Security, Audits & Contracts
MINERAL Protocol has undergone three rounds of independent security audits. All contracts are non-upgradeable, open-source, and verified on Basescan.
Audit History
Three Audit Rounds
| Round | Scope | Result | Key Findings |
|---|---|---|---|
| V1 Audit | Full protocol (10 contracts) | 4 findings, all fixed | Initial comprehensive review |
| V2 Audit | Fix verification + new analysis | All V1 fixes verified | VRF timeout, timelock, claim rounding |
| V3 Audit | Final review | 202 checks passed, 0 failed | No-winner rollover, surplus sweep |
V1 Findings (All Resolved)
| ID | Severity | Finding | Resolution |
|---|---|---|---|
| BM-H-01 | High | VRF liveness concern | reRequestRandomness() with 300-block timeout |
| BM-M-01 | Medium | Admin address changes lack timelock | 1-day timelock on all admin address updates |
| BM-L-01 | Low | Claim rounding dust | Last claimer receives remainder |
| PKG-I-01 | Info | Package completeness | Documentation improved |
V2 Verification
All V1 fixes independently verified:
- VRF timeout recovery tested and confirmed
- Timelock mechanism validated (queue → wait 1 day → apply)
- Claim rounding edge cases resolved
V3 Findings (All Resolved)
| ID | Severity | Finding | Resolution |
|---|---|---|---|
| BM-M-NEW-01 | Medium | No-winner rounds could lock funds | Rollover to Motherlode pool |
| BM-I-NEW-01 | Info | Contract accepts arbitrary ETH | receive() now reverts, surplus sweep added |
Final V3 Result
Total checks: 202
Passed: 202
Failed: 0
Previous fixes verified: 13/13
Contract Addresses
All contracts deployed on Base L2 (Chain ID: 8453)
| Contract | Address | Basescan |
|---|---|---|
| Token (MINERAL) | TBD | TBD |
| AuctionMining | TBD | TBD |
| BlockMining | TBD | TBD |
| EmissionsController | TBD | TBD |
| RefineVault | TBD | TBD |
| StakingVault | TBD | TBD |
| BuybackVault | TBD | TBD |
| BuybackExecutor | TBD | TBD |
| AutoLPVault | TBD | TBD |
| AutoLPExecutor | TBD | TBD |
Addresses will be filled after mainnet deployment. All contracts will be verified on Basescan with full source code.
VRF Configuration
| Parameter | Value | Description |
|---|---|---|
| Provider | Chainlink VRF v2.5 | Industry-standard oracle |
| Coordinator | TBD | Chainlink VRF Coordinator on Base |
| Key Hash | TBD | VRF proving key identifier |
| Subscription ID | TBD | Pre-funded Chainlink subscription |
| Request Confirmations | TBD | Block confirmations before fulfillment |
| Callback Gas Limit | TBD | Gas budget for VRF callback |
| Native Payment | TBD | ETH or LINK for VRF fees |
| Timeout | 300 blocks (~10 min) | After which re-request is allowed |
VRF Verification
Anyone can verify VRF integrity:
- Each round's
randomnessRequestIdis stored on-chain - Chainlink submits a cryptographic proof with the random word
- The VRF Coordinator verifies the proof before forwarding to BlockMining
- All VRF events (
RandomnessRequested,RandomnessFulfilled) are indexable
Security Architecture
Defense in Depth
MINERAL implements multiple layers of security:
Layer 1: Smart Contract Design
├── Non-upgradeable (immutable after deployment)
├── Minimal external dependencies (OpenZeppelin only)
├── Pull-based payments (reentrancy prevention)
└── One-time wiring (critical addresses set once)
Layer 2: Access Control
├── Ownable2Step (two-step ownership transfer)
├── 1-day timelock on admin address changes
├── Keeper-gated executor functions
└── Pausable mining (emergency stop)
Layer 3: Economic Safety
├── Anti-sandwich protection (maxPrice parameter)
├── Slippage protection on swaps
├── Deadline enforcement on trades
├── Flash-loan prevention (2-day claim cooldown)
Layer 4: Liveness Guarantees
├── VRF timeout recovery (300 blocks)
├── Permissionless settlement (anyone can call settle)
├── Permissionless reward pushing
├── No-winner rollover (no locked funds)
Layer 5: Accounting Integrity
├── Tracked balance (all obligations on-chain)
├── Surplus detection and recovery
├── Last claimer gets remainder (no dust)
├── Outstanding claims tracking
Specific Security Features by Contract
Token.sol
| Feature | Detail |
|---|---|
| Hard cap | totalSupply + amount <= CAP enforced on every mint |
| One-time minter | setMinter() can only be called once |
| Contract-only minter | Minter must have code (prevents EOA) |
| Initial allocation guard | LP + Dev cannot exceed 10% of cap |
| Two-step ownership | Ownable2Step |
AuctionMining.sol
| Feature | Detail |
|---|---|
| ReentrancyGuard | All state-modifying functions |
| Pull-based ETH | Previous operator payments via pendingEth |
| Anti-sandwich | maxPrice parameter on mine |
| Pausable | Owner can halt mining |
| Pool target max price | Prevents forced pool execution at unfavorable prices |
| Cooldown | Optional minMineInterval between mines |
| Epoch-spanning accuracy | Geometric series for cross-epoch emission calculation |
BlockMining.sol
| Feature | Detail |
|---|---|
| Chainlink VRF v2.5 | Tamper-proof random winner selection |
| VRF timeout recovery | 300-block permissionless re-request |
| VRF config protection | Cannot change config during active request |
| No-winner rollover | Empty winning square → funds to Motherlode |
| Last claimer remainder | No dust stranded |
| 1-day timelock | Admin address changes delayed 24 hours |
| Surplus sweep | Timelocked recovery of force-sent ETH |
| Tracked balance | All obligations accounted on-chain |
receive() reverts | Direct ETH transfers rejected |
| Deploy bounds | MIN_DEPLOY (0.001 ETH) to MAX_DEPLOY (100 ETH) |
StakingVault.sol
| Feature | Detail |
|---|---|
| 2-day claim cooldown | Prevents flash-loan reward siphoning |
| SafeERC20 | Safe token transfer handling |
| ETH buffer | No funds lost during bootstrap (zero stakers) |
receive() reverts | Must use fundRewards() |
BuybackExecutor.sol & AutoLPExecutor.sol
| Feature | Detail |
|---|---|
| Keeper-gated | Only authorized keepers can execute |
| Minimum 1 keeper | Cannot remove the last keeper |
| Balance verification | Pre/post swap balance check |
| Slippage protection | minTokensOut parameter |
| Deadline | Reverts if block.timestamp > deadline |
| Router must be contract | Prevents EOA manipulation |
| Approval revocation | Router approval zeroed after LP add |
Immutability
All MINERAL contracts are non-upgradeable. There are no proxy patterns, no delegatecall, and no self-destruct mechanisms.
Once deployed:
- Contract code cannot be changed
- Core parameters (revenue splits, grid size, VRF odds) are constants or immutables
- No admin function can modify the fundamental protocol mechanics
What the Owner CAN Do
| Action | Contract | Timelock |
|---|---|---|
| Pause/unpause mining | AuctionMining, BlockMining | Immediate |
| Update VRF config | BlockMining | Blocked during active request |
| Change staking vault address | BlockMining | 1-day timelock |
| Change treasury address | BlockMining | 1-day timelock |
| Queue surplus sweep | BlockMining | 1-day timelock |
| Update refine fee (max 50%) | RefineVault | Immediate |
| Update keeper list | Executors | Immediate |
| Update router address | Executors | Immediate |
| Schedule emission rate changes | EmissionsController | Max 8 epochs ahead |
What the Owner CANNOT Do
| Action | Reason |
|---|---|
| Mint tokens beyond cap | Hard-coded in Token.sol |
| Change revenue splits | Immutable in constructors |
| Change grid size | Constant (25) |
| Change Motherlode odds | Constant (1/625) |
| Change round duration | Constant (30 blocks) |
| Upgrade contracts | No proxy pattern |
| Access user funds | Pull-based, user-initiated claims |
| Manipulate VRF results | Chainlink external oracle |
| Change token cap | Immutable |
Open Source
All smart contract source code is publicly available:
| Repository | Content |
|---|---|
| GitHub (TBD) | Full source code, tests, deployment scripts |
| Basescan | Verified source for all deployed contracts |
Test Suite
| Metric | Value |
|---|---|
| Test files | 14+ |
| Individual tests | 45+ (all passing) |
| Test framework | Foundry (Forge) |
| Coverage | All core functions, edge cases, and audit findings |
Audit Reports
Full audit reports are available:
| Report | Link |
|---|---|
| V1 Audit Report | TBD |
| V2 Audit Report | TBD |
| V3 Audit Report | TBD |
Bug Bounty
A bug bounty program via Immunefi is planned for post-launch.
| Severity | Bounty Range |
|---|---|
| Critical | TBD |
| High | TBD |
| Medium | TBD |
| Low | TBD |
How to Verify
Verify Contracts on Basescan
- Go to Basescan
- Enter contract address
- Click "Contract" tab → "Read Contract"
- Verify parameters match this documentation
Verify VRF Randomness
- Find a settled round's
randomnessRequestId - Check Chainlink VRF explorer for the request
- Verify the proof was submitted by the Chainlink Coordinator
- Confirm
winningSquare = randomWord % 25
Verify Revenue Splits
- Read contract constants on Basescan:
- AuctionMining:
bpsPrevOperator,bpsBuyback,bpsStaking,bpsAutoLP,bpsDevFee - BlockMining:
WINNER_BPS,MOTHERLODE_BPS,STAKING_BPS,TREASURY_BPS
- AuctionMining:
- Confirm they sum to 10,000 (100%)
Verify Token Cap
- Read
Token.CAP()on Basescan → should return 21,000,000 * 10^18