Glasspad's Base contract set was audited by CLAWDIT, and no critical or high-severity vulnerabilities were found. LP tokens are locked and non-withdrawable, hooks are immutable and isolated per pool, and value flows are guarded by ReentrancyGuard and SafeERC20.
Findings summary
| Severity | Count |
|---|---|
| Critical | 0 |
| High | 0 |
| Medium | 1 |
| Low | 6 |
| Informational | 7 |
The single medium finding is an MEV/slippage note on protocol-owned fee-conversion swaps; the rest are low/informational hardening items. See the report for full details.
Scope & methodology
The audit covered the deployed factory, both v4 hooks (dynamic + static), the LP fee-conversion locker, the sniper-auction MEV module, the fee locker, the pool-extension allowlist, and the per-launch token template. Methodology was static analysis (Aderyn, Slither, Foundry lint) backed by full manual line-by-line review, focused on swap-time fund safety.
| Auditor | CLAWDIT |
| Report ID | CLAWDIT-2026-004 (v1.1) |
| Date | July 1, 2026 |
| Chain | Base (chainId 8453) |
Read the full audit report (PDF)
Robinhood Chain
Robinhood Chain deployed in September 2026, two months after this report; its contracts are not in scope and have not been independently audited. Most of the stack is the identical audited Base bytecode redeployed, with one exception: Robinhood Chain runs GlasspadMevDescendingFees, not the GlasspadSniperAuctionV2 module named in the scope above, because block-counting MEV protection behaves differently on a chain where Solidity's block.number reports an L1 height rather than the chain's own (see MEV Protection).
Arc
Arc deployed in September 2026, also after this report, and its contracts have not been independently audited either. It runs the same GlasspadSniperAuctionV2 MEV module as Base. The Solidity differences from the audited scope are two deploy-time flags: the dev-buy extension skips wrapping, because Arc’s native USDC needs no WETH-style deposit, and the LP locker and dev-buy use Arc’s forked UniversalRouter swap layout.