# Working notes — audit of Jing deployment set @ df091b8

Competitive pass over the post-`d4ac0c4` delta and the router/vault layer.
Prior-bounty review (`contracts/README-audit-core-spread-v1-bounty.md`)
records 10 submissions: withdrawal overflow + aged sizing accepted
(fixed in `b41dbd6`/`ee2edde`, both inside this diff); the vault sBTC
allowance claim (Shark F1, Pure Leo, Photon Warden duplicates) rejected
as "not established on the actual vault/router path" — explicitly left
open only for a repro through the real sizing path.

## Dead ends (each verified before discarding)

1. **`d8b01e4` dropped `current-proceeds` flush — VACUOUS, not a bug.**
   The removed `close-epoch` paid `current-proceeds` to the last member.
   But `epoch-payout` already returns `current-proceeds` in full when
   `(var-get members) == u1`, and `settle-proceeds` runs before the
   member count is decremented — so the last member was always paid the
   remainder first, making `close-epoch`'s `owed` always `u0`. The
   `members==1` sweep exists identically at `d4ac0c4` and on the
   sell-side mirror. Verified by `git show` + reading `settle-proceeds`.

2. **DLMM variable fee mid-swap divergence — does not exist in Bitflow.**
   Fetched `dlmm-core-v-1-1` source: `x-variable-fee`/`y-variable-fee`
   are stored pool fees set by `variable-fees-manager` under cooldown
   (`set-variable-fees`, `reset-variable-fees`), constant within any tx.
   The router's static-fee walk model is therefore correct.

3. **Walk limit unit mismatch — handled.**
   `dlmm-capacity` threshold = `PRICE_SCALE*DLMM_PRICE_SCALE/limit`
   (1e10·1e8 reciprocal), fee-adjusted in the right direction
   (`(BPS-fee)/BPS` for up, `BPS/(BPS-fee)` for down). Per-bin
   `raw`/`grossed` are byte-for-byte the core's `max-x/y-amount` and
   `updated-max` formulas. Empty/one-sided bins pass free in both the
   model and the core's `updated-active-bin-id` rule.

4. **Router pull accounting — airtight.**
   `jing-spent = amount - token-x-rolled - rebate-refunded` where
   `token-x-rolled` in the swap result is the **post-walk** `rem` from
   `cross-remainder`, so a residual sold into next-cycle bids is counted
   as spent. `residual` therefore never exceeds what returned to the
   wallet; total pull ≤ `amount`. The `+min-x+u51` vault budget is pure
   headroom — consistent with the maintainers' rejection of F1.

5. **Capacity quote vs batch cross — consistent.**
   `mid-cap = kept-opposite - own-in-range`, `walk_cap` mirrors
   `walk-*-book-step` bounds (`limit ≤ l < mid`, `amt ≥ min`, excludes
   taker). `min-taker = smallest+1` matches `park-tenth`'s `(> size
   smallest)`. Quote and swap run in one tx on identical book state, so
   the only divergence is caller-hint `mid` — self-inflicted, documented.

6. **`gross-up`/`net` rounding — exact maximal gross, verified
   algebraically** (`floor(((n+1)(B+r)-1)/B)` is the largest g with
   `floor(gB/(B+r)) ≤ n`).

7. **`cp-split` rounding** can give `velar` `cap+1` — inside the 20 bps
   `CP_SAFETY` headroom, cannot trip the venue minimum.

8. **Ladder v1 seat/replace/retire + band-count** — symmetric
   increments/decrements; `registered` rows survive replacement so
   historical withdraws still validate; dispatch's side-string keys
   (`buy-band`/`sel-band`) confirmed intentional.

9. **Dispatch v1** — subtractive budget (no overflow), duplicate check,
   seat check for deposits vs historical registration for exits,
   `tx-sender == contract-caller` guard, atomic fold — all consistent.

10. **Vault batch lifecycle** — `is-empty` covers wallet + live + parked
    + pending; DUST_SATS (u2) donation case handled by sweep semantics;
    `emergency-recover` is oracle-free; `router-swap-split`'s missing
    `+51` is safe because `fallback: none` keeps the residual unrouted.
    `get-no-pyth-price` native fallback uses `mid/2` floor — extreme but
    a documented degraded-mode choice.

11. **`dlmm-pick` balance heuristic** — real weakness (picks by total
    bought-asset balance, ignores limit/price) but **already filed**
    (Nilo; master README documents the "best payout for leg amount"
    successor). Not re-claimed.

12. **Member-pays-Lazer-fee on escrow settle in rung `withdraw`** —
    kept as I-1 informational: `settle-escrow` is a plain call so
    `tx-sender` = member pays any nonzero oracle fee. Cosmetic at `u0`.

## What produced L-1

`pyth-lazer-oracle.verify-price-feeds` (deployed source fetched from
Hiro API) ends with `charge-fee` → `(stx-transfer? fee tx-sender
recipient)` for `fee > u0`. Market `swap` calls it via `lazer-feeds`
inside every swap. In the vault's `as-contract?` scope `tx-sender` is
the vault and only `(with-ft SBTC ...)` is granted → a nonzero fee makes
the call abort. `citycoins-protocol/contracts/deployed/jing-vault.clar`
budgets `(with-stx PYTH_FEE_BUDGET)` for the identical pitfall (comment
L42-50) — the newer juice/fastpool vaults dropped it. Mainnet `get-fee`
queried live: `u0` → conditional/latent.

## Not executed

No Clarinet/fork run: L-1's trigger is a governance-only `set-fee`
call; I verified the charge path and the missing allowance from source
plus an on-chain `get-fee` read instead.