DiscordNFT Collection
LYNX

Security

LP Range Manager — Release gate sign-off (2026)

Last updated September 30, 2026

Manifest

Release SHA: 37f0ee2f2bc7134669c15c02170bc5a11b4fa0f5 (short 37f0ee2)

Branch: release-gate-lp-range-manager

Layer B (paged harvest) + Layer C (LP Range Manager) on this branch, atop Layer A (already on mainnet).

Audited stack 164880a (mainnet-deployment merge), baseline ca33ab4 — both ancestors of release SHA.

In-scope production contracts

  • LynxLpAllocator.sol — RangePolicy, rebalanceOne, OOR gates, emergency widen/unwind
  • LynxKeeperRouter.sol — OPS_PHASE_COUNT = 6, phase 3 _rangeOps(), phase 0 paged-harvest hold
  • SaucerSwapLiquidityStrategy.sol — paged harvest + rotateClosePosition
  • libraries/LpRangeMath.sol, libraries/TickMath.sol
  • interfaces/ILynxLpAllocator.sol, interfaces/ILpHarvestPaged.sol

LynxVault, LynxHTSBridge, StrategyManager, LynxCompositeStakingStrategy, LynxStakingAllocator, governance — bytecode unchanged; StrategyManager push/pushSplit/reportGain used as-is.

Verification results (at manifest SHA)

  • §1 PT-010–030 remediation: 21/21 PASS
  • §2 PT-001–009 CONTEXT audit: 72/72 PASS
  • §3 CI deterministic replay: compile, lint, 580 tests, property fuzz 2000 runs — PASS
  • §4 Compound scenarios: 5 PASS + 2 PASS (doc)
  • §5 Governance / emergency ACL: 8/8 ACCEPT
  • §6 Accepted-risk falsifier: 3/3 PASS

Verdict: GO with waivers

Manifest SHA 37f0ee2 on branch release-gate-lp-range-manager.

Waivers

  • Echidna: Optional toolchain not run in gate budget; Hardhat property fuzz (2000 runs, seed 42) covers deterministic replay.
  • Halmos: Optional toolchain not run in gate budget; owner accepted waiver.
  • T-2 third-party liquidity: 2026-09-30 testnet: non-owner contract increased NPM liquidity without updating strategy bookkeeping. PT-012 decrease-before-burn is the control (unit-tested).

Testnet items (post-signoff execution)

  • T-1 OOR rotate testnet: PASS (2026-09-30)
  • T-3 Full accelerated HSS 0→5→0 cycle: PASS (2026-09-30)
  • T-2 donation probe: donation confirmed (not an ACL pass)

Disposition

Signed off at manifest SHA 37f0ee2 with waivers above. This is not mainnet deploy approval — cutover still requires redeploy/migration playbooks and merge to main. Post-gate keeper fixes (PT-031+ pool field) land in merge commit, not as a silent waiver.

  • No FAIL at manifest SHA across remediation, CONTEXT audit, compound scenarios, ACL, and falsifier sections.
  • Required deterministic gates: solc 0.8.28 compile, nav-no-oracle lint, 580 passing tests, property fuzz — all exit 0.
  • Emergency widen/unwind + freeze remain owner/timelock-direct, not DAO-proposable — matches trust model.
  • Follow-ups: PT-031+ keeper LPPosition pool field; merge branch to main with post-gate fixes included.