Streak Vault hostile review (multi-asset) HPX-VAULT-2026-08-21

PASS WITH REMEDIATION — vault money path is epoch-active wad-weighted stake; Claim pays stable only. Not a named-firm bytecode certification. Nothing is deployed yet.

Scope: this interface and unpublished contract drafts. Out of scope: ProveX, PulseChain consensus, $PRVX bytecode, user devices. Not a warranty.

V1 — Dust-pool equal split (HIGH — remediated). Equal split among pools with totalActive > 0 let 1 wei of HEX or WPLS take 25% of every notifyFee. Fees now split proportional to 18-decimal (wad) active stake; HEX raw amounts are scaled 8→18 (×1e10). A dust position earns dust, not a full pool share.

V2 — Stable token colliding with a stake token (HIGH — remediated). Constructor previously allowed stable_ == PRVX/WPLS/PLSX/HEX. notifyFee and claim would then mix principal and yield. Constructor now reverts DuplicateToken if stable is any allowlisted stake token. stake() also rejects the stable address.

V3 — Non-boolean ERC-20 returns (MEDIUM — remediated). Some PulseChain stables / clones return no data on transfer. Strict `if (!token.transfer(...))` treats empty success as failure or the reverse. Transfers now use low-level calls that accept empty return data or a true boolean.

V4 — Reentrancy on ERC-777-style callbacks (confirmed closed). nonReentrant uses locked 1↔2. Stake deactivates before pull. Unstake and claim update accounting before token transfer. Reentering stake/unstake/claim/notifyFee/sync reverts.

V5 — Same-epoch fee sniping / history harvest (confirmed closed). Stake or top-up sets unlockEpoch = currentEpoch+1 and deactivates. First activation sets paid = current accumulator. notifyFee only credits currently active wad. Claim cannot harvest prior-epoch acc on a just-unlocked position.

V6 — Unstake-to-collect-yield (confirmed closed). claim() transfers only `stable`. It never moves $PRVX, WPLS, PLSX, or HEX and does not deactivate. Unstake settles rewards into rewards[] for a later claim and pauses that token until the next epoch. Client claimVaultFees is 0-value, PulseChain-only, fail-closed until VAULT_DEPLOYED, no approve.

V7 — Fee-on-transfer accounting (confirmed handled on deposit). Stake and notifyFee credit the actual balance delta, not the requested amount. Unstake sends the accounted amount. Allowlisted tokens are not expected to take transfer fees; a future fee-on-transfer allowlisted token could strand the last unstakers — do not pin such a token.

V8 — Permissionless sync / notifyFee (confirmed non-theft). Anyone may activate a wallet whose delay has elapsed (helps the user). Anyone may notifyFee by paying stables in (cannot extract). No admin, pause, or upgrade function exists.

V9 — No-oracle USD inequality (accepted residual). 1 whole HEX and 1 WPLS have equal wad weight. That is not USD-fair. An oracle would reintroduce admin/manipulation risk on an immutable vault. Documented; not a theft of accounted shares.

V10 — Environment / out of band (not vault bugs). Phishing, malicious extensions, lying RPCs, fake token addresses at deploy, and rebasing or pauseable ERC-20s at the pinned addresses can still harm users. Direct stable transfers that skip notifyFee sit in the contract and are not credited. Immutable deploy means bugs after pin are migration-only. This review is source-level, not deployed bytecode.

A stolen seed, a malicious browser extension, a fake ProveX domain you type yourself, or a lying RPC operator can still harm a user. Those are outside this contract set. The vault money path does not trust confirmCycle, localStorage, or OAuth.

• 20 August 2026 · HPX-SRC-2026-08-20-C · Protocol-manipulation close-out
• 20 August 2026 · HPX-SRC-2026-08-20-B · Independent second pass
• 20 August 2026 · HPX-SRC-2026-08-20-A · Initial source-code audit