Protocol-manipulation close-out HPX-SRC-2026-08-20-C

PASS WITH REMEDIATION — protocol money path is stake-and-epoch only

Scope: this interface and unpublished contract drafts. Out of scope: ProveX, PulseChain consensus, $PRVX bytecode, user devices. Not a warranty.

C1 — Self-attested cycles could still move money. confirmCycle is a user heartbeat, not a ProveX proof. Vault payouts no longer read cycleCount. Weight = staked $PRVX. Streaks remain reminders only.

C2 — Same-epoch and later-epoch fee sniping. Stake or top-up deactivates the position until the next weekly epoch. notifyFee only splits among currently active stake. First activation sets paid = current accumulator so history cannot be harvested.

C3 — createHabit spam / clone rows. If habitCount is 0 the wallet calls createHabit; otherwise it updates the latest row. Max 16 habits remains as a hard cap.

C4 — HABIT eligibility via fake registry streaks. HABIT snapshot rules now require months of *active vault stake*, not confirmCycle counts.

A stolen seed, a malicious browser extension, a fake ProveX domain you type yourself, or a lying RPC operator can still harm a user. Those are outside this contract set. The vault money path does not trust confirmCycle, localStorage, or OAuth.

• 21 August 2026 · HPX-VAULT-2026-08-21 · Streak Vault hostile review (multi-asset)
• 20 August 2026 · HPX-SRC-2026-08-20-B · Independent second pass
• 20 August 2026 · HPX-SRC-2026-08-20-A · Initial source-code audit