Security

• MeridxVaultFactory0xa0f5…228D
  No authority
• MeridxVaultDeployer0x3529…6388
  No authority
• MeridxBeacon0x6600…0828
  Guardian
  upgradeTotransferOwnershiprenounceOwnership
• MeridxVault0x5b46…8a0D
  Guardian
  emergencyWithdrawNativeemergencyWithdrawTokensetAutoForward
• MeridxText0x374e…DA11
  No authority

What a rescue does to loans

• 01
• 02
• 03
• 04
• 05
• 06
• 07
• 08
• 09
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• 51
• 52
• 53
• 54
• 55
• 56
• 57
• 58
• 59
• 60
• 61
• 62
• 63
• 64

1. G01commission is revenue x 6 / 200
2. G02a loan is at most 30% of the collateral value
3. G03outstanding principal stays under the pair cap
4. G04the first reference is no higher than the listing price
5. G05the reference rises at most 5% per daily close
6. G06a repaid loan releases its share of the 24-hour window
7. G07only the locked share of the pair counts
8. G08the exit is measured behind pending tax and locked collateral
9. G09defaults keep occupying the pair cap
10. G10settle only strictly after due + grace
11. G11a same-block pump does not raise the value
12. G12vaultData must be empty
13. G13buy tax must be 200 bps
14. G14interest is charged by started hour
15. G15repay stays open until the loan is settled
16. G16only the Guardian can drain native
17. G17the beacon belongs to the Guardian
18. G18the listing price is lockedLP^2 / seeded^2
19. G19reserves are oriented (token, quote)
20. G20locked reserves are oriented (token, quote)
21. G21a failed forward never reverts receive()
22. G22borrow is non-reentrant
23. G23only the Guardian can move tokens
24. G24a quote rescue rebases the ledgers at once
25. G25a shortfall is shared in proportion
26. G26BNB attached to repay is not revenue
27. G27only a PancakeSwap V2 pair is priced
28. G28an overflowing listing price reads as unreadable
29. G29interest is charged for at least a day
30. G30one open loan per address
31. G31a USDT vault refuses BNB on repay
32. G32the excess over owed is refunded
33. G33the window spans 24 clock hours
34. G34a view previews exactly what a poke would store
35. G35a launcher commission is shown
36. G36quoteBorrow reads 0 below the minimum loan
37. G37disarming the forward clears its target
38. G38only the VaultPortal creates vaults
39. G39one vault per token
40. G40repay's schema input is msg.value
41. G41the implementation cannot be initialized
42. G42USDT is a supported quote
43. G43a second default rebases what is left
44. G44the settler gets 1% of the collateral
45. G45the commission goes to the platform
46. G46the schema text states the constants
47. G47no dividend leg at launch
48. G48a tax-free token is valued without sell tax
49. G49the beacon refuses unsupported chains
50. G50owedAt charges by started hour from the start
51. G51only the trigger service may call trigger()
52. G52only the pending request id is accepted
53. G53the pending id is cleared before any work
54. G54a dispatch needs at least the minimum loan of tax
55. G55a sync for revenue needs at least the minimum loan waiting
56. G56the daily close is due only 24 hours after the anchor
57. G57a vault whose pair is not live is not synced for its clock
58. G58the lap keeps the schedule reserve in hand
59. G59the cursor resumes where the lap stopped
60. G60an incomplete lap comes back at the active cadence
61. G61kick waits for a pending request unless it is stale
62. G62an unfunded tick goes idle instead of reverting
63. G63the fee is read from the service at each slot
64. G64a failed leg's reason is truncated

• Inheritance
• receive()
• ERC-20 quote accounting (rule 010)
• description(), schemas and factory
• Guardian and fairness
• Errors and oracles
• Emergency controls
• Tests

These contracts have not been audited. The self-check is by the authors. It is not an audit.