Vote-escrow governance is a specific kind of nightmare to audit. Locks, epochs, weight decay, delegation, gauge systems — the bugs live in the interaction between time and state, not in individual functions. veRWA's Code4rena 2023-08 contest exposed eight high-severity findings across 749 lines of Solidity. We ran our AI engine against the same codebase and caught seven of the eight — in 18.7 minutes.
The Results
88%
High Detection (7/8)
67%
Medium Detection (2/3)
18.7 min
Total Audit Time
749
Lines of Solidity
This is the kind of protocol where most automated scanners produce noise and no signal. Pattern matchers do not understand the concept of "vote delegation expiring at the wrong epoch." You need an engine that can reason about temporal state, role hierarchies, and adversarial incentives. That is what we built.
The Target: veRWA Governance
veRWA is a Curve-style vote-escrow governance system adapted for real-world asset gauges. It consists of four main contracts tightly woven together:
Governance Surface
VotingEscrow
Users lock tokens for time-weighted voting power. Lock duration drives voting weight via linear decay.
GaugeController
Weekly weight snapshots per gauge. Voters direct their voting power. Admins can add or remove gauges.
LendingLedger
Epoch-based reward accrual for depositors into whitelisted markets. Depends on VotingEscrow balances at epoch boundaries.
Delegation
Voters can delegate their voting power. The delegation unwind path is where the worst bugs lived.
Every High-Severity Finding
C4 High Finding
- •H-01: Weekly reward theft via point-in-time balance snapshots
- •H-02: Vote multiplication — GaugeController votes not invalidated on delegation change
- •H-03: Adding a gauge without admin init loses all voting power
- •H-04: Delegated votes locked when owner lock expires
- •H-05: DoS on all gauge functions via slope underflow
- •H-06: Forced long lock times to undelegate back to self
- •H-07: Missing access control in LendingLedger checkpoint functions
- •H-08: Gauge removal permanently locks user voting power
Detection
- •DETECTED
- •DETECTED (CRITICAL)
- •DETECTED
- •DETECTED (CRITICAL)
- •DETECTED
- •DETECTED
- •MISSED
- •DETECTED
Seven out of eight highs detected. We missed H-07 (checkpoint-griefing via missing access control on checkpoint_lender / checkpoint_market) — a specific permission bug that our access-control agent should have flagged. That detection gap is now on our roadmap.
Two Findings We Upgraded Above C4
Our severity calibrator upgraded two of the C4 highs to Critical based on exploit evidence:
- H-02 → Critical: Vote multiplication via delegation means a single voter can effectively cast unlimited votes. That is the kind of bug that decides governance outcomes.
- H-04 → Critical: Delegated tokens get permanently locked when the owner's lock expires. User funds are unrecoverable. That is as bad as it gets.
Our rules say Critical only when the exploit path has zero prerequisites. Both of these qualify — anyone with locked tokens can trigger them.
Medium-Severity Coverage
2/3
Medium Findings Detected
M-01
Gauge Weight Front-Run
M-02
Lock Misalignment
17
Total Findings in Report
Two of three C4 mediums caught. The miss (M-03, underflow-protection variable rename in _change_gauge_weight) was subtle enough that it required specific knowledge of the prior audit history to flag correctly.
Why 19 Minutes Matters
The original Code4rena contest gave wardens days to analyze this protocol. Our AI engine delivered an 88% high-severity detection rate in 18.7 minutes. That is not a replacement for a careful manual audit at a protocol launch — but it is a massive step change in what continuous security monitoring can look like. You can run this audit every day. You can run it on every pull request. You can run it before you ship.
⚠️What This Means in Practice
For a team shipping governance code, this is the difference between "we audited once at launch and hoped" and "we audit every change before it hits main." When the audit takes 19 minutes instead of 19 days, the economic calculus flips.
The Honest Comparison
What We Caught
- •Vote multiplication via delegation (upgraded to Critical)
- •Permanently-locked delegated funds (upgraded to Critical)
- •Slope-underflow DoS on all gauge functions
- •Epoch-boundary reward-theft via balance snapshots
What We Missed
- •Checkpoint griefing via missing access control
- •Underflow-protection variable rename edge case
- •
- •
Try It Yourself
88%
High Severity Found
7/8
Critical Bugs Caught
18.7 min
Completed In
PoC
Every High Verified
Governance protocols are where bugs cost the most. We published our detection rate against a real, scored benchmark. Ask your current auditor for theirs.