From docs/audit/2026-09-19-reaudit.md:
- O-1 a 7-signature release (n >= 9) is 1,224 of 1,232 bytes, leaving no room for the compute-budget instruction; use stored bumps (
Config.bump is stored and unused), add an SBF-mode compute/size test at n = 10.
- O-2 no on-chain bound on a rotated set's size: a rotation to a set too large to release under freezes Solana custody until a program upgrade.
MAX_GUARDIANS is a parity rule (every verifier or none).
- O-3 no
SetPauser instruction (EVM has setPauser).
- O-4
Lock names ["msg", config.sequence], so dust locks grief concurrent honest locks; key the message account by (owner, nonce).
From
docs/audit/2026-09-19-reaudit.md:Config.bumpis stored and unused), add an SBF-mode compute/size test at n = 10.MAX_GUARDIANSis a parity rule (every verifier or none).SetPauserinstruction (EVM hassetPauser).Locknames["msg", config.sequence], so dust locks grief concurrent honest locks; key the message account by(owner, nonce).