Resolved-without-proof findings
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor counts the number of findings in the protocol's most recent audit report that are marked 'Resolved' or 'Fixed' where no corresponding on-chain bytecode change or verifiable commit can be identified. A finding is counted as unverified-resolved when the audit marks it closed, but the deployed bytecode at the audited commit hash shows no change consistent with the described fix. The data source is audit PDF cross-referenced against commit trails and deployed bytecode.
**Why it matters** Audit findings marked Resolved without on-chain proof create a false paper trail. Merlin DEX's CertiK audit marked a critical centralization risk -- maximum approval granted to a single EOA -- as Resolved after the team verbally promised to implement a multisig. The EOA was never replaced; the finding remained fully exploitable and was the direct vector for the $1.82M exploit. This pattern -- verbal or self-reported fixes accepted by auditors without on-chain verification -- is a documented class of false assurance. A protocol with multiple unverified Resolved findings has potentially fewer real security properties than its audit certificate suggests.
**Green / Yellow / Red** Green: all findings marked Resolved in the audit have on-chain proof of fix, either via a verifiable commit hash or a subsequent audit confirming the remediation. Yellow: one or two low-severity findings lack verifiable on-chain proof, but high and critical findings are all confirmed fixed. Red: any high or critical severity finding is marked Resolved without on-chain or commit-level proof of the fix.
**Common gray cases** Curators cannot grade this factor when the audit report is not publicly available or when the protocol does not publish source code with verifiable commit history, making it impossible to cross-reference stated resolutions against deployed code.
**Notable historical examples** The Merlin DEX case ($1.82M, 2023) is the clearest documented instance: CertiK accepted a verbal commitment of a multisig migration as resolution for a critical centralization finding; the EOA was never replaced and remained the direct exploit vector.
Measurement what to look for #
Count the number of findings the audit report marks "Resolved" or "Fixed" where no matching on-chain bytecode change or verifiable commit can be found.