Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
I-01·audit-finding

StressLive reports success when every settlement item fails

Fixednfterc-1155marketplace
TL;DR

StressLive reports success when every settlement item fails. Final disposition: Fixed.

Severity
INFO
Method
MManual review
CAT.

Tracker: issue #35 · Status: Fixed · Verified at: audit-v3-rereview-handoff

02Section · Description

Description

In script/StressLive.s.sol#L118-L148, the script counts successful batch items into ok, but every aggregate expectation is scaled by ok and every per-item assertion skips failed entries. It never requires any settlement to succeed before printing all invariants held and returning normally.

When all items fail, every observed balance delta and every expected delta is zero, so all assertions pass vacuously. A live reproduction produced:

code
settled 0 of 3
settlement USDC at rest (MUST be 0) 0
treasury delta 0
expected 0
all invariants held
ONCHAIN EXECUTION COMPLETE & SUCCESSFUL.

No order settled, no badge moved, and no seller or treasury payment occurred. This is an assurance defect rather than a contract vulnerability: no checked CI or release gate consumes the script, but its false-green result can mislead an operator running the advertised live stress check.

03Section · Recommendations

Recommendations

Require at least one successful item immediately after counting the results:

solidity
require(ok > 0, "STRESS FAILED: zero settlements succeeded");

This preserves intentional partial-success testing while rejecting the vacuous all-fail case. If the script is intended to prove complete deployment readiness, require ok == batchSize instead, or enforce an explicitly documented minimum success threshold.

04Section · Remediation

Remediation

Fixed. _requireAllSettled requires every item in the batch to have settled, names each item that did not, and refuses an empty batch as proving nothing. A run in which every settlement failed can no longer report success.

05Section · Verification provenance

Verification provenance

Final disposition: Fixed. Verified at audit-v3-rereview-handoff, commit f020448976eb7c4895e1626ef3228876cff2b7d2. This earlier remediation disposition is carried forward from the prior re-review, not independently re-verified in the generation-d pass. The report-wide scope and evidence limitations remain applicable; see the final report overview.

Status
Fixed
I-01