TRUST — ACCURACY

False Positive Rate Report

Clean FPR is 11.4%. Counting confirmed High/Medium findings downgraded to Low raises the quality-error rate to 20.5%.

11.4%

Clean false-positive rate

20.5%

Counting confirmed downgrades to Low

High and Medium findings in scope

Confirmed by the maintainers

Overall Summary

Primary metric: explicit false positives only. The calculation excludes original Low findings because reviewers did not cover Low severity findings consistently. The table groups confirmed findings by adjudicated severity and false positives by submitted severity.

Severity	Confirmed	False Positive	Total
Critical	1	0	1
High	16	4	20
Medium	18	1	19
Low	4	0	4
Total	39	5	44

Clean FPR:

5 / 44 = 11.4%

Second estimate: explicit false positives plus confirmed downgrades to Low.

Outcome	Count	Rate
Confirmed and retained above Low	35	79.5%
Explicit false positives	5	11.4%
Confirmed but downgraded to Low	4	9.1%
False positives + Low downgrades	9	20.5%

Scope rules:

Included: only scans that have external feedback.
Included severities: original High and Medium only.
Excluded: original Low findings.
Counted as FP: the feedback rejects the finding as false-positive, invalid, or based on a non-existent condition.
Not counted as FP: known issues, fixed issues, valid downgraded issues, out-of-scope real issues, and useful issues that may be obsolete.

Scan Breakdown

Legacy Staking and Root Dividend Review

I checked both reports. Coldkey swap orphaning RootClaimed is High and fixed in the private repository. The root-claim Swap unbacked mint is a false positive, apparently fixed since April 2026. The root-claimable fallback is Medium / unlikely. The dissolution unbacked refund is a false positive. remove_stake_limit bypassing SubtokenEnabled is Low and fixed in #2823.

From the maintainers’ feedback

Metric	Count
Original High findings	4
Original Medium findings	1
High/Medium in scope	5
Explicit FP	2
Confirmed / non-FP	3
Clean scan FPR	40.0%
Low downgrades	1
FP + Low downgrade rate	60.0%

High

H-01

Coldkey swap orphans root-dividend reward debt

Coldkey swap moves ROOT stake but misses the matching RootClaimed watermark, letting the new coldkey claim historical dividends again. Result: Confirmed, High. The feedback says it was fixed in the private repository.

High

H-02

Root-dividend Swap claim mints unbacked ROOT stake

The Swap claim path mints ROOT stake directly without crediting the backing ROOT reserve accounting. Result: False positive, original High. The feedback says it had already been fixed since April 2026.

High

H-03

Root-dividend accrual fallback diverts dividends to the owner

A fallback path compares subnet alpha against ROOT stake and can route the whole dividend to the hotkey owner instead of nominators. Result: Confirmed, downgraded to Medium / unlikely.

High

H-04

Subnet dissolution mints an unbacked owner lock refund

Legacy subnet dissolution credits the owner lock refund by minting balance without an offsetting accounting decrement. Result: False positive, original High.

Medium

M-01

remove_stake_limit bypasses SubtokenEnabled

Limit-order unstake paths bypass the subnet trading freeze, allowing exits while normal unstake is disabled. Result: Confirmed, downgraded to Low. This is counted in the second estimate but not in clean FPR.

Note

one original Low finding was also marked false-positive, but original Low findings are excluded from both the denominator and the primary FPR.

Staking, Precompile, and SharePool Verification Review

For the second report: SharePool under-collateralization is Low. The EVM limit-price scale mismatch is Medium / possible, though changing it may break clients that already adapted. Auto-parent delegation is Medium and known; a fix is planned. The rest are confirmed as Low.

From the maintainers’ feedback

Metric	Count
Original High findings	1
Original Medium findings	3
High/Medium in scope	4
Explicit FP	0
Confirmed / non-FP	4
Clean scan FPR	0.0%
Low downgrades	2
FP + Low downgrade rate	50.0%

High

H-01

SharePool under-collateralization enables subnet reserve drain

Rounding drift in share removal can make the pool owe more alpha than it holds, eventually allowing reserve drain through unstake. Result: Confirmed, downgraded to Low. This is counted in the second estimate but not in clean FPR.

Medium

M-01

EVM limit-price scale mismatch disables slippage protection

EVM price views and limit-price inputs use incompatible scales, so integrators can accidentally pass limits that disable protection. Result: Confirmed, Medium.

Medium

M-02

claim_root unbounded loop under clamped weight

claim_root and auto-claim iterate attacker-inflated StakingHotkeys while charging a fixed or under-reported weight. Result: Confirmed, downgraded to Low. This is counted in the second estimate but not in clean FPR.

R-01

Auto-parent delegation is default-on and under-metered

Subnet registration auto-delegates to root validators by default and performs root-set-sized work under fixed registration weight. Result: Confirmed / known, Medium review-pending.

Staking and Proxy Safety Review

The report is nominally about precompiles, but many issues are not really in precompile code; they are valid bugs that can also be reached directly without smart contracts. The coldkey-swap root-dividend watermark issue is a valid critical bug, fixed in the private repository. It allows repeatedly extracting dividends from the network.

From the maintainers’ feedback

Metric	Count
Original High findings	3
Original Medium findings	2
High/Medium in scope	5
Explicit FP	0
Confirmed / non-FP	5
Clean scan FPR	0.0%
Low downgrades	0
FP + Low downgrade rate	0.0%

High

H-01

Coldkey swap reopens already-paid root-dividend claims

Coldkey swap fails to migrate per-source-subnet claim watermarks, letting the new coldkey re-claim dividends already accounted as paid. Result: Confirmed, Critical/High. The feedback explicitly calls it critical and says it was fixed in the private repository.

High

H-02

Decaying-lock roll-forward freezes aggregate conviction

Rolling a lock forward updates the aggregate clock without accruing aggregate conviction, corrupting subnet ownership selection. Result: Confirmed, High.

High

H-03

NonTransfer / NonFungible proxies can burn delegator principal

Proxy denylists omit destructive staking calls, so a restricted proxy can dispatch burn_alpha or related calls as the delegator. Result: Confirmed, High.

Medium

M-01

Aggregate-stake precompile views undercharge unbounded map iteration

Aggregate stake views charge a fixed two DB reads while helper calls iterate never-pruned staking maps. Result: Confirmed, Medium.

Medium

M-02

transferStakeFrom can seize locked alpha on same-subnet transfer

Allowance-driven same-subnet transfer skips the lock guard, allowing a spender to move locked stake and later liquidate it. Result: Confirmed, Medium.

Note

the feedback says the bugs are valid, but several are broader staking/runtime side effects rather than strictly precompile-only issues. That is not counted as FP.

Dynamic Tempo and Activity Cutoff Review

Translated feedback:

root-set-tempo-zero-bricks-subnet-epochs is normal behavior; root-only calls are not protected against user error. The safety-net starvation, commit-reveal desync, and dynamic-tempo cutoff clamp findings are interesting and should be sent to the maintainer. The RPC wire-break items are just breaking changes, but useful to notice.

From the maintainers’ feedback

Metric	Count
Original High findings	1
Original Medium findings	3
High/Medium in scope	4
Explicit FP	1
Confirmed / non-FP	3
Clean scan FPR	25.0%
Low downgrades	0
FP + Low downgrade rate	25.0%

High

H-01

ActivityCutoff migration operator-deception compound

The ActivityCutoff-to-factor migration can silently change consensus windows while stale setters and views keep reporting the old value. Result: Confirmed / useful, High. The feedback routes the relevant parts for maintainer follow-up.

Medium

M-01

Epoch safety-net can be starved by per-block epoch cap

The MAX_TEMPO safety-net still loses to the per-block epoch cap, allowing a due subnet to remain deferred. Result: Confirmed / interesting, Medium.

Medium

M-02

trigger_epoch / set_tempo desync commit-reveal windows

Manual epoch controls can advance epoch counters ahead of the Drand reveal timing and silently drop committed weights. Result: Confirmed / interesting, Medium.

Medium

M-03

Root sudo_set_tempo(0) bricks subnet epochs

Root can set tempo to zero, causing the scheduler to return before the safety-net path and freezing epochs. Result: False positive, original Medium. The feedback says root-only calls are not protected as user-error surfaces.

Note

RPC wire-break findings were treated as breaking changes rather than false positives, but they are Low/component items and excluded from the clean FPR denominator.

Balancer Swap and Limit Orders Review

Some Balancer High findings are not confirmed. The swap-pallet hooks finding was tested on a clone and the migration works successfully. The stake_into_subnet no-refund finding looks real. The emission drop on weight clamp is real, but very unlikely and misclassified. For the order pallet, all bugs are valid; one is overestimated and should be Low severity. Findings #1 and #3 are good findings and were fixed in PR #2732.

From the maintainers’ feedback

Metric	Count
Original High findings	9
Original Medium findings	7
High/Medium in scope	16
Explicit FP	1
Confirmed / non-FP	15
Clean scan FPR	6.25%
Low downgrades	1
FP + Low downgrade rate	12.5%

High

H-01

Duplicate order_id in batched orders overspends signer cap

The batched order path validates all entries against the same pre-batch order state, so duplicate signed orders can be executed multiple times. Result: Confirmed, High. This was one of the good findings fixed in PR #2732.

High

H-02

migrate_cleanup_swap_v3 is not wired into runtime upgrade

v3 LP reserve cleanup exists but is not run from the runtime upgrade path, leaving old reserves invisible to the new AMM. Result: Confirmed / not rejected, High.

High

H-03

Swap pallet hooks section is not imported

The report claimed the swap pallet hooks section is not wired, so the Balancer migration would never run. Result: False positive, original High. The feedback says the migration works successfully on a clone.

High

H-04

stake_into_subnet strands unswapped TAO on price-limit hit

When a Balancer swap only consumes part of the input due to price limits, the residual TAO is not refunded. Result: Confirmed, High.

High

H-05

adjust_protocol_liquidity silently drops emissions on weight clamp

If injection would push Balancer weights outside constraints, the code returns zero injection and the emission is effectively dropped. Result: Confirmed, severity overestimated. The feedback says it is real but very unlikely / misclassified. No final Low severity was stated, so it is not counted as a Low downgrade.

High

H-06

Limit-orders pallet hotkey can be front-run

The deterministic pallet hotkey can be claimed before migration, permanently bricking pallet enablement. Result: Confirmed, downgraded to Low. The limit-orders feedback says issue #2 was known and considered Low severity. This is counted in the second estimate but not in clean FPR.

High

H-07

Chain-extension add-stake recycle/burn helpers are non-atomic

The chain extension calls raw helper functions without transactional wrapping, so the first staking leg can persist after the second leg fails. Result: Confirmed, High.

High

H-08

Default Balancer sell floor blocks unstake on depressed subnets

The new default minimum price can make normal unstake fail on very low-price subnets, with the documented limit path also blocked. Result: Confirmed / not rejected, High.

High

H-09

Depressed-subnet emission compound amplifies misallocation

Several reserve, emission, and protocol-flow bugs combine on depressed subnets, boosting their emission share while burning or orphaning value. Result: Confirmed / not rejected, High.

Medium

M-01

inject_and_maybe_swap leaves orphan TAO after failed swap

The excess-TAO branch resolves TAO to the subnet account before swap failure, leaving accounting and real balance diverged. Result: Confirmed, Medium.

Medium

M-02

Balancer migration fallback resets v3 subnet to 50/50

If the v3-derived weight is rejected by constraints, migration inserts a default 50/50 pool rather than preserving price. Result: Confirmed / not rejected, Medium.

Medium

M-03

SubnetProtocolFlow accumulates while subnet is emission-ineligible

Protocol flow is recorded while EMA drainage is skipped, causing a shock when the subnet becomes eligible again. Result: Confirmed, Medium.

Medium

M-04

try_execute_order can commit swap but skip Orders::insert

Missing transactional wrapping lets buy_alpha persist when forwarding the fee fails, leaving the order replayable. Result: Confirmed, Medium. This was one of the good limit-orders findings fixed in PR #2732.

Medium

M-05

Limit-orders TAO transfer burns dust without total-issuance tracking

Raw Currency::transfer(..., Expendable) can reap dust from balances issuance without updating subtensor issuance. Result: Confirmed, Medium.

Medium

M-06

Coldkey swap downgrades perpetual locks to decaying

Coldkey swap migrates lock rows but not the perpetual/decaying flag, causing locks to decay after migration. Result: Confirmed, Medium.

Medium

M-07

Alpha precompile views miss EVM gas accounting

Alpha precompile views perform Substrate reads and swap simulations without charging corresponding EVM gas. Result: Confirmed, Medium.

Note

the feedback does not enumerate every High/Medium finding individually. The only explicit false-positive in scope is H-03; severity downgrades are not counted as FP.

Mainnet Deployment QA Review

All High findings are valid except "Swap-pallet no-op LP path burns user liquidity on dissolution"; there is no user liquidity. Lock-related bugs are useful for checking, but do not necessarily need to be filed because locks were mostly rewritten and those issues may already be obsolete. Of the Medium findings, file the chain-extension non-atomic recycle/burn issue and the NetTaoFlowEnabled EMA shock issue.

From the maintainers’ feedback

Metric	Count
Original High findings	6
Original Medium findings	4
High/Medium in scope	10
Explicit FP	1
Confirmed / non-FP	9
Clean scan FPR	10.0%
Low downgrades	0
FP + Low downgrade rate	10.0%

High

H-01

inject_and_maybe_swap silently strands TAO on swap failure

Coinbase deposits TAO to the subnet account, then silently drops failed swaps, leaving internal reserves out of sync with real balances. Result: Confirmed, High.

High

H-02

root_claim_on_subnet marks claim paid on transfer failure

The claim path can update RootClaimed even when the TAO transfer failed, permanently burning the user's claim. Result: Confirmed, High.

High

H-03

do_terminate_lease strands stake under unspendable lease coldkey

Lease termination moves ownership and removes proxy access but leaves stake and locks under a derived coldkey no one can sign for. Result: Confirmed, High.

High

H-04

withdraw_in_alpha swallows unstake_from_subnet failure

Alpha fee withdrawal catches unstake failure after partial state has already committed, making the user lose alpha while reporting zero fee. Result: Confirmed, High.

High

H-05

force_reduce_lock over-reduces HotkeyLock.locked_mass

A force-reduce path subtracts the requested amount from aggregate lock state rather than the actual per-coldkey contribution. Result: Confirmed, High.

High

H-06

Swap-pallet no-op LP path burns user liquidity on dissolution

The report claimed dissolved subnets wipe user LP positions because LP cleanup functions are no-op stubs. Result: False positive, original High. The feedback rejects it because there is no user liquidity.

Medium

M-01

do_unlock_stake undercounts aggregate conviction

Unlocking stake forwards the wrong conviction delta to aggregate lock accounting, corrupting subnet-king selection. Result: Useful / not counted FP, Medium. The feedback says lock-related bugs were useful for checking but may already be obsolete due to a lock rewrite.

Medium

M-02

Chain-extension add-stake recycle/burn helpers are non-atomic

The chain extension can leave the first staking leg committed when the recycle/burn leg fails. Result: Confirmed, Medium. The feedback explicitly says this should be filed.

Medium

M-03

swap_hotkey_on_subnet strands lock entries

Per-subnet hotkey swap migrates stake and membership state but not lock state, leaving locks attached to the old hotkey. Result: Useful / not counted FP, Medium. The feedback says lock-related bugs were useful for checking but may already be obsolete due to a lock rewrite.

Medium

M-04

NetTaoFlowEnabled toggle injects accumulated flow into EMA

Protocol flow accumulates while the EMA update is disabled, then gets injected as a large one-block shock when re-enabled. Result: Confirmed, Medium. The feedback explicitly says this should be filed.