Two models, no mercy

Verdict: v1.6 may be deployed for maintainer-only proof compounds from the team's own wallets, small amounts, upgrade authority retained; the upgrade authority must not be burned until the first compound is traced end to end and the items below are closed. Verified complete: the fail-closed price guard, the bound destination slots, the creator-fee refusal, the CPMM oracle endpoint and the monotonic fee. Five new findings: three about CPMM reference pools (neither launch market uses one) and two keeper accounting bugs.

Scope: v1.6 working tree: full source, harness and tests, complete off-chain client and keeper, plus live mainnet evidence gathered for its earlier findings

• MediumAST-13 Single-transfer fee math still needs the first real compound tracedTwo mainnet simulations of real routes show one Token-2022 transfer straight into the user's account and a delivered amount equal to the quote. The report lists exactly what the first real compound must show; that trace happens before any freeze.open
• HighAST-20 A CPMM reference lets a caller pick a size that collapses the floorCPMM only; both launch markets use CLMM pools, where the floor is linear in the spot price. v1.7: a CPMM compound may feed the pool at most 1% of its reserve, so the modeled impact stays under 1%; the keeper splits bigger balances into pieces.fixed
• HighAST-21 An idle CPMM oracle can be backfilled at a donated priceCPMM only. v1.7 refuses a CPMM average whose samples are more than a third of the window apart, so a planted price must be held, and defended against arbitrage, for the whole window before it counts.fixed
• MediumAST-22 CPMM prices with extreme reserve ratios round to zero and blind the guardCPMM only. v1.7 refuses a spot or average price below 2^-16 raw units at registration and at every compound; such pairs need a CLMM reference.fixed
• LowAST-23 Keeper backoff missed on-chain custom errors reported in decimalv1.7 keeper reads the error code (decimal or hex) and attaches the program's logs before classifying a failure.fixed
• LowAST-24 The command-line client printed "confirmed" for a transaction that landed with an errorv1.7 client refuses to report success unless the confirmation and the read-back record are both error-free, and prints the program's error otherwise.fixed
• MediumAST-14 Keeper landed-transaction check had two fail-open branchesv1.7 keeper requires both enrollment counter reads (at or after the transaction's slot) and counts nothing otherwise.fixed
• LowAST-18 Keeper amount ladder: a failing surplus attempt discarded a valid planv1.7 keeper keeps the contribution-only plan when the surplus attempt fails, and tries one raw unit last when a market has no minimum.fixed
• MediumAST-05 Route arguments are read from the trailing bytes, not a full decodeWe disagree on impact: the transit and wallet balance checks after the swap make any disagreement between the parsed tail and what Jupiter executes fail the compound rather than underpay the user, and the platform-fee slot must be empty. A full decode of Jupiter's route plan would pin the program to today's Jupiter encoding forever.accepted
• InfoF9 Fee statistics record the gross amount for fee-on-transfer rewardsv1.7: the market's fee total and the event record what the fee vault actually received.fixed

Verdict on v1.4: do not deploy for production or burn the upgrade key yet. The two High findings (a price guard that stepped aside when the pool's history was missing or stale; unbound destination accounts in the relayed route) and the Medium ones are fixed in v1.6. One open point needs the chain, not code: the first real compounds must show Jupiter delivering a fee-on-transfer token with the single transfer the program's fee math assumes, before any freeze.

Scope: commit 5d91406 (v1.4): every prior finding re-verified, plus nine new findings on the hardened code

• HighAST-11 The spot-vs-average guard failed open when the pool's history was missing, short or stalev1.6: the guard fails closed. The pool's recorded history must cover the market's whole window and be under an hour old, or the compound is refused (OracleUnavailable), and a market cannot be registered until its pool qualifies. Windows are 1 to 20 minutes, which a full Raydium ring always covers.fixed
• HighAST-12 Unbound destination slots plus a zero floor could send a user's output elsewherev1.6: the route's user-destination, destination and destination-mint slots are pinned to the swap authority's own target account, the user's target account and the market's target mint; the route must quote a nonzero amount and the floor must be nonzero (already in v1.5).fixed
• MediumAST-13 Fee math assumes one transfer of a fee-on-transfer output; a real route might do twoEvidence so far says one: a mainnet simulation of a real ZEC to ZCAT route with an explicit destination shows a single Token-2022 transfer straight into the destination, and the destination receives exactly Jupiter's quoted amount (scripts/dev/jupiter-trace-probe.mjs). The first real compounds settle it on-chain before any freeze.accepted
• MediumAST-14 The keeper counted a landed-but-failed transaction as a successv1.6 keeper: a compound counts only when confirmation carries no error, the transaction is fetched back with an error-free record, and the enrollment's compound counter moved.fixed
• MediumAST-15 CPMM reference ignored Raydium's optional creator feev1.6 refused such pools outright. v1.9 models the fee instead, reproducing Raydium's own order of operations on whichever side it is charged. Verified by running Raydium's CPMM program against a mainnet snapshot of a creator-fee pool and checking our reference equals what it actually pays, both directions. An unrecognised fee mode is still refused.fixed
• MediumAST-16 CPMM average used the wrong endpoint for in-place oracle updatesv1.6: the average ends at Raydium's last_update_timestamp, verified against a live pool where it runs ahead of the newest entry.fixed
• LowAST-17 The swap authority can own token accounts beyond the transitv1.6 keeper: intermediate accounts may only be created for the target mint and a short allowlist (SOL, USDC, USDT); anything else falls back to a direct route. On-chain, such accounts hold no user funds and every compound is still measured on the user's own wallet.accepted
• LowAST-18 Keeper halving never tried the market minimumv1.6 keeper: the amount ladder halves down to the minimum and quotes the minimum itself last; surplus in transit is added only when the quote still clears.fixed
• InfoAST-19 "The fee can only go down" was a promise, not codev1.6: set_params refuses any fee above the current one.fixed

14 of 19 prior findings verified complete, 2 partial, 3 accepted, none missing. Recommends deploying v1.4 and running the first real compounds. Asked for one proof before any freeze: that Raydium records the pre-swap price in its observation account, which decides whether the TWAP guard can be gamed in one transaction. That proof now exists as a test that runs Raydium's real program against the pool snapshot.

Scope: commit 5d91406 (v1.4): every prior finding re-verified in the code, plus a hunt for issues introduced by the fixes

• HighN1 TWAP guard soundness depended on which tick Raydium recordsSettled: a test runs Raydium's real swap against the mainnet snapshot; the observation records the pre-swap tick, a second swap within 15 s writes nothing, and the guard refuses a compound at the pushed price.fixed
• MediumN2 A 5-minute window made a two-transaction hold-the-price attack plausible on thin poolsv1.5: the window is per market (admin-settable); launch markets use 15 minutes. v1.6: 1 to 20 minutes, and the pool's history must cover all of it.fixed
• LowN3 Keeper folded any transit surplus into its quote; an oversized donation could stall itv1.5 keeper: quotes the user's own contribution first and adds surplus only when the quote still clears the floor.fixed
• LowN4 Price-deviation pre-checks counted toward the 6-hour backoffv1.5 keeper: pre-check skips are free retries; only on-chain reverts count.fixed
• LowN5 After a freeze the admin key would be irreplaceablev1.5: two-step admin transfer (propose, then the new key accepts).fixed
• MediumN6 Freezing pins Jupiter's and Raydium's account layouts foreverDocumented in the runbook: the alternative is a timelocked multisig; the decision is taken before the freeze, and users' tokens never depend on it (revoke and floor need only the token program). v1.6 adds one escape hatch: a pair can be registered again with a new reference pool if the old one dies.accepted
• InfoN7 The signer-stripping test proved nothingv1.5: the mock router rejects any relayed signer but the swap authority, and the test flags a real transaction signer in another slot.fixed
• InfoN8 Keeper accepted setup instructions with an unpinned token programv1.5 keeper: slot 4 must be the system program, slot 5 a token program.fixed
• InfoN9 A zero reference output could let a pay-nothing route throughv1.5: compound refuses a zero threshold or zero amount.fixed
• InfoN10 Status-page and spec inaccuraciesCorrected on this page and in the spec.fixed

Account validation found tight and idiomatic. Two structural risks: one PDA both delegated on every user and signing a keeper-chosen Jupiter instruction, and a slippage floor read from a spot price the caller can move in the same transaction. Verdict on v1.2: do not deploy as-is.

Scope: commit 9b7b726 (v1.2): program, tests, mock router, design spec, off-chain keeper

• HighF1 Over-privileged CPI signer: the delegate PDA also signed the relayed swapv1.3: each market has its own swap authority that owns only that market's transit account and is the only signer of the relayed route; the delegate never signs a keeper-supplied instruction.fixed
• HighF2 Slippage floor from a same-transaction spot pricev1.3: the pool's own observation account gives a time-weighted average; a spot pushed below it by more than the market tolerance is refused. v1.6: no average, no compound.fixed
• MediumF3 Front-run donations to the transit account could block compoundsv1.3/v1.4: the route may swap anywhere between the user's contribution and the transit balance; surplus waits for the next compound; the keeper names an explicit amount.fixed
• MediumF4 Unlimited delegate allowance plus an upgradeable programDisclosed on the security page. The upgrade key is burned before public launch, which is the whole of the fix; the allowance stays unlimited so it never needs re-approving.accepted
• MediumF5 Leaving one market revoked the delegation of sibling marketsv1.3: unenroll takes a revoke flag, and a re-approve instruction restores a delegation without touching the floor.fixed
• LowF6 Reference config not bound to the pool or re-checkedv1.3/v1.4: pool, config and observation are cross-checked (types included) at registration; their owners and types are re-checked on every compound.fixed
• LowF7 Floor footguns on re-enroll and recreated accountsv1.3: re-approve covers the recreated account case; v1.5: the app says the floor starts again at the current balance when you leave and come back.fixed
• InfoF8 CLMM reference ignores price impact (liveness only)v1.4: the keeper halves the amount until Jupiter's quote clears the floor, so large balances go in chunks.accepted
• InfoF9 Stats record gross amounts for fee-on-transfer rewardsCosmetic; telemetry only.accepted

Three High findings (manipulable reference price, global signer exposed to an unbound Jupiter account graph, retained upgrade authority) and Medium issues in Token-2022 fee math, route argument parsing, quote races and keeper setup handling. Verdict on v1.2: do not deploy.

Scope: commit 9b7b726 (v1.2) via the same source packet

• HighAST-01 Keeper-manipulable reference pricev1.3: spot-vs-TWAP guard from the pool's observation account; v1.6: the guard fails closed.fixed
• HighAST-02 Global signer PDA exposed to the Jupiter account graphv1.3/v1.4: per-market swap authority; the route's authority and source slots are bound, the platform-fee slot must be empty, and only the plain route instruction is accepted. v1.6: both destination slots and the destination mint are bound too.fixed
• HighAST-03 Retained upgrade authority can bypass every protectionMitigated by design: the upgrade key is burned before public launch, after the first real compounds are verified. Until then the security page says so.accepted
• MediumAST-04 Transfer-fee modeling ignored the fee cap and the venue-side feev1.4: exact Token-2022 fee (bps and maximum fee, current epoch) applied on both legs.fixed
• MediumAST-05 Suffix-only parsing of the route argumentsv1.4: the platform-fee account slot must be empty, so no platform fee can be collected whatever the arguments say; the transit and user-wallet balance checks after the swap bound everything else, so a disagreement between the parsed tail and what Jupiter executes can only make the compound fail, never underpay.accepted
• MediumAST-06 CLMM reference ignores price impact; large balances could get stuckv1.4: the keeper chooses a bounded amount per compound and halves it until the quote clears the floor.fixed
• MediumAST-07 Quote races on mutable balances and transit donationsv1.4: explicit amount, surplus tolerated in transit.fixed
• MediumAST-08 Keeper executed arbitrary setup instructions from the APIv1.4: the keeper only accepts associated-token-account creation for the swap authority, re-paid by itself; v1.6: and only for the target mint or an allowlisted intermediate.fixed
• LowAST-09 Raydium config, discriminators and vault data not fully boundv1.4: account discriminators checked, pool/config/observation bound both ways, CPMM vaults checked for owner and mint; v1.6: discriminators re-checked on every compound.fixed
• LowAST-10 Unenroll could leave the delegation behind or revoke a replacement delegatev1.4: the canonical reward account is always inspected and only the vawlt's own delegation is revoked.fixed