Coffer ETH Bonds and Marketplace

The security audit and mitigation-review report is dated 22 October 2026 and is available as a 40-page PDF. It records the scope, individual finding write-ups, verification evidence and final dispositions. The review ran from 12 to 22 October 2026.

This public copy matches the corrected PDF delivered to the client. SHA-256: c2f84b1db4aa2963385fbfc5f8846dbcb93a87aaefede32f16a802f7efd7e789.

The audit identified 11 findings: two Medium, five Low and four Informational. No Critical or High finding was identified in the reviewed scope. The mitigation review records seven fixed findings and four acknowledged residual risks.

The fixed findings include the marketplace cancellation-nonce issue and corrections to redemption-funding guidance, consensus-withdrawal timing, credential-binding guidance, deployment ownership and withdrawal-event documentation. A documentation correction is not presented as removal of the underlying runtime behavior.

The four acknowledged findings preserve these qualifications:

• M-02: A partial default claim changes a bond's remaining value without changing its ERC-721 token ID. External venues must validate remaining value atomically with transfer; stale external listings remain an accepted integration risk.
• L-01: The uint32 purchase timestamp retains a February 2106 rollover boundary. Documentation and stopping sales before that boundary address the operational response; the stored type is unchanged.
• L-02: The public third-party default-declaration path remains exposed to transaction ordering. The holder's atomic redeem-or-default path and private ordering are the documented alternatives.
• L-05: Primary purchases use the fee, bond terms and owner at transaction execution. Documentation explains this accepted risk; calldata still does not bind a deadline, maximum fee, minimum maturity value or expected owner.

The initial scope comprised ten Solidity and deployment-script files, totalling 1,178 nSLOC, frozen at core commit 793f6a78d805bfa2c83320633dc5984eca1038db and marketplace commit 926218175f6534b7d867ea30193fafae6cbf346a.

The report separately identifies the remediation commits and evidence used for each final disposition. The initial scope hashes above are not a claim that every later revision, application component or deployment was audited.

The report describes a fixed-duration review. It is not exhaustive, does not guarantee the absence of vulnerabilities and does not eliminate the four acknowledged residual risks. The findings and remediation conclusions apply to the documented scope, revisions and evidence. They do not certify the whole platform, later code changes or future operational security.