41 findings.
All resolved.

OMEGA V4: assume every guarantee is a lie

OMEGA V4 is Kairos Lab's internal adversarial audit framework. It is not a checklist. It's a mindset: assume every guarantee the compiler claims to enforce is a lie, and try to prove it. The question is never "does the source look right?" — it's "does the emitted bytecode contain the bytes the source promised?"

• Phase 1
  Reconnaissance Map the full attack surface. Parse every crate. Identify every place where source intent becomes bytecode — every opcode, every emit path, every optimization pass.
• Phase 2
  Adversarial deep-dive For every guarantee the compiler claims, construct a source program that should work but the compiler silently breaks. Look at the actual bytecode. Verify the emitted code provides the guarantee.
• Phase 3
  Reproducible PoCs For each finding, produce a minimal working example. Compile it. Simulate deployment. Show — with annotated bytecode — exactly how the bug manifests in production.
• Phase 4
  Remediation Fix each finding with a regression test. The test alone, without the fix, must fail. The test with the fix must pass. No exceptions — every finding has a corresponding test that would have caught it.
• Phase 5
  Re-audit After all fixes are merged, re-run every PoC. Verify no regressions. Look for new attack vectors that fixes might have introduced. Confirm the compiler is clean before GA.

Five failures that would have made every contract a honeypot

These findings share a pattern: the source looked correct, the tests passed, the contracts deployed — but the generated bytecode did not enforce the guarantee the source promised. Silent codegen failures are the worst class of bug.

; withdraw_all() — NO ACCESS CHECK
JUMPDEST
PUSH1 0x00
SLOAD         ; load balance
CALLER        ; push msg.sender
; (transfer — no guard before it)
PUSH1 0x00
PUSH1 0x00
SSTORE        ; clear balance
STOP

; withdraw_all() — GUARDED
JUMPDEST
CALLER        ; msg.sender
PUSH32 …      ; stored owner
SLOAD
EQ
ISZERO
PUSH2 revert  ; revert if ≠
JUMPI
; (transfer follows)

Eight high-severity issues

High findings caused incorrect or insecure behaviour without being fully exploitable in isolation. Several had been present since early compiler versions with no visible test failures.

23 further findings — the long tail of defense

Medium findings affected correctness and developer safety. Low and Informational findings strengthened tooling, diagnostics, and supply chain. All resolved before V0.7 GA.

Four lessons that change how we write tests

• Lesson 1
  Test the bytes, not the source For every safety guarantee your compiler claims, write a test that inspects the emitted bytecode and asserts the exact opcode pattern. only(owner) should produce CALLER + EQ + ISZERO + JUMPI. If it doesn't, the test fails — not because the source looked wrong, because the bytes are wrong.
• Lesson 2
  Asymmetric tests catch operand ordering bugs Every test with symmetric values (Add(3,3), Eq(5,5)) would pass even if operands are reversed. We now test every binary op with asymmetric pairs (Sub(10,3) vs Sub(3,10), Lt(2,7) vs Lt(7,2)).
• Lesson 3
  State machines must be enforced at the bytecode level Writing state = Phase2 in a function body doesn't protect you if the function can be called when state is Phase0. Every transition needs a precondition check compiled into bytecode — not documented in source, not enforced by convention.
• Lesson 4
  Defense in depth for external calls STATICCALL has three failure modes: success flag, return data size mismatch, revert. Check all three. If any single check would have caught CVN-013 or CVN-014 alone, the exploit would have been impossible. That's what defense in depth means.

What V0.7 does not yet support

Shipping broken stubs is worse than shipping nothing. These features are deliberately disabled until they can be implemented correctly.

Everything is public. PoCs included.

The full OMEGA V4 report is public at github.com/Valisthea/covenant-audits. Every finding has a finding ID, severity, description, annotated bytecode PoC, remediation commit, and regression test. If OMEGA V4 missed something, that's a welcome problem — the bounty program is in the same repo.