VEYLOCKTRANSPARENCY / SECURITY REVIEW
A clear record.
Including the gaps.
What we checked, what the tests showed, and what still needs work.
Prepared by Codex as an internal AI-assisted review. It is not a certification, a safety guarantee, or approval to deposit funds. Open findings are published below.
The tested contract scenarios enforced atomic funding, fixed recipients, cliff release and schedule isolation. This review did not demonstrate an unauthorized withdrawal in those scenarios. It did identify usability, receipt-parsing and development-tooling issues that remain open.
Scope & method
Reviewed the local source snapshot listed below: the VEYLOCK Solidity contract, browser wallet and transaction flow, schedule arithmetic, token discovery, public viewer, and build/export configuration. Checks combined manual source inspection, the existing automated suite, two focused local reproductions, and an npm advisory scan.
The contract uses Solidity 0.8.30, optimizer 200 runs and the Shanghai EVM target. Tests used Node 24.14.1 and a local Ganache EVM. Ganache fell back to its JavaScript transport because its native module did not match Node 24; the test suite still completed.
The contract’s no-admin, fixed-beneficiary and non-cancellable behavior is intentional. Issuer-controlled, rebasing or taxed tokens can become unclaimable even when a schedule was funded successfully.
Open findings
Severity reflects the affected component. The tooling finding is not a claim of a critical browser or contract vulnerability. Recommendations below have not been applied by this report.
Large account histories can hide the dashboard
src/app.js · refresh()
Evidence
Source inspection: refresh() throws once the collected schedule IDs reach 2,000, including exactly 2,000. Its catch handler clears every displayed row. Anyone can create a funded schedule naming an arbitrary recipient.
Impact
A sufficiently large history, including unsolicited schedules, can make the normal account dashboard unavailable. This does not change contract balances or recipient permissions. The public viewer can still read a known schedule ID.
Recommended action
Paginate the dashboard and retain already loaded rows. Show the remaining-page state instead of clearing the workspace. Add a 2,000-schedule boundary regression.
Validation
Confirmed from source; the full 2,000-transaction scenario was not executed.
Extreme contract dates have an ambiguous display
contracts/Veylock.sol · createSchedule(); src/app.js and src/public-vesting.js · date formatting
Evidence
A local transaction successfully created a schedule ending at uint64 max. The browser conversion rounded 18446744073709551615 to 18446744073709552000 and displayed “Invalid Date”.
Impact
Schedules created outside the normal date form can show unreadable dates. Conversion to Number also loses precision outside the safe integer range. No fund loss was reproduced; the local vesting amount probe matched the contract in this specific case.
Recommended action
Preserve uint64 timestamps as strings or BigInt and display exact Unix seconds when a date is outside the browser calendar range. Keep all financial time arithmetic exact.
Validation
Reproduced on a local Ganache EVM; see the evidence JSON.
Creation receipt parsing does not check the emitter
src/app.js · confirmCreate()
Evidence
The client chooses the first log that parses as ScheduleCreated. A synthetic log bearing a different emitter address was accepted by the same ABI parser.
Impact
A nonstandard token emitting an identically shaped event before the workspace event could misdirect the saved label or opened schedule ID. The real contract allocation and beneficiary are unaffected.
Recommended action
Filter receipt logs by the selected workspace address before parsing the event, and verify its creator, token and amount.
Validation
Parser behavior reproduced locally; a complete malicious-token browser transaction was not executed.
Local Ganache dependency tree contains known advisories
package-lock.json · node_modules/ganache/node_modules/*
Evidence
npm audit --omit=dev reported 27 affected package entries: 4 critical, 17 high, 5 moderate and 1 low. Every reported node is nested under Ganache, which is declared as a devDependency.
Impact
These advisories concern the local test/build environment. Ganache is not imported by the browser entry points and is not copied into the Pages export. The command’s omit flag alone is therefore not a reliable production-exposure label for this installed tree.
Recommended action
Replace or isolate the outdated local EVM toolchain and re-run the advisory scan. Do not use this Ganache instance as a public RPC service.
Validation
Registry scan captured on September 14, 2026; paths checked against the application imports and export allowlist. No independent exploitability analysis of all 27 entries was performed.
Verified controls
| Control | Evidence |
|---|---|
| Atomic funding | Local EVM tests checked exact escrow deposits and rollback for unsupported transfer fees. |
| Fixed beneficiary | A third party triggered a claim; tokens reached only the configured recipient. |
| Cliff and final release | Tests covered before-cliff denial, catch-up at the cliff, repeated claims, final dust and schedule isolation. |
| Workspace compatibility | Exact runtime bytecode checks in the app and public reader; local runtime comparison passed. |
| Wallet context | Source inspection found chain/account checks and epoch invalidation around creation and deployment. Real extension signing remains untested here. |
| Public reads | A local HTTP provider read another recipient’s schedule without wallet access; wrong-chain inputs were rejected. |
| Untrusted labels | Dynamic token names, labels and status messages are escaped or assigned as text in inspected render paths. This was not a full XSS penetration test. |
| Static export | The Pages export allowlist excludes node_modules and test tooling. Template images, fonts and motion scripts are local; builds reject Ronolaunch asset URLs. |
Evidence you can inspect
npm test completed with 28 passing tests and 0 failures. Passing the existing suite does not close the findings above; the reported edge cases are not fully covered by it.
Dates & receipt parsing
Raw inputs and observed behavior from a local EVM and ABI parser.
DEPENDENCIES ↗The full advisory output
27 affected package entries, all nested under the local Ganache installation.
Reproduction command: node scripts/audit-evidence.mjs. Dependency command: npm audit --omit=dev --json. Advisory data changes over time; these files record this review date.
What this report does not cover
- No independent external auditor or certification.
- No mainnet wallet transaction, deployed workspace address or live contract bytecode was validated by this review.
- No formal verification, coverage percentage, dedicated static-analysis engine, fuzzing campaign or comprehensive reentrancy test suite.
- The wallet-extension signing flow was inspected in source, not exercised end-to-end in a wallet-enabled browser.
- Third-party tokens, RPC/indexer operations, hosting-account security and all transitive dependency implementations are outside comprehensive coverage.
- This is a dated source snapshot, not continuous assurance of later releases.
Before making independent-audit claims, commission an external review, address the open findings, and publish the auditor’s actual report and reviewed version. This page will not label the product “audited” merely because automated tests passed.
The reviewed source snapshot
Each link downloads the exact source reviewed for report VEYLOCK-2026-09-14-01. SHA-256 values identify that snapshot. Later releases may differ; this report does not automatically extend to them.
| Source | SHA-256 |
|---|---|
| contracts/Veylock.sol | e6d0917f76d6e3daba33920dde7a1b3f7edcc61d4d9b507b187839d6528701a1 |
| src/app.js | 70041c1ad2cd330ac4f1850abfd35fa2ffbf97e4d5694cbd5779b14d3642409e |
| src/vesting.js | dfaac6f1230e135f1611caa39217c24d7659e03972518443a271448e4aebce24 |
| src/public-reader.js | 4f312e3eae0dcfb5c1f9e70e468e592afb83c179daf1f902e61c77e0cdc492cf |
| src/public-vesting.js | c014748106f2f0d4ca1776388b08fe1fec1bf3498a0832e240258e67cb1276ca |
| src/wallet-tokens.js | 78155a3ab614158c82cffb46d850f2bba962741132bf7909e096e2ad6ba8f641 |
| src/token-metadata.js | 968e57492ff378a81dd5610d23d0810810fc7894a93517345c6c989f5f72ba4c |
| tests/contracts.test.mjs | ecacddbb6ffe1fbbc0dca8ab1f199026f72055c15b0e9af46376e4f49767d2c2 |
| tests/public-reader.test.mjs | 973b17dc0df9c1bcdcbebb4c161bd57c443d8d341b06a6643a8e1ecf900f387d |
| tests/vesting.test.mjs | 12ddcfad1427719a5772ab21831fc4def3a345ef38d68ac22dc89a6eed36db23 |
| tests/wallet-tokens.test.mjs | a1e5abcbff7261706ffcfa2a0f01178c4dee038328df4da18f3c266f73d6d925 |
| tests/token-metadata.test.mjs | 605dcc6345cf8958cf86e48a34b742205416583cb4a099878fce4b77807b1730 |
| scripts/build.mjs | 54c29b13fcea02d875c546fc8d1402dd9de71c0b916d6cde44c42f6cbbeb207b |
| scripts/build-cloudflare.mjs | 68e537c4cd1931275935a8df7f615111666ab4193c1a3fd37845e9ae2db2d3bc |
| package.json | dcd8eec8b4a161574a9938872c77224dc04362fb2ff7bd7da09a08155414ec89 |
| package-lock.json | 3c7790ae3b7c569de6c1a3d7b69762850933c2f7322dd4dee85367d7f3fc0465 |
| scripts/audit-evidence.mjs | 62df2b0b732b3977677ac67ec334de23f6f1f536c862937a8aeea9a6124de041 |
| public/build/contracts.json | 49f0c5ed0a5aea227b51af8e3800d7b6406ec1ce344a476cd00d025b363a4ca7 |