evangelEVANGEL DOCUMENTATION / 14
Internal security review
First-party findings, verification and outstanding release blockers — October 2, 2026.
First-party review, not independent certification
This is an AI-assisted internal review by the team building Evangel. No external audit firm participated. It does not certify the absence of vulnerabilities or establish readiness for mainnet trading. Reviewed source: 08892ae31eec6d97d23801a1c0d5f79f461b9f4e.
The complete report is available at https://evangel.fund/internal-security-review.md. Source remains private; the commit hash alone does not permit public reproduction.
Open findings
EV-01 (medium): an unverified pending adopter can block another adoption request until governance rejects it. Repeated contention can delay onboarding; it does not grant withdrawal rights. This behavior is reproduced in local compiled-program tests. A local candidate now supports immutable wallet-signed adoption terms and quorum selection despite a pending claimant; the deployed program still needs a reviewed upgrade.
EV-02 (medium): the aggregate 600 requests/minute rule passed a controlled live threshold test; notification delivery and sustained capacity checks remain open. EV-05 (informational): upstream bincode 1.3.3 remains unmaintained. EV-07 is resolved for the observed mainnet venue: the digest-pinned Linux build exactly matches its executable. Future upgrades require new verification.
Fixes and evidence
EV-03: governor and reviewer preflight now reject actions missing the required terminal multisig account. EV-04: monitoring now verifies deployed program bytes and fails when deployment configuration is missing. The live Devnet monitor passed locally and in GitHub.
57 unit/integration tests passed after review fixes; 46 existing browser checks passed during review. npm audit reported no known vulnerabilities; RustSec retained the maintenance warning. Tests and scans are bounded evidence, not security guarantees.
Not completed by this report
The real participant pilot, reviewed adapter deployment, public-chain fee receipts and mainnet trading remain incomplete. Public launches are disabled. A local Rust adapter now passes real-venue-binary integration tests; that does not make it a deployed or independently audited product.
Two reviewers can collude or approve an upgrade. Reports cannot prove useful work or honest invoices. Each material change requires a new review and regression evidence.
Pilot addendum: account decoding
EV-06 (medium, fixed in source f11e0aa): the first real project registration exposed incorrect integer decoding from Node Buffer slices. Normalizing input to Uint8Array fixes the server state failure. An offset-buffer regression test now covers it; all 58 unit/integration tests and the build pass. No onchain upgrade was made.
The public repository happycamper-stix/evangel-fund is registered on Devnet and remains unadopted. The custody monitor passes. Registration is not identity verification or payout approval.
Venue adapter continuation
Source 68df6f3 adds atomic launch and permanent position custody, exact reserve separation, separate dust sponsorship, authenticated fee collection and collection-day settlement. A governance-enforcing review build remains separate from local test fixtures.
65 unit/integration tests, 12 actual venue-binary tests and 48 browser checks pass. Mainnet and Devnet venue binaries are executed locally with dummy assets. No public-chain launch receipt or mainnet approval is implied.
The live API threshold test returned 600 normal rejections followed by 10 HTTP 429 responses. Read-only custody and website monitoring is scheduled every 30 minutes in the private repository. Notification and recovery drills remain outstanding.
Verified venue source
The pinned Linux build of Meteora source a85c926 exactly matches the observed mainnet executable, with only zero allocation padding. The result was independently compared locally after downloading the workflow artifact. This closes EV-07 for that binary, not for future upgrades.
This is build provenance, not an independent security audit. The adapter remains a local review candidate until real governance deployment and participant acceptance complete.