay bypasses withdrawal limits
severity  high
validity  valid

$ v12 findings list 42 --validity valid
UID  SEVERITY  VALIDITY  TITLE
4    critical  valid     Reentrancy permits complete vault drain
9    high      valid     Oracle price can be manipulated within one block
11   high      valid     Signature replay bypasses withdrawal limits

Securing the code behind systems that cannot afford to fail.

We meet you where you work.

Every pull request gets a security review. Findings land beside the code, ready for your team to review.

Connect GitHub

maya-chen commented 2 minutes ago

@v12sec please review the frontend & db surface

v12sec Bot commented just now · edited

Finding	Severity	Details
F-82768	`Critical`	Removed status guard enables replayable refund drain

Analyzed twelve files, diff 4f29a17...8bc320e.

Chat with V12 like it’s your security engineer. Ask it anything about the repo, and trigger a run for what actually matters.

Connect Slack

Reply…

Also send to # v12-security

Your coding agent knows how to use V12. Audit the code, pull the findings, and patch them—in one session.

Configure MCP

› Review V12 run 42.

•Called

└v12.v12_findings({"runUid":42,

"severity":["critical","high"]})

3 of 3 findings.

•Run 42 complete — 1 critical, 2 high

UID 4 · critical · valid · contracts/Vault.sol:41

Reentrancy permits complete vault drain

UID 9 · high · valid · contracts/OracleAdapter.sol:88

Oracle price can be manipulated within one block

UID 11 · high · unreviewed · contracts/WithdrawalAuthorizer.sol:126

Signature replay bypasses withdrawal limits

•UID 11 is unreviewed. Mark it valid, invalid, or acknowledged?

I can also change severity or add a note — after you confirm.

The entire audit lifecycle lives in your terminal. Quote, review, triage, fix, all from one binary.

Install CLI

$ v12 runs create \ --name "Treasury v4 audit" \ --repo acme/treasury --branch main

Scope: acme/treasury @ main (4f29a17) — 12 files, 2,841 LOC

PATH LOC

contracts/AccessManager.sol 318

contracts/LiquidityPool.sol 602

… 10 more files 1,921

Estimated cost: ~$8.42, up to $10.80 (p90)

Create this run? [y/N] y

✓ Run 42 created · queued

Audit your next PR, automatically.

Whatever you build, we bring expertise. No matter what language or framework, V12 finds the bugs you care about.

Every change gets reviewed before it reaches production. Autopilot audits every change as soon as it lands.

stong/account Once after PR creation

Active

Recent reviews View all

Vault access controls PR #8 · 91cb347

Running Now

Passkey fallback validation PR #7 · 8c3dc73

Complete 25d ago

Session token rotation PR #6 · 744d0dd

Complete 31d ago

OAuth callback validation PR #5 · 19f6a2e

Complete 39d ago

Webhook signature checks PR #4 · 5ed21bf

Complete 45d ago

Dependency version pinning PR #3 · e703c81

Complete 52d ago

Admin role boundaries PR #2 · b48a612

Complete 64d ago

V12 audits the intent, not just the syntax. It reads your specs, notes, and past findings to focus on what actually matters to you.

Context documents Type links and notes for agents to read before the audit.

threat-model.pdf Trust boundaries and privileged roles

protocol-spec.md Expected state-transition invariants

access-policy.ts Authorization rules and enforcement paths

schema.sql Role grants and ownership constraints

Audit privileged role changes against

threat-model.pdf

before release.

Preview

Browse

Add ↵

What teams say about V12.

“We had our cryptography library audited by V12 alongside a human auditor. V12 caught every critical bug the human found and surfaced several issues the human missed. For a team our size, an independent review at this depth with both cryptographic and engineering insights was invaluable.”

Winderica Ethereum Foundation

“V12 has given us greater confidence throughout our Solana smart contract audit process. It consistently catches issues that are easy for humans to overlook, helping us identify potential vulnerabilities earlier and focus more of our time on validating complex attack scenarios. It’s become a valuable addition to our security workflow.”

sudoku Meteora

“V12 found a critical soundness bug that had been lurking in our ZK code for over a year. Human expert auditors missed it. Since then, we’ve made V12 a central part of a security strategy. Better and cheaper than most human experts.”

Yuvi Lightman Quantus

“V12 has been great at spotting issues and helping us pipeline them into our production process. For Bulk, the biggest value is the loop: find risk, verify it, turn it into a ticket, fix, retest. Excited to see this loop get better every day!”

Jun Bulk Trade

“We write a lot of complex cryptographic code, and security is always top of mind. Having a tool like V12 in our belt has been a huge lift for our security posture. We get detailed code review on complete repositories in hours, giving a boost in confidence for our engineers, researchers, and partners.”

Aaron Feickert Alpen Labs

“V12 is fantastic as another set of review eyes for your high velocity team. When fixing legacy code, it points out all the other ways it was already broken for you.”

Dev Ojha ZCash

V12 is your security agent for mission critical code. Start with $200 in free credits.

We meet you where you work.

Audit your next PR, automatically.

What teams say about V12.

Get started with V12.