MONAF · Engineering record · 24 October 2026

Security audit

The agent can trade. It cannot take the MON out. Anything this page cannot prove, it does not sign.

This is the record of the velocity desk in this build. It is not a third-party audit, a formal proof, or a promise of profit. A loss inside the minimum is a fill.

Read this first

Six things that still matter

Everything else on this page is the map. These are the bounds a reader should leave with.

01
Residual
The agent key is online
Script on this site can read it. It still cannot release the MON.
The key exists so a called card can trade without a second prompt. It may only deposit, swap back into its own vault, or unwrap WMON that vault already holds. Withdraw, transfer, and a bare send are refused before signing. A stolen key used outside this page can still choose a weak minimum. The creator wallet is the only release.
02
Residual
A searcher can move the price inside 2%
The minimum stops a zero fill. It does not stop a worse fill inside the band.
There is no private mempool. A single-call swap has no separate deadline, because a hidden second call would be the worse bug. Two hosts must agree within 2%, and the lower quote sets the floor. A move inside that band can be taken.
03
Residual
Two nodes can lie together
One lying node is not enough. Two are.
Reads hedge across six endpoints. A quote is checked on a second host. A base fee above 1,000 gwei is ignored, and the tip stays 2 gwei. If both hosts are wrong, the desk believes them. A display balance can be ten minutes old and is never what gets signed.
04
Residual
One creator wallet
Whoever can sign as the creator can take the MON back. There is no second signer.
Return pays the owner already stored on the vault. The user does not type a destination. There is no timelock. Phishing that creator wallet is the release path. The agent cannot invent a new owner.
05
Outside
The vault and the router are trusted code
This page checks the client. It does not re-prove their bytecode.
The factory, the vault, the Pancake router, WMON, and the pinned tokens are assumed to be the contracts at those addresses. An admin upgrade, a token tax added later, or a bug in that bytecode is outside this record. The client’s containment is that the agent still cannot call withdraw.
06
Residual
A card can be a bad trade
The rules can refuse a thin pool. They cannot refuse a bad idea that clears them.
The tape can show a card. It cannot set the token, the recipient, or the minimum. No control here is a promise of profit. A loss inside the minimum is a fill, not a bug.

Custody

Where the MON sits

Deleting the site does not delete the vault. The agent is a trader, not an owner.

1Creator walletOwns the vault. The only key that can release.
2VaultHolds the MON and the position. Deleting the site does not delete it.
3Agent keyCan swap back into that vault. Cannot withdraw.
4ReturnPays the owner the vault already stores. No address is typed.

The key is kept in three places. If the local copy is damaged, the session copy is kept. A new key is created only when all three are empty, and it cannot overwrite a backup that is still there.

A send

What has to be true before a signature

Miss one of these and the desk does not sign. A guessed gas limit, a zero minimum, and a wrong chain id are all misses.

Right vault
The address names this browser as agent and this wallet as owner. A saved address that fails that read is deleted.
Right call
Only the known router, or WMON to unwrap. The swap pays the vault. The tokens are the pinned ones.
Right minimum
Above zero, and the same number in the swap and in the vault guard. A buy attaches exactly that size. A sell attaches none.
Right price
Two hosts, within 2%. The floor is the lower quote. An empty quote sends nothing.
Right chain
The node’s chain id must be the Monad network this desk was built for. Simulation must answer. A guessed gas limit is not used.
Right pace
One trade at a time. The same close cannot be sent twice. A nonce more than one ahead of the chain is resynced. A paused agent is resumed by the creator, or skipped.

When something is down

The desk stays up. The send does not bluff.

A slow node, a rate limit, a dead tape, or a broken screen must not look like a filled trade.

Nodes. The first endpoint is used at once. If it is silent, the next starts. One rate limit does not freeze the others. Six endpoints. A broadcast is raced. The first acceptance wins.
Stale reads. A balance can be shown from the last good answer for ten minutes. Sending does not use that cache.
Feeds. If the tape fails, the last tape stays, including after a reload. A card still cannot set the price that is signed.
The page. One screen can throw without taking the header or the bar. A script chunk that fails to load reloads once.

Case file

The incidents that named the class

Open a case for what happened, what this desk does, and what is still true. None of these is a re-run of the original hack.

Reentrancy, The DAO, 2016

What happened: A withdraw call sent ETH before it wrote the balance down. The receiver called back in and withdrew again. About 3.6 million ETH moved.
On this desk: The desk never writes its own vault. Swaps pay the vault, then the receipt is waited on. A second close of the same fill is refused while the first is in flight.
Still true: The vault bytecode itself is not re-audited on this page. A bug inside that contract is outside the app checks.

Uninitialised wallet and a killed library, Parity, 2017

What happened: One wallet was left uninitialised, so anyone could become its owner. A second bug let a library be destroyed, freezing funds in every wallet that pointed at it.
On this desk: A cached vault address is ignored unless the contract says this wallet is the owner and this browser is the agent. The desk key cannot call an arbitrary contract.
Still true: The factory that deploys the vault is trusted. This page does not re-verify its bytecode.

Integer overflow, batchOverflow, 2018

What happened: A token transfer multiplied amount by balance and wrapped past the type limit, minting a huge balance from a tiny input.
On this desk: Trade sizes are bigints. A zero output, a zero minimum, and a minimum that does not match the swap are refused before signing.
Still true: A malicious token with its own overflow is not in the trade set. Only the known WETH, WBTC, cbBTC and WMON addresses are allowed in a desk swap.

Hot wallet theft

What happened: Exchanges kept withdrawal keys online. One server breach emptied the hot wallet. The pattern repeats from Mt. Gox onward.
On this desk: The private key is never shown and never leaves the signer. At rest it is sealed, so storage is not a usable key. The only bare MON it can sign goes to the vault owner, read from the contract. It cannot withdraw the vault.
Still true: This is still a hot key. Script that replaces this page can still ask it to sign. The vault contract, not the page, is what stops a withdrawal.

Unlimited token approval

What happened: Wallets approved a router for the maximum uint256. A later bug or a malicious spender could pull every token, not just the trade.
On this desk: A wallet sell approves only the quantity of that sell. A vault sell approves no more than the swap amount, and only the known router.
Still true: An approval already sitting on the router from an older session is not revoked by this page.

Approval front-run

What happened: Changing an allowance from 10 to 5 could be front-run: the spender pulled 10, then the new allowance of 5 let them pull 5 more.
On this desk: The desk does not edit an existing allowance. It approves the exact size when the allowance is short.
Still true: A token that does not follow the usual approve semantics is not used here.

Oracle and flash-loan price manipulation

What happened: bZx, Harvest, Mango and others priced a position from a pool the attacker could move inside one transaction, then borrowed against the fake price.
On this desk: A fill price is an on-chain quote, then a second node must agree within 2%. The minimum is built from the lower quote. The tape does not settle the trade.
Still true: Both nodes can be wrong together. A thin pool can still move inside the 2% band. Social and exchange prints are signals, not prices.

Sandwich and missing slippage

What happened: A swap with a zero minimum, or no deadline, can be surrounded. The attacker buys first, the victim pays the worse price, the attacker sells.
On this desk: A desk swap with a zero minimum is not signed. The recipient must be the vault. Two nodes must agree before that minimum is set.
Still true: One percent of room remains inside the band. There is no private mempool. A delayed transaction can still land later if the price is still inside the minimum.

msg.value reused inside a multicall

What happened: Some routers counted the same attached MON twice when two calls in one multicall both read msg.value. The caller was over-credited.
On this desk: The desk swap is one exactInputSingle, not a multicall. A buy must attach exactly the swap size. A sell must attach zero.
Still true: Wallet-direct MON sells still use the router multicall to unwrap. That path pays the connected wallet, not the vault, and the minimum is still required.

Delegatecall and an open target

What happened: A contract that delegatecalls a user-supplied address runs the attacker code in its own storage. That is a common drain.
On this desk: The desk may call only the Pancake router for a swap, or WMON for an unwrap. Any other target is refused before the key signs.
Still true: This is an app check. A stolen key used outside the app is limited by the vault contract, which is a separate line of defence.

Missing access control on withdraw

What happened: Functions named withdraw, emergencyWithdraw or sweep were left public. The first caller took the balance.
On this desk: The desk key is rejected for withdraw, withdrawToken, emergencyWithdrawAll and transfer. Tests cover those selectors. Only the creator release path builds them, and it pays the creator.
Still true: The creator wallet can still be phished into signing a release. The app cannot stop a signature the wallet shows the user.

Bridge and trusted-relayer theft

What happened: Wormhole, Ronin, Nomad and Poly failed in different ways: a signature check, a compromised validator set, a trusted root, an unbounded message. The pattern is a second system that can mint on the far side.
On this desk: This desk does not bridge. It does not mint. A swap stays on Monad, and the output address is the vault.
Still true: MON itself can arrive from a bridge. This app does not inspect that origin.

Frontend hijack, Badger, 2021

What happened: The website was altered so users signed approvals to an attacker. The contracts were fine. The page was not.
On this desk: A changed vault address in local storage is dropped unless owner and agent match. The key is also kept in the session and in IndexedDB, and a damaged copy does not overwrite a good one.
Still true: If the real site or a dependency is replaced, those checks are replaced with it. Host the page, pin the dependency, and treat a surprise wallet prompt as hostile.

Permit and blind-signature phishing

What happened: Users signed permit, Permit2 or eth_sign payloads that looked like a login and were a transfer. No gas was needed from the victim.
On this desk: The desk key does not sign permits. It signs one vault call, one deposit, or one profit transfer to the owner. The payload is decoded before it is signed.
Still true: The creator wallet can still be asked to sign a permit by any site. That is the wallet’s prompt, not this key.

Signature replay

What happened: A signature without a chain id, nonce or deadline was reused on another chain or another contract.
On this desk: Each desk trade is an EIP-1559 transaction with chain id 143 and a fresh request id. A used id is rejected by the vault.
Still true: The request id has 6 random bytes. A collision retries. It does not replay.

ERC-4626 inflation

What happened: A vault with no shares was donated a huge asset balance, so the next depositor’s shares rounded to zero and the donor took the deposit.
On this desk: Velocity does not mint shares. It swaps into WETH, WBTC or cbBTC and holds them in the vault.
Still true: aprMON and other staking tokens elsewhere in the app are external contracts. Their share math is not this desk.

Read-only reentrancy

What happened: A view read a pool mid-callback, before reserves were updated, and a second protocol trusted that view.
On this desk: The desk does not lend against a view. A quote is checked, then the swap itself enforces the minimum.
Still true: A quote and the later block can differ. Disagreement above 2%, or a revert in simulation, sends nothing.

Proxy admin and uninitialised implementation

What happened: An implementation left initialise public, or the admin slot was taken. The new admin upgraded the proxy and drained it.
On this desk: The desk does not upgrade contracts and does not call initialise.
Still true: If the vault factory were upgraded by its own admin, this app would be talking to new code. That admin is not this user.

Supply-chain compromise

What happened: event-stream, ua-parser-js and the Ledger Connect Kit were poisoned. The page users loaded was not the page the authors shipped.
On this desk: The fund checks live in the client that is shipped. A poisoned dependency can remove them. There is no second, on-phone verifier.
Still true: Lock the install, read the diff, and do not treat this page as a substitute for that.

Malicious or eclipsed RPC

What happened: A wallet pointed at one node. The node lied about balances, simulation, or chain id. Users signed against a fake state.
On this desk: Reads hedge across six endpoints. One slow node does not hold the desk. A quote must match a second host within 2%. A failed simulation is not replaced with a guessed gas limit.
Still true: Two colluding nodes can still agree on a lie. Display reads may show the last good answer for ten minutes. A send does not use that cache.

Stuck nonce and dropped transaction

What happened: A wallet incremented its nonce, the transaction vanished, and every later transaction waited forever. The account looked frozen.
On this desk: If the local nonce is more than one ahead of the pending count, the desk resyncs. A send that never returns stops blocking the lane after 25 seconds.
Still true: A transaction that is still in the mempool is left one ahead on purpose, so a replacement is not fired on top of it.

Double execution

What happened: A timeout was shown as a failure. The user, or a bot, sent the same trade again. Both landed.
On this desk: While a trade is unconfirmed, a second send is refused. The same close cannot be submitted twice at once. A called card that has already filled leaves the stream.
Still true: A second device with the same key is not coordinated. Use one browser for the desk key.

Paused-agent denial of service

What happened: A pause flag made every later call revert. The product looked broken, and a naive retry loop burned gas on Monad, which bills the gas limit.
On this desk: The desk reads paused() and, if the creator wallet is connected, resumes before the trade. A revert is simulated first, so a failed call is not broadcast.
Still true: Resume needs the creator wallet. Without it, the trade is not sent and the MON stays in the vault.

Rate-limit and dependency failure

What happened: One HTTP 429, or one dead endpoint, stalled every read. The app looked down. Users retried into worse state.
On this desk: A 429 retries once and does not freeze the other calls. The queue is capped. If every endpoint fails, a recent balance read is shown. The shell stays up if one screen throws. A bad script chunk reloads once.
Still true: After ten minutes with no live node, reads fail closed. Nothing is sent into that silence.

Off-chain tape treated as a fill

What happened: Bots that trusted a printed price, a tweet, or a candle traded into an empty pool. The print was never the market.
On this desk: Binance, Coinbase, Stocktwits and the pool tape can show a card. They cannot lower the on-chain minimum. No card trades twice, and a card that does not clear the round trip is not offered.
Still true: A card can still be a bad idea inside a pool that is merely thin. The minimum protects the fill, not the decision.

Local storage as authority

What happened: Apps trusted a position list or a vault address kept on the device. Another script on the origin rewrote it and the app acted.
On this desk: Fills are clipped to the tokens the vault actually holds. A top-up is paid only to the on-chain executor, and only when this browser holds that key and the connected wallet is the owner.
Still true: Script running on this origin can still call the key directly. Storage checks do not survive a hostile page.

Gas griefing on Monad

What happened: A reverted transaction was still billed for the full gas limit. Retry loops became the loss.
On this desk: The desk simulates, and a transport failure does not skip that step. A paused or reverting close is not broadcast. The gas float is a small balance on the key, separate from the trade size.
Still true: A trade that simulates cleanly and reverts in a later block still pays gas. That is the chain.

Creator impersonation and address poisoning

What happened: A lookalike address was placed next to a real one. The release went to the lookalike.
On this desk: Release pays the owner the vault already stores. The user does not type a destination for a velocity return.
Still true: A wallet prompt that asks for a new recipient is not this return. Reject it.

Chain halt, reorg, and a lying explorer

What happened: The chain stopped, a short reorg replaced a receipt, or an explorer showed a transaction that was not on the canonical chain.
On this desk: The desk waits for a successful receipt. A timeout is reported as still landing, not as a failure and not as a success.
Still true: This app cannot keep Monad producing blocks. A deep reorg after a receipt is a chain event, not something the page can undo.

Catalogue

106 known classes

Stopped: this client refuses the shape. Residual: the bound is real and incomplete. Outside: the desk has no such surface, or it belongs to the chain, the factory, or the creator wallet.

Chain and consensus1 stopped · 7 residual or outside · 8 in view

Outside
Majority hash or stake
A majority of Monad validators can reorder or halt the chain. This client cannot outvote them.
Residual
Short reorg
The desk waits for a successful receipt. A deep reorg after that receipt is a chain event.
Stopped
Chain split and replay
Every desk transaction is EIP-1559 and carries the Monad chain id. A node reporting another id is refused.
Residual
Eclipse of one node
Reads hedge, and a quote needs a second host. Two eclipsed hosts can still agree.
Outside
Selfish mining and time skew
Block production is the validator set. The desk does not choose timestamps or parents.
Outside
Censorship
A builder can delay a transaction. The desk can resend. It cannot force inclusion.
Outside
Chain halt
If Monad stops producing blocks, sends wait. The last good read can be shown. Nothing is invented.
Outside
Finality gadget failure
This client treats a receipt as the chain’s answer. It does not run its own consensus.

Smart-contract classes13 stopped · 19 residual or outside · 32 in view

Tokens, pools and DeFi7 stopped · 16 residual or outside · 23 in view

Bridges, messages and admins0 stopped · 8 residual or outside · 8 in view

Outside
Faulty signature check on a bridge
The desk does not verify or send bridge messages.
Outside
Validator or relayer compromise
No bridge set is trusted here. MON that arrived from a bridge is just MON.
Outside
Uninitialised message root
The desk stores no merkle root.
Outside
Replay of a cross-chain message
There is no inbound message executor.
Outside
Unlimited mint on the far side
The desk does not mint.
Residual
Admin key or upgrade rug
The factory and the router have their own admins. This user is not those admins, and cannot stop them.
Outside
Timelock bypass
The desk has no timelock. It also has no upgrade button.
Residual
Multisig threshold social-engineered
The creator is a single wallet. If that wallet signs a release, the vault obeys. There is no second signer.

Wallets, phishing and the supply chain3 stopped · 11 residual or outside · 14 in view

Residual
Hot wallet theft
The agent key cannot release, but it is online. Script on this origin can read it.
Outside
Seed phrase and clipboard theft
This app does not ask for a seed and does not render the agent key.
Residual
Malicious extension or drainer
An extension that can open the creator wallet can ask that wallet to sign. The desk cannot veto the wallet UI.
Stopped
Blind signing and eth_sign
The agent signs one decoded transaction. It does not sign an opaque hash as a login.
Residual
Ice phishing and a lookalike verify
Return pays the owner already stored on the vault. A prompt that names a new recipient is not this return.
Stopped
Address poisoning
The user does not paste a destination for a velocity return.
Stopped
Wrong network
The node’s chain id must match the network the desk was built for.
Residual
Lying RPC on balance or fee
Quotes need two hosts. A base fee above 1,000 gwei is ignored. Two hosts can still lie together. A display read can be ten minutes old and is never used to send.
Residual
Frontend hijack and DNS
If the shipped page is replaced, the checks are replaced with it. A surprise prompt is the tell.
Residual
XSS on this origin
Storage checks and payload checks do not survive hostile script. That is the hot-key bound.
Residual
Poisoned dependency
A bad package can delete these checks. Pin the install and read the diff. This page is not that pin.
Residual
Malicious wallet deep link
Links open the wallet the user picks, aimed at this origin. A wallet that lies about the origin is the wallet.
Outside
SIM swap and custodial recovery
There is no custodian and no phone-number recovery. Losing the creator wallet loses the release path.
Outside
Exchange insolvency
Balances here are on-chain reads, not an IOU from a venue.

Agents and automation12 stopped · 3 residual or outside · 15 in view

Stopped
Overprivileged agent
The key’s allowlist is deposit, one swap shape, and one unwrap. Release selectors throw.
Stopped
Confused deputy
A caller cannot aim the key at a contract that is not the bound vault, even if the selector looks allowed.
Stopped
Prompt or tape injection
A card, a tweet, or a candle cannot set the recipient, the token, or the minimum. Those come from the quote and the allowlist.
Stopped
Tool output trusted as a price
The off-chain tape can show a card. It is not the number in the signed minimum.
Stopped
Missing human confirmation on release
Release is the creator wallet, not the agent. The agent cannot invent an owner.
Stopped
Infinite retry spending gas
A failed simulation is not retried onto the chain. A second tap during an unconfirmed send is refused.
Stopped
Double execution
One close at a time per fill. An unconfirmed trade blocks the next send.
Stopped
Stuck nonce
A local nonce more than one ahead of pending is resynced. A hung send stops blocking the lane after 25 seconds.
Stopped
Paused agent as a trap
Pause is read first. Without the creator’s resume, nothing is sent and the MON stays put.
Residual
Shared key across tabs
Two tabs can share the stored key. They are not a lock across devices. Use one browser.
Stopped
Memory poisoning of a stored vault
The saved address is re-read from the chain against owner and agent before a send.
Stopped
Agent changes policy or owner
Those calls are not in the allowlist. The key cannot retarget the release.
Residual
Goal hijack by a hostile instruction
The desk will still enter a card the rules allow. The rules can be a bad trade inside the minimum. They cannot be a withdrawal.
Stopped
Key displayed or copied by the UI
The agent key is not rendered. Losing the creator wallet is still losing the release path.
Residual
Clock skew triggering exits
The hold timer uses the device clock. A wrong clock can ask for an exit early. The exit still needs a live quote and a minimum.

Operations2 stopped · 4 residual or outside · 6 in view

Residual
No monitoring
A failed send is written on the card. There is no separate pager. The creator still has the release.
Residual
Single operator
One creator wallet. There is no second approver and no timelock on return.
Stopped
Backup that overwrites a good key
Three copies. The session wins if the local copy changes. A newly generated key cannot clobber a backup that is still there.
Residual
Dependency not pinned in this page
The record tells you to pin it. The record is not the pin.
Outside
Incident response that moves funds to a new owner
There is no migration key. A suspected compromise is handled by the creator releasing, then stopping use of the browser.
Stopped
Logging the key or the signed raw transaction
The key is not written to the tape, the card, or the audit page.

How to keep this honest

A new send path has to pass the same refusals, or this page is wrong and has to change in the same commit. An unknown in a quote, a node, a chain id, or a request id stops the signature. An unknown in the vault, the router, or Monad does not. The containment that remains is the agent: it cannot release the position.

Six things that still matter

The agent key is online

A searcher can move the price inside 2%

Two nodes can lie together

One creator wallet

The vault and the router are trusted code

A card can be a bad trade

Where the MON sits

What has to be true before a signature

The desk stays up. The send does not bluff.

The incidents that named the class

106 known classes