Issues

Pending-match finaliser: unguarded Nat fee subtraction in finalisePendingMatch + stale 'pending-match path' comment

dfinity/public-multidex#56 · opened

on Sep 9, 2026

OhShii Labs review, round 18 — part 2 · 4 findings (#55.1–#55.4): the verifier takes its origin from the host, the Bridge wipe never fires where it is deployed, and the instruments that certified both

dfinity/public-multidex#55 · opened

on Sep 2, 2026

OhShii Labs review, round 18 · 9 findings (#54.1–#54.9): the season seal races its own gates, and what the 1.60 drop fixed for us

dfinity/public-multidex#54 · opened

on Sep 1, 2026

1

A reproduced finding is sitting in the private advisory channel — posting a pointer here because the 20 that preceded it are all still in triage

dfinity/public-multidex#53 · opened

on Aug 24, 2026

OhShii Labs review, round 12 · 6 findings (#49.1–#49.6): readiness for real custody, and a margin-limit bypass that is our own remedy shipped without its qualifier

dfinity/public-multidex#49 · opened

on Aug 11, 2026

3

OhShii Labs review, round 7 · 5 findings (#44.1–#44.5): four instruments that stop meaning what they say on the day custody lands, and one input an approver cannot verify

dfinity/public-multidex#44 · opened

on Aug 10, 2026

2

OhShii Labs — index of all 161 counted findings across rounds 1–18 (153 public, 8 private) — map, not new findings

dfinity/public-multidex#29 · opened

on Aug 4, 2026

1

Both pre-push lint-gate checks certified in #10 are structurally inert

dfinity/public-multidex#21 · opened

on Aug 2, 2026

4

OhShii Labs review, 8/8 · 4 findings (#11.1–#11.4): the AI proxy, and one delegation-handshake issue held back for private disclosure

dfinity/public-multidex#11 · opened

on Aug 1, 2026

3

OhShii Labs review, 2/8 · 7 findings (#5.1–#5.7): unvalidated input reaching permanent state, and cycle burn with no cross-caller ceiling

dfinity/public-multidex#5 · opened