Security Audit Report

Tier

Standard ($29)

Model

Sonnet

Specialists completed

8 of 8

Executive Summary

The analyzed contract is a LiquidInfrastructureERC20, an ERC-20 token that manages distributions of revenue from associated NFTs to approved token holders. The analysis identified 0 critical, 8 high, 7 medium, 6 low, and 3 informational findings across 24 total submissions. The most dangerous pattern is the combination of an unbounded holders array with DoS-enabling logic errors in holder management, distribution locking, and a permanently-stuck LockedForDistribution state triggered by any reverting ERC20 transfer, which can render the contract completely inoperable. The contract in its current form carries substantial operational risk and should not be considered safe for production deployment without significant remediation of its distribution, holder management, and state machine logic.

Critical Highlights

Decentralization

Attack Chain Analysis

Agent Coverage

Scope and Methodology

Severity Classification

Limitations

This automated audit has inherent limitations. The following areas are not covered.

• -Business logic correctness: The audit can detect deviations from expected patterns but cannot verify whether the distribution entitlement model, approval gating, and minimum distribution period are economically correct or aligned with the protocol's intended revenue-sharing rules.
• -Off-chain component security: The security of admin key management, keeper bots responsible for calling distribute() and withdrawFromManagedNFTs(), and any multisig or governance infrastructure controlling the owner role are entirely outside the scope of this analysis.
• -Economic modeling: The viability of the revenue distribution model, the impact of token supply changes on entitlement values over time, and whether the precision loss in entitlement calculations meaningfully harms token holders at realistic supply and balance values cannot be determined by static analysis alone.
• -Cross-protocol composability: The security of external ERC-20 tokens listed in distributableERC20s is not analyzed. Malicious, upgradeable, or fee-on-transfer tokens introduced by the owner could alter the behavior of distribution in ways not covered here.
• -Governance social dynamics: The single-owner model with no timelock means the owner can call setDistributableERC20s, approveHolder, disapproveHolder, and addManagedNFT at will. The analysis identifies the on-chain impact of these powers but cannot assess the trustworthiness or operational security of the key holder.
• -LiquidInfrastructureNFT dependency: The security of the LiquidInfrastructureNFT contract and its withdrawal mechanics are analyzed only at the interface level. Internal vulnerabilities in that contract's _withdrawBalancesTo or threshold management that do not surface at the ERC20 call boundary may not be fully captured.