20 August 2026
Independent second pass HPX-SRC-2026-08-20-B
Follow-up review after the first remediations. Found wrong-chain registry writes, immortal streak weight, stale IPFS pack, OAuth on a no-account dApp, DexScreener any-chain price, shared localStorage.
Effective 20 August 2026 · Last updated 20 August 2026
All audits · HPX-SRC-2026-08-20-B
Verdict
PASS WITH REMEDIATION (then superseded by C)
Scope: this interface and unpublished contract drafts. Out of scope: ProveX, PulseChain consensus, $PRVX bytecode, user devices. Not a warranty.
Findings
B-H1 — Registry tx followed settlement chain. Fixed: registry writes always on PulseChain 369.
B-H2 — Streak 2.0x never decayed. Superseded by C: streak is not in the money path.
B-H4 — Stale IPFS pack. Re-packed after each contract/legal change.
B-M2 — Google/X Sign in. Removed from header. Protocol unused.
B-M3 — Production frame-ancestors. Production CSP is 'self' only.
B-M4 — DexScreener any-chain. PulseChain pairs only.
B-M5 — Shared localStorage. Key scoped per connected wallet.
Environment (not protocol bugs)
A stolen seed, a malicious browser extension, a fake ProveX domain you type yourself, or a lying RPC operator can still harm a user. Those are outside this contract set. The vault money path does not trust confirmCycle, localStorage, or OAuth.
Other reports
These documents are provided for transparency. They are not legal, tax, or investment advice. If you need advice for your situation, consult a qualified professional in your jurisdiction.