Contract Audit Registry - zeroauthority-dao/mission GitHub Wiki
Security Registry, Audit Archive, and On-Chain Contract Index
Overview
This wiki serves as the canonical protocol security registry and audit archive for the Zero Authority ecosystem.
It exists as a permanent institutional record for:
- Smart contract audits
- Security lineage
- Interface consistency history
- Critical vulnerability disclosures
- On-chain deployment references
- Cross-chain contract registries
- Governance traceability
- Forensic anchoring
- Protocol archaeology
- Incident response grounding
- Long-term protocol memory
This documentation is not a bug tracker. This documentation is not a feature roadmap. This documentation is a protocol integrity archive.
Audit Registry
All protocol audits are conducted by Friedger.
Quests & Treasury Contract Audit
https://github.com/zeroauthority-dao/platform-v2-base/blob/main/audits/quests.html
Gig Marketplace & Bounties Contract Audit
Interface Consistency Archive
Reported by: BowTiedSirJonathan Date: June 26, 2025
Issue Description
The tokenBased-bounties and nft-bounties smart contracts expose equivalent functionality with differing argument order. This does not affect contract correctness but introduces interface inconsistency across similar contract surfaces, increasing user error risk and developer friction.
Wallet extensions preserve argument labeling, maintaining functional clarity despite ordering differences.
Resolution
Resolution Commit https://github.com/zeroauthority-dao/platform-v2-base/commit/54b7f45
Status Resolved. Preserved for historical traceability and interface lineage documentation.
Security Disclosure Archive
Critical Vulnerability Record
Severity: Critical Affected Component: Gig contract Impact: Contract fund drainage risk
Description
A critical vulnerability was discovered that enabled draining of the gig contract. This represents a security-class financial exploit vector and a funds-at-risk protocol failure mode.
Purpose of Record
This disclosure exists to preserve:
- Permanent incident traceability
- Governance transparency
- Security lineage continuity
- Risk model completeness
- Future auditor visibility
- Protocol forensics integrity
- Institutional memory
This is a disclosure archive record. This is not a live exploit report.
On-Chain Contract Registry
Stacks + BASE (Ethereum L2)
This section is the canonical on-chain contract registry for all Zero Authority deployments.
Purpose:
- Forensic traceability
- Audit verification
- Governance transparency
- Security anchoring
- Deployment lineage
- Protocol archaeology
- Incident response grounding
- Cross-chain verification
Stacks Mainnet — v1 Contracts
Cerulean-Marketplace-v1
Cerulean-NFT-Bounties-v1
Cerulean-SIP10-Bounties-v1
Cerulean-badge-test
https://explorer.stacks.co/txid/SP1ZCYG0D3HCK2F7SY8VH9ZREB0JWCBSAPFNS8V5Z.Cerulean-badge-test
Stacks Mainnet / Testnet — v2 Contracts
ZADAO-token-whitelist-v1
https://explorer.stacks.co/txid/SP2GW18TVQR75W1VT53HYGBRGKFRV5BFYNAF5SS5J.ZADAO-token-whitelist-v1
trajan-endorse-v0_1_0
https://explorer.stacks.co/txid/SP25W1B7YX3F20S598J4EXEE9HZ0XHY6PNVTT6FA3.trajan-endorse-v0_1_0
BASE (Ethereum L2) Registry
Deployment Registry Files
Base Sepolia Testnet
Base Mainnet
BASE Contracts (BaseScan)
ZADAO-V2-MultiW-Bounty
https://basescan.org/tx/0d05df760fecd5d8a2719adbce5d7f2223c555304e71d3752fbebb246096dfb3
ZADAO-V2-gigs
https://basescan.org/tx/0x11822932a28fb1f3a035e4df718718e04e626fcc9246cb0b6f45c82627c100fb
ZADAO-V2-token-bounties
https://basescan.org/tx/0xe928afa87c5df3fc0c24d82765f50ee1fe20f83b8277c1a378e8c765746f8746
za-dao-endorsement (testnet)
https://sepolia.basescan.org/tx/0xba0b8028ffb8b6760950e06aef9edb965ea60d23609e24d12220b5166ad38842
Active Production Configuration
ZADAO-V2a-gigs
https://basescan.org/tx/0x00ffda6e14c66e295226fe08bfdfd4dc5e8f53219c706b0437cd3afab066270b
ZADAO-token-whitelist-v2
https://basescan.org/tx/0x58104148bac708519cc7d6fd3795d449bc3489c536b802a7d15902c56ef4d50c
Production Mapping
Gigs → ZADAO-token-whitelist-v2 Bounties → ZADAO-token-whitelist-v1
Ethereum Mainnet Registry
ZADAOTokenWhitelistV1 (ETH)
https://etherscan.io/address/0x32D0BBC22211CF387F23CFA87AaDdFe3DAc18FCE
Pull Request Reference
https://github.com/zeroauthority-dao/platform-v2-base/pull/45
Source Code Reference
Stacks Mainnet — Quests & Treasury
ZADAO-Quest-V1
ZADAO-Treasury-V1
Protocol Memory Statement
This wiki is designed as a permanent protocol memory layer.
It encodes not only deployments, but history, risk, governance accountability, security evolution, and institutional memory as first-class infrastructure.
The protocol is treated not as software alone, but as a living system with lineage, failures, corrections, and continuity preserved through documentation.