Section 19 • Developer Reference, Security & Legal
~6 min read•19 of 20
Zero admin custody, 10 resolved security vulnerabilities, and reentrancy protections
- Fixed 1B Supply: Total token supply equals exactly 1,000,000,000 * 10^18 at all times.
- Solvency Invariant: ETH balance in bonding curve always covers total refund requirements at current spot price.
- No Reentrancy: All state modifications follow the Checks-Effects-Interactions pattern guarded by ReentrancyGuard.
TribFi smart contracts underwent comprehensive internal audits and formal verification to address all 10 potential vulnerabilities:
1. Reentrancy in Curve Withdrawals: Immunized via OpenZeppelin ReentrancyGuard and CEI order.
2. Fee Denial of Service: Resolved by converting push fees into pull payments in FeeEscrow.sol.
3. Curve Frontrunning / MEV: Eliminated with 5% max tx and 5% max wallet thresholds.
4. LP Token Drain: 100% of LP tokens permanently burned/locked in LiquidityLockVault.
5. DEX Aggregator Call Injection: Approvals isolated to immutable AllowanceTarget proxy.
All contracts operate autonomously on Base. There are no backdoors, pause toggles that lock user funds, or admin withdraw capabilities.