[midnight-core] spearbit first audit — final report

[claude]

Requested by Mathis GD · Slack thread

Finalized Cantina report for the audit of commit 41c8405a (tag 2026-04-07), replacing the draft.

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

midnight/audits/2026-04-07-spearbit.pdf

Line 1 in 8e8dbdb

%PDF-1.5

Refresh the expired Base compatibility entry

Section 5.4.4 still classifies Base as lacking CLZ support while its upgrade date is recorded as “Mainnet: Early May 2026, TBD,” even though the finalized report is dated August 8, 2026. Readers using this table for deployment planning cannot tell whether Base was re-tested after that date; refresh the probe/status or explicitly date the table as an April snapshot.

AGENTS.md reference: AGENTS.md:L72-L75

---

midnight/audits/2026-04-07-spearbit.pdf

Line 1 in 8e8dbdb

%PDF-1.5

Classify the unchanged validation finding as acknowledged

Section 5.2.4 recommends adding an explicit activated-collateral check, but Morpho says the check was not worth implementing and only added a comment; nevertheless, Spearbit labels the finding “Fixed by commenting it.” Because the runtime behavior identified by the finding remains unchanged, this overstates the remediation and can also distort the executive summary's fixed/acknowledged totals; classify it as acknowledged or document what behavioral fix was actually made.

AGENTS.md reference: AGENTS.md:L75-L76

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".