What the review found

Who did this, and what it is

An AI reviewer (Claude, an Anthropic model) that did not write the contract reviewed it in four passes, all on 2026-11-12:

After each of the first three passes, the authors changed the rules. The reviewer worked from docs/SPEC.md, the Rust source, and tests it wrote itself.

This is not an audit by a security firm. It is not a formal verification. No person has signed it off. A finding that is absent here means only that the reviewer did not find it within the scope and time below. It does not mean the problem is absent.

Scope

In scope:

• contracts/weir/src/ (all files), checked against docs/SPEC.md.
• contracts/mock-usdc/src/lib.rs, only for what would break tests or mislead a reader.

Out of scope:

• the TypeScript packages (engine/, chain/, agents/, keeper/, web/, integration/);
• the reporters' off-chain code and their data sources;
• any real token contract;
• NEAR protocol behaviour beyond what near-sdk 5.30.1 documents;
• the economic behaviour of real participants;
• deployment and key management.

Method

• Read the specification and the changed source in each pass.
• Followed every path that moves dollars, by hand, against the running totals behind get_totals.
• Wrote unit tests that drive the contract through its public methods in near-sdk's mocked VM. Each call runs like a transaction: a panic rolls the state back.

The authors rewrote or renamed the tests in the first three files after each pass.

• audit* tests assert that a finding is closed.
• limit_* tests keep demonstrating something the specification states as an open limit.

• The real wasm was not run for this review. The sandbox and integration runs in the repository were made by the authors. Gas figures for anything other than clear were not measured.

Deployed parameters

The weekly preset in agents/src/presets.ts:

History

First pass. It found that one reporter could ratchet the index and one could freeze it, that clear could overflow, that forfeits could be steered to an accomplice, that eviction was free, and that the guard could be changed after commit. Specification 0.4 closed most of these.

Second pass. It found that, when one reporter was absent, a single dishonest reporter could force a void settlement at mid-band. Specification 0.5 replaced that rule.

Third pass. The 0.5 rule paid a void series at the average price its own auctions had traded at. That fix was faulty. Wash trades between two accounts of one person, in a round they alone used, set the average anywhere in the band for the price of commit fees. In the test, a trading reporter took 19.40 $ of a counterparty's 20 $. It was a worse hole than the one it replaced.

Fourth pass. Specification 0.6 withdrew the 0.5 rule. It now pays a void series half the band on each side, and this pass checks that rule.

Fourth pass (spec 0.6)

The centre-of-band rule is sound against traders who are not reporters

settlement::settle sets long_payout = band / 2 and short_payout = band - band / 2.

• Rounding. band is always even, because settlement::band builds it as half.checked_mul(2). So band / 2 is exact, and each set pays exactly band.
• The old fields are inert. traded_units and traded_value are still added up in clear and returned by get_series, but nothing reads them. They cannot overflow: the traded units of a series are at most its auction capacity, below 2^52.

audit4_void_centre.rs::audit4_a_non_reporter_cannot_move_the_void_payout tries everything a trader can do before a void:

• an honest trade below half the band;
• wash trades of 10,000 units at both extremes (0.399 and 0.001 on a 0.40 band);
• minting 500 sets and merging 200;
• moving positions both ways.

Then the index fails on its own, with no reports in the delivery window.

This confirms the coordinator's statement. A trader who is not a reporter gains from a void only by having bought a side for less than half the band. That is ordinary price risk.

There is no on-chain way to trade on the knowledge that a void is coming:

• auctions and mint close before delivery starts;
• merge is neutral;
• transfer_position moves units but sets no price.

One indirect path remains, found by reading and not tested (4.1). Prints can stop if the contract runs out of NEAR for storage. Anyone can add storage to the contract (commits, positions), but at today's costs this is expensive: about 6.40 $ of fees for 8 KB of book storage. It matters only if the operator lets the NEAR balance run down.

What remains for a reporter, at deployed parameters

Both cases need one of the three reporters to be absent, or the operator to control two of them. With one operator running all three, that operator can set the fixing outright, so these numbers measure what a single compromised reporter key can do.

How the 0.029 $ for choosing which buckets print is made up:

• Leaning each print: up to max_spread/2 = 1% of the index, about 0.020 $ a unit (3.3% of the band).
• Dropping hours: up to 42 of 168 hours (25%). That adds about 0.42σ, where σ is the hourly spread of the index. At σ = 1% of the index this is about 0.009 $. I assumed σ; I did not measure it.
• Together: about 0.029 $ a unit, about 4.8% of the band.

These are acceptable on a testnet with test dollars and one known operator: that operator already holds full power over the fixing, and nothing real is at stake.

They are not acceptable for real dollars. That needs at least:

• reporters run by independent parties;
• enough reporters that one absence does not leave two, each able to veto any bucket;
• a published policy, or a mechanism, for what happens to a reporter who causes no-prints.

Every finding, status under 0.6

"Open" means the weakness exists in the deployed contract today. The test named demonstrates it. Numbers are at deployed parameters.

Examined and found sound

These were checked by reading. Some are also covered by the authors' property tests or by the review tests named.

• Dollar accounting on every path, in all four passes. This includes the 0.6 void path: audit4_a_non_reporter_cannot_move_the_void_payout asserts free + burned = deposits after a full void redemption. Burned dollars are never credited.
• The void payout under 0.6 cannot be moved by trades, mints, merges, transfers, or the timing of clear and settle.
• Clearing matches sections 7.1 and 7.2.
• The commit hash is unambiguous and cannot be replayed.
• Access controls (1 yoctoNEAR, the token check, the single private callback, new once) are as described.
• The recorded guard, max_round_lock and the sets cap behave as the specification says.
• Pruning: a pruned bucket cannot come back (audit2_a_pruned_bucket_cannot_come_back), and pruning does not touch the accumulators or the last print.
• The index with all reporters present gives the median, which a minority cannot move.
• Invariant 7: I found no state in which clear or settle fails for a reason other than time, a pending round, missing prints, or a short NEAR balance.

Residual risks before real money (0.6)

• Reporters decide the fixing.
• All three are run by one operator, who can set any price.
• A single compromised reporter key, while another is absent, can lean and select prints (about 0.029 $ a unit, 2.1).
• It can also force a void that pays its cheap side up to 0.299 $ a unit (3.2).
• Nothing on chain checks a report against its published data.
• A round can be blocked for 6.40 $, a week of rounds for about 1,075 $.
• Agent keys: bounded only if the owner sets both guard and max_round_lock. Both are off by default.
• Parameters: new accepts parameters that remove protections. Read get_params.
• Storage: relies on someone pruning and sending NEAR. Nobody is paid to do either. A low balance stops reports, and with them settlement turns void.
• No mainnet history and no upgrade path. A bug means a new contract.

Verdict

Public testnet. Weir 0.6 is fit for a public testnet with test dollars, with its reporters run by one known operator and these limits stated where users will read them.

• Its accounting has stayed exact through four passes.
• The void rule now in force cannot be moved by traders.
• Everything that remains concerns the reporters, whom testnet users must trust anyway, or cheap blocking, which costs test dollars only.

Not for real dollars. It is not fit for real dollars until, at least:

• the reporters are independent parties, numerous enough that one absence does not hand every bucket to a two-reporter veto;
• blocking a round costs something that scales with what it blocks;
• max_round_lock is on by default;
• the contract's NEAR balance and pruning have a funded owner.

One fix in this review's history was itself found faulty: the 0.5 void rule. Any change made to meet the conditions above needs its own review.

How to re-run

cargo test --manifest-path contracts/Cargo.toml -p weir --test audit_findings -- --nocapture --test-threads=1
cargo test --manifest-path contracts/Cargo.toml -p weir --test audit2_findings -- --nocapture --test-threads=1
cargo test --manifest-path contracts/Cargo.toml -p weir --test audit3_void -- --nocapture --test-threads=1
cargo test --manifest-path contracts/Cargo.toml -p weir --test audit4_void_centre -- --nocapture --test-threads=1
contracts/build.sh && cargo test --manifest-path contracts/Cargo.toml --workspace   # everything, including the slow sandbox suite

On 2026-11-12, against the 0.6 source, all four files passed:

A test passing means its stated outcome happens. For limit_* tests, that outcome is the weakness itself.