# Fix status — audit 2026-11-08

| ID | Severity | Title | Status | Fix commit | Regression test | Fix reviewed | Notes |
|---|---|---|---|---|---|---|---|
| KR-1 | High | In-tx slippage; admin self-sandwich | Fixed (residual accepted) | 393b574, 80f5a4a | test/audit20261108/KR1_adminSelfSandwich.t.sol | yes | maxPrice mandatory, raw-unit scale; UI flags >3× spot |
| KR-2 | High | Zero review on open targets | Fixed | 393b574 | test/audit20261108/KR2_tickerImpostorZeroReview.t.sol | yes | MIN_REVIEW 10 min + veto required |
| KR-3 | Medium | Flash-pledge veto | Fixed | 80f5a4a | test/audit20261108/KR3_flashPledgeVeto.t.sol | yes (round-1 fix broken → FR-1) | snapshot weight at proposal |
| FR-1 | Medium | One-block veto + withdraw auto-cancel | Fixed | 80f5a4a | fixreview20261108/FixReview.t.sol (KR3_*) | self-reviewed | no auto-cancel; eligibleVetoTotal |
| REG-1 | Medium | Registry live control | Fixed | 393b574, 80f5a4a | test/audit20261108/REG1_registryLiveControl.t.sol | yes | verifiedAt < createdAt; checks at propose + first step |
| FR-3 | Low | Same-second / re-list bypass | Fixed | 80f5a4a | FixReview.t.sol (REG1_*), test_registry_relistReverts_sameSecondListingRejected | self-reviewed | |
| KR-4 | Low | Admin stall | Fixed | 393b574 | test_stalledAdmin_anyoneFinalizesAfterGrace, test_KR4_stallFinalize | yes | STALL_GRACE 1 day |
| KR-5 | Low | Veto reset by re-propose | Fixed | 80f5a4a | test_cannotReproposeAnyEarlierTarget, test_KR5_fixed_ABAreverts | yes | |
| KR-6 | Low | Mutable symbol halts | Fixed | 393b574 | REG1 tests | yes | |
| FR-2 | Low | vetoBps 100% | Fixed | 80f5a4a | test_factory_vetoCapAndFixedTargetNoVeto | self-reviewed | MAX_VETO 7000 |
| INT-1 | Low | Public deployer key | Fixed | deploy | — | — | private key in /srv/kitty/kitty.env |
| KR-7 | Info | First buy closes pledging | Documented | — | — | — | docs + UI |
| KR-8 | Info | Dust | Accepted | — | — | — | |
| KR-9 | Info | FoT / rebasing tokens | Documented | — | — | — | |
| KR-10 | Info | walletCap per address | Documented | — | — | — | |
| FAC-1 | Info | Single-key factory owner | Documented | — | — | — | multisig for prod |
| DEX-1 | Info | Test DEX scope | — | — | — | — | |