Fork retains upstream audit coverage
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor assesses whether the fork's audit coverage is adequate for its deployed code, specifically whether: (a) the upstream audit covers the portions of code the fork shares with the upstream, AND (b) any diverged portions (identified by RD-F-129 code divergence) have been covered by either a fresh fork-specific audit or a documented delta-review. The data source is audit PDFs combined with bytecode diffing against the upstream.
**Why it matters** A fork protocol that relies on the upstream's audit without its own review of diverged code has a false audit signal. Cork Protocol ($12M, 2025) is the sharpest example in the dataset: four separate audit firms reviewed the protocol across multiple rounds, yet the specific CorkHook contract that was exploited was outside at least three firms' scope. The protocol's management of a complex fork with multiple audit firms failed to cover the single most critical contract. For fork protocols specifically, the question is not 'has the protocol been audited?' but 'is the audit coverage continuous from the upstream through all divergence points to the deployed bytecode?'
**Green / Yellow / Red** Green: either (a) the fork divergence is below 10% and the upstream audit explicitly covers the shared code, or (b) the fork has a dedicated independent audit covering all deployed code including all diverged portions. Yellow: the fork has a delta-review or spot-review of the diverged portions but no full audit of the fork as a whole. Red: the fork relies entirely on the upstream's audit with no coverage of its own diverged code, or the diverged code exceeds 40% and no audit of any kind covers the fork-specific portions.
**Common gray cases** This factor is gray when audit PDFs are not publicly available and audit scope cannot be assessed, or when the fork origin cannot be confirmed to map the divergence.
**Notable historical examples** The factor functions as the integrated audit-coverage signal for the Cat 8 lineage assessment.
Measurement what to look for #
Determine whether the fork's deployed code is covered by either: (a) the upstream audit plus a delta-audit for fork-specific changes, or (b) a fresh independent audit of the fork.