Potential Risks
DISCLAIMER // NFA // DYOR
This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.
⊙ generated by robots | curated by humans
| METADATA | |
|---|---|
| Contract Address | 0xb276f62d...1eac1c (etherscan) |
| Network | Ethereum Mainnet |
| Analysis Date | 2026-08-11 |
| Snapshot Block | 25733839 |
Overview
A risk assessment was conducted against the FWA acquisition pool as part of the broader contract analysis. The assessment examined centralization characteristics, trust assumptions, economic vectors, complexity surface area, and external dependencies across the Etherscan-verified Solidity source (2,372 lines, plus four inherited Solady libraries and three Chainlink interfaces), together with the external rewards module, randomness service and fee splitter the pool depends on.
The contract is a non-upgradeable pool that holds NFTs and ETH on behalf of depositors and prices a randomized allocation against them. Because it custodies real value — over 1,300 ETH of depositor backing at the snapshot block — the assessment covered the custody path, the pricing path, the randomness path and the owner-configuration surface, and each was evaluated against what the deployed code enforces rather than what the surrounding interface or the project's public repository presents.
Three structural properties shaped the review. The escrow accounting is checkable from outside the contract, and the solvency position was reconstructed independently from primitive chain state rather than from the aggregates the contract reports. The pricing identity the design rests on was likewise re-derived and reproduces exactly. Against those two, the configuration surface is broad, immediate, and held by a single key — and the boundary between what that key is bounded from doing and what it is not is where most of the findings sit.
Findings Summary
The assessment identified 16 findings across four severity tiers and five risk categories. No critical-severity issues were found, and no defect was identified that would let an arbitrary caller take funds. The findings concentrate on the asymmetry between the parameters that are hard-bounded in code and those that are not, on the timing relationship between when the owner may act and when depositors may exit, on the dependency chain behind the randomness that drives every allocation, and on the divergence between the deployed contract and the source the project publishes.
| SEVERITY | COUNT |
|---|---|
| Critical | 0 |
| High | 3 |
| Medium | 5 |
| Low | 4 |
| Informational | 4 |
| CATEGORY | FINDINGS |
|---|---|
| Economic | 7 |
| Centralization | 3 |
| Complexity | 3 |
| Trust Assumption | 2 |
| External Dependency | 1 |
Report Availability
The detailed findings for this assessment are not publicly available at this time. The full report includes specific descriptions of each finding, affected code paths, severity justification, and suggested questions for contract owners and integrators.
If you are the contract owner, an integrator, or a security researcher with a legitimate interest in the full findings, you are welcome to request this portion of the report (no guarantees).