Risks

Assume loss is possible

Deepstate combines an onchain matching engine, top-of-book rewards, a burn-to-governance vault, fixed-price fee purchases, and external tokenized assets. These mechanisms expose participants to economic, market, and governance risks even when the contracts behave as designed.

Reward and token risks

The reward allocation is locked

The rewarder holds 1 billion DEEP and exposes no owner withdrawal. Unearned rewards remain locked after schedules expire. A bug or disabled hook can therefore leave a substantial balance permanently inaccessible.

Token mint roles remain unlimited

The launch rewarder has no mint role and distribution cannot exceed its prefunded balance. DeepstateToken itself still has no supply cap. A malicious or compromised future MINTER_ROLE holder can create DEEP, deposit it for STATE, redeem vault value, and acquire governance.

Front-loaded rewards may overwhelm organic economics

Up to 1 billion prefunded DEEP can be distributed by NVDA/USDG. Front-loaded incentives may attract capital that leaves as rewards decline or end. The program does not subsidize depth behind the top price.

Vault risks

Asset lists can be incomplete

redeemAssets pays only explicitly listed addresses. Assets omitted from the call remain in the vault and are not paid in that transaction.

Multi-asset value is not normalized

The vault pays pro-rata token amounts without an oracle, valuation, or rebalance. USDG, NVDA, native ETH, and other assets can move independently. A holder receives the onchain balances included in the call, not a target dollar value.

Fee-purchase risks

Fixed price can be far from fair value

buyFees sells complete listed balances for exactly 10,000 USDG. There is no oracle or auction. A valuable basket can be purchased below market; a weak basket may never attract a buyer.

Buyers choose the list

ERC-20 balances are not enumerable onchain. A buyer can include any eligible set, including NVDA, and omit other assets. DEEP, STATE, USDG, and duplicate entries are rejected, but NVDA is not protected from purchase.

Fee-token behavior may be unsafe

The vault rejects fee-on-transfer USDG payments, but listed payout tokens can still be malicious, callback-heavy, rebasing, or otherwise non-standard. A token transfer failure reverts the purchase.

Market risks

Best in book is not fair value

No oracle validates rewarded quotes. A stale or manipulated top can earn while mechanically best. Thin books can produce a winning price with little useful depth.

Top-only rewards invite priority games

Makers can repeatedly move one tick ahead. This may tighten spreads, but it can also create churn, transaction races, and weak depth behind the best quote. Quantity scaling does not reward inferior prices.

Tokenized equity is externally governed

NVDA depends on Robinhood's contracts, custody and legal structure, corporate-action handling, sequencer, and interface multiplier. Deepstate cannot guarantee redemption, market-hours behavior, sanctions policy, or continued token support.

Unsupported tokens can violate assumptions

Pools are permissionless, but settlement assumes exact ERC-20 transfers. Fee-on-transfer, rebasing, malicious, or non-standard tokens can violate accounting assumptions. Onchain existence is not an endorsement by deepstate.sh.

Governance risks

No timelock

A successful proposal can execute immediately after voting. The 15-day launch lock, 3-day voting delay, and 7-day voting period are not a post-approval escape window.

Governance controls powerful settings

The governor can raise the protocol fee to 100 bps, redirect its recipient, replace pool hooks, grant an unlimited DEEP minter role, and change voting settings. Non-upgradeability constrains code changes, not harmful calls already authorized by deployed code.

Interface control is separate power

Deep State Incorporated cannot stop direct contract use, but default listings and routing can shape attention and liquidity. A zero founder token grant does not eliminate that offchain advantage.

Accepted audit findings

Accepted findings register

This section records disclosed security review findings and Deepstate's acknowledgement of each item. An acknowledgement identifies whether the reported behavior is controlled by the canonical deployment, intentionally retained, unsupported for noncanonical assets, or accepted as residual protocol risk.

These acknowledgements do not mean that the reported impact is impossible. Production deployments and integrations must use the reviewed configuration and respect the assumptions described below.

#227463 Incompatible Token Addresses Brick Vault Flows

Severity: Medium

Finding. The vault constructor can permanently bind incompatible deposit or value-token addresses, leaving deposits, burns, redemptions, or fee purchases unusable.

Acknowledgement. This is accepted as a deployment-configuration risk. The canonical deployment creates DEEP from the known implementation and validates external token code and decimals before deployment. Required token behavior is also exercised during deployment verification. Interface probing cannot reliably prove arbitrary ERC-20 runtime behavior, so Deepstate relies on the reviewed production configuration and deployment simulation.

#227489 Fixed-price Sweep Underprices Valuable Fee Balances

Severity: High

Finding. Anyone can purchase all listed fee inventory for the fixed 10,000 USDG price even when that inventory is worth substantially more.

Acknowledgement. This is intentional economic design. The fixed price creates a permissionless arbitrage incentive to sweep fees at the earliest economically profitable moment. The design assumes an efficient market in which competing buyers monitor the vault and execute as inventory approaches the profitable threshold. Inventory can be underpriced if nobody acts promptly, but that market-dependency risk is accepted in exchange for avoiding a substantially more complex auction system.

#227497 Zero Launch Delay Disables Proposal Bootstrap Lock

Severity: High

Finding. The Governor constructor permits a zero bootstrap delay, allowing proposals immediately after deployment if the deployment configuration supplies zero.

Acknowledgement. This is accepted as a deployment-configuration risk. The canonical production configuration sets a 15-day governance start delay, followed by a three-day voting delay and seven-day voting period. This creates the intended 25-day period before the earliest governance execution. A zero value would require an incorrect reviewed deployment configuration rather than an action available after deployment.

#227510 Immediate Governance Can Enable Uncapped Token Minting

Severity: Critical

Finding. Because the Governor controls DEEP role administration and executes without a timelock, a successful proposal can immediately grant an unrestricted MINTER_ROLE.

Acknowledgement. This authority is intentional. Governance is the ultimate administrator of DEEP issuance and must be capable of appointing a future emissions controller. A timelock would delay a malicious governance decision but would not prevent governance that has already been captured from eventually granting the role. Deepstate accepts direct execution and relies on the bootstrap delay, voting delay, voting period, quorum, and proposal threshold to provide public notice and participation before execution.

#227511 Unbounded Minter Can Capture Governance and Drain Vault Assets

Severity: Critical

Finding. An independent minter can issue arbitrary DEEP, convert it into STATE, obtain governance power, dilute existing holders, and redeem a proportional share of vault assets.

Acknowledgement. MINTER_ROLE is intentionally a system-level authority and must be treated as equivalent to supply, treasury, and governance authority. The canonical deployment premints the fixed reward allocation, revokes the deployer's temporary minter role, gives no minter role to the rewarder, and launches with no persistent external minter. Any future minter must be a capped and audited emissions controller. Compromise or malicious configuration of such a future minter is an accepted governance risk.

#227524 Outbound ERC-20 Payouts Do Not Ensure Exact Delivery

Severity: Medium

Finding. SafeERC20.safeTransfer confirms call success but does not prove that the receiver's balance increased by the requested amount. Fee-on-transfer or otherwise nonstandard tokens can deliver less than the amount returned and emitted by the vault.

Acknowledgement. The protocol assumes standard exact-transfer behavior for canonical assets. Supporting arbitrary transfer-tax, rebasing, callback-driven, or otherwise nonstandard output tokens would add substantial complexity and still could not provide universal ERC-20 guarantees. Such tokens are unsupported payout assets. The vault reports the gross amount transferred, while any token-level deductions remain an accepted property of that token.

#227526 Nominal Deposit Accounting Mints Unbacked Shares

Severity: Medium

Finding. The vault records the requested DEEP amount without independently proving that transferFrom and burn moved and destroyed exactly that amount. A malicious or nonstandard deposit token could therefore create unbacked STATE.

Acknowledgement. This does not apply to the canonical deployment because the deposit asset is not an arbitrary external token. The deployment script creates DEEP from the repository's known OpenZeppelin implementation, and that implementation has exact transfer and burn behavior. The deposit-token address is immutable after deployment. A no-op, partial-transfer, or malicious deposit token therefore requires a noncanonical deployment using the wrong implementation, which is accepted as deployment misuse.

#227533 Skipped Top-order Hooks Permanently Misallocate Rewards

Severity: High

Finding. Deepstate treats reward hooks as best-effort. If a hook fails and is swallowed, the rewarder can miss a transition and later attribute an incorrect duration or quantity to another order.

Acknowledgement. Swallowing hook failures is a deliberate order-book safety decision. A reward extension must never be able to halt order placement, cancellation, or execution in the core exchange. If hook delivery fails, incentive accounting may be lost or misattributed, but user orders, balances, and market execution remain correct. Reward exposure is bounded by the prefunded immutable emission caps. Deepstate accepts reward-accounting degradation in exchange for guaranteeing core CLOB liveness.

#228892 Absolute Quorum Floor Exceeds Total Voting Supply

Severity: High

Finding. The absolute one-STATE quorum floor can be unreachable when less than one STATE of voting power is active, making proposals created during that period impossible to pass.

Acknowledgement. This is an intentional fail-closed governance property. Governance should not execute with less than one full STATE of active voting power. The canonical deployment permanently seeds one STATE and delays governance for 15 days, eliminating the reported zero-supply restart path. If active voting power still remains below the floor, governance temporarily loses liveness but no attacker gains execution authority. Proposals can be resubmitted once sufficient voting power exists.

#228898 Unprotected Inherited Deposit and Mint Remain Publicly Callable

Severity: High

Finding. Standard two-argument ERC-4626 deposit and mint calls remain available without minimum-share or maximum-asset limits, allowing execution at a worse conversion rate than an earlier quote.

Acknowledgement. Preserving these methods is an intentional ERC-4626 compatibility decision. The vault also provides bounded overloads using minShares and maxAssets, and Deepstate's front end uses those methods. Integrators using the standard unbounded selectors accept quote movement in the same manner as an unbounded swap. Disabling them would make the vault less compatible with ERC-4626 integrations.

#228900 Redemption Minimums Bypassed by Fee-on-transfer Assets

Severity: Medium

Finding. Redemption and fee-purchase minimums are checked against the gross vault balance, so a fee-on-transfer output token can credit the receiver with less than the stated minimum.

Acknowledgement. The minimums protect against changes in vault inventory or STATE ownership while a transaction is pending. They are not intended to normalize arbitrary ERC-20 transfer behavior or guarantee a receiver balance delta after token-level taxation. Fee-on-transfer output assets are unsupported, and their net-delivery behavior is an accepted integration risk. The canonical USDG payment path separately rejects fee-on-transfer payments.

#228905 Uncapped Token Minting Converts Into Governance Control

Severity: Critical

Finding. Any MINTER_ROLE holder can mint arbitrary DEEP, deposit it for self-delegated STATE, dominate governance, dilute vault claims, and potentially obtain control of the ecosystem.

Acknowledgement. This restates the known authority described in #227511. The canonical deployment leaves no persistent external minter: reward emissions are preminted, the rewarder is not a minter, and the deployer's temporary role is revoked. Governance may appoint a future minter, but that role must only be granted to a capped and audited controller. An incorrectly authorized or compromised minter remains an explicitly accepted critical governance risk.

#228906 Dust Supply Epochs Permit Unbounded Proposal Spam

Severity: Low

Finding. A dust-sized STATE supply can reduce the proportional proposal threshold to one wei, allowing a negligible holder to create unlimited proposals at only the cost of gas.

Acknowledgement. The canonical deployment permanently locks one STATE at address(0xdead), preventing zero-supply restarts and eliminating the reported one-wei proposal path. The initial proposal threshold is therefore approximately 0.01 STATE rather than one wei. A holder who legitimately satisfies the configured 1% threshold can still create multiple proposals, which is an accepted OpenZeppelin Governor property without proposal deposits or rate limits. Every proposal costs gas and still requires quorum before execution.