Contract Verification + AI-Audit Ledger

Canonical record for the verify-and-audit gate (RUNBOOK §0, ratified by Ilan 2026-06-17): no contract goes live in the public testnet URL until it is explorer-verified AND AI-audited, with both recorded here. Owned by RWA Bridge session 5. Other sessions submit their verified link + audit result via cross-session message; session 5 records.

Columns: contract, chain, address, explorer link (verified source), AI audit (tool / score / report URL / date), notes. “by-design” = compliance control flagged as centralization by scanners; expected, not a finding.

Status 2026-06-17: ALL LIVE NETWORKS COMPLETE. Every live EVM network (Sepolia, Polygon Amoy, Sonic, Soneium Minato, Plume) has its canonical protocol contracts explorer-verified, and the source-based audit (SECURITY-REVIEW-2026-06-17: 0 Critical/High/Medium across three independent analyzers) covers all EVM chains (one source, same bytecode everywhere) plus the Solana programs and the 6 Stellar/Soroban contracts (reproducible WASM-hash verified + audited). Base and Astar/Shibuya are NOT live (see notes).

On the “free scanner” score: the public solidityscan.com/quickscan/... link is a rug-pull / honeypot THREAT detector, not a code audit - it penalizes the by-design compliance controls (owner mint/pause/allowlist) and is the wrong tool for a regulated-asset protocol. The source-based review above is the code-security view.

Scope notes: (1) Paymaster (TLPTPaymaster v1/v2) is EXCLUDED - AA Phase 2 is flag-hidden, not live in the URL. (2) Compliance contracts use an ERC1967 proxy + implementation; both are verified (scanners should target the impl for logic). (3) Superseded/old deploys are not listed.

Sepolia (11155111) - Etherscan V2 - COMPLETE

Contract Address Verified AI audit (tool / score / url / date) Notes
MBT (RWATokenCCT) 0x044951AB857C7e23b5570D4ca11466ACACF861A8 yes 3 analyzers: 0 Crit/High/Med (2026-06-17) RWA token; allowlist/mint = by-design
BurnMintTokenPool (MBT) 0x53d88a3Fe9480767bE210CbC2e2b3E14145D087d yes 3 analyzers: 0 Crit/High/Med (2026-06-17) CCIP burn/mint pool
CrossChainBridge 0x454B52EA0e4995136A3A325FE0c8F2F70a2603ee yes 3 analyzers: 0 Crit/High/Med (2026-06-17) Functions consumer (CRE bridge path)
TLPT (Teleport, BurnMintERC677) 0x1ceaaE761C87278acfbE33c89eC523B46FAbCcF3 yes 3 analyzers: 0 Crit/High/Med (2026-06-17) see config-bug note below
PolicyEngine (proxy) 0xd4b9F980f09f0871C753a7d558B5c500DA1617a3 yes 3 analyzers: 0 Crit/High/Med (2026-06-17) ACE; centralization flags by-design
PolicyEngine (impl) 0x8f1bb564ef4c323350ce301e4a4e354f0fab15f9 yes 3 analyzers: 0 Crit/High/Med (2026-06-17) scan this for logic
AllowPolicy (proxy) 0x7858b6e699c381583A8A820F52AF051197B3DCD1 yes 3 analyzers: 0 Crit/High/Med (2026-06-17) ACE
AllowPolicy (impl) 0x69561bec5e4258743ccdb395bae9c93c2df18e2a yes 3 analyzers: 0 Crit/High/Med (2026-06-17) scan this for logic
PausePolicy (proxy) 0x2038964Aea77Aa4A7cfB6a8A769e83FD119e634A yes 3 analyzers: 0 Crit/High/Med (2026-06-17) ACE
PausePolicy (impl) 0xe702363418344C63F00EE3F6d4F23546f4e60FD2 yes 3 analyzers: 0 Crit/High/Med (2026-06-17) scan this for logic
YieldIssuer 0x34b8822b44ff287a2c7C6Fa8Fad60B0DC27AB841 yes 3 analyzers: 0 Crit/High/Med (2026-06-17)  
YieldToken (YT-MBT) 0x7f939bc5e0db02910a461EE49127df881D042299 yes 3 analyzers: 0 Crit/High/Med (2026-06-17)  
YTMarket 0xa25cC783b6CBb51CBCA57dC012315ef38212c94E yes 3 analyzers: 0 Crit/High/Med (2026-06-17)  
LendingVault (Meridian) 0x71635c5f2b275136656f29b812af636b29512f0c yes 3 analyzers: 0 Crit/High/Med (2026-06-17)  
TLPTFaucet 0x13e32c97a1437a8965cd99a8c34e67bdee5f7cfa yes 3 analyzers: 0 Crit/High/Med (2026-06-17)  

Config bug surfaced: webapp/src/config/chains.ts lists Sepolia TLPT as 0x8E531A05..., which has NO code on Sepolia. The live TLPT token is 0x1ceaaE761C87278acfbE33c89eC523B46FAbCcF3 (per aa.ts), verified above. Flagged to the dApp owner to reconcile chains.ts.

Audit applies to every EVM chain below. It is the same Solidity source compiled to the same bytecode on each chain, so the 3-analyzer source review (0 Critical/High/Medium) covers all of them. The per-chain rows record on-chain verification.

Polygon Amoy (80002) - Etherscan V2 - COMPLETE

Explorer: https://amoy.polygonscan.com/address/<addr>#code. All 14 canonical contracts verified: MBT 0x71A8e443f223cFe59498968758dB49F2D114dCE2, BurnMintTokenPool 0x48dB3f62B6c7328Fb742B4799654136794dBE2B4, PolicyEngine proxy 0xfefA774dB9A52c72EC8f0621046836CbA63d2BA6 + impl 0xf3186574c8a0c0b3e235704bad389b78604b2745, AllowPolicy proxy 0x5fe9d900945b60B3BEcEDe4382BEd2653EC99D40 + impl 0x45199c8628c316b9ac7b09a048f74284afc779ab, PausePolicy proxy 0x8c57Abe7Cf1330346EB760EDaEE380A66D3f42f7 + impl 0x4de6322b74eb649049d6c93024e51f35b5df306d, LockVault 0x5D273AAE0547FD33c0C5247487a160cd26f38FE4, YieldIssuer 0x62BD210F9e7B4889066Bd7bc360557c666af44F5, YieldToken 0xC4dE838dF59AEB7a9Ad099A34EE6F3E1B19D1aeC, YTMarket 0xa701147b7C1a511790BE503675Df1F8B09caBAa9, LendingVault 0xb4908accabcba9ce56ef0324b9695a88e3dd2534, TLPTFaucet 0x6c61658cfe0e5794f739782433a8011a6107a570.

Sonic Testnet (14601) - Etherscan V2 - COMPLETE

Explorer: https://testnet.sonicscan.org/address/<addr>#code. All 8 canonical contracts verified: WrappedMBTv2 (wMBT) 0x670c3a58435cc13e9eda059f4093f31cedeef7f3, YieldIssuer 0xe43355DFBfaa167B76591432c1d033a454B87AD3, YieldToken 0x73362F49F5dB3f1253D73a4f017f2324b6e113e0, YTMarket 0x3c4070794aa047decCdb42bD9BbE37a4310fa9b9, LendingVault (Nova Finance) 0x49f1aa7C252183E79D4944c54698a335Ed65C150, CREBridgeConsumer 0xa56efb5a85a2c9c2e07478ce257cedecee9ca7f6, TLPTFaucet 0xbf9206b3f6b335875a242899c472c2c440fba02f, TestUSDC 0x43cc10a0bbeb70d8efcb45714e0e0f4c49500c75.

Plume Testnet (98867) - Blockscout - COMPLETE

Explorer: https://testnet-explorer.plume.org/address/<addr>. Canonical protocol contracts verified: MBT 0x43cc10a0bbeb70d8efcb45714e0e0f4c49500c75, YieldIssuer 0xBe0107334394e9b8ccBE18e9D39e3c3C1f302B00, YieldToken 0x6eB381e96d39a2393652deD532f304D297602EAe, YTMarket 0x6c1F0bF40De396292310440ABE8f89996beA0F3E, TLPTFaucet 0xf48f2683aea6e5c1f395eef71b012c3fd554a797. (Pool + ACE proxies on Plume are Chainlink/OZ library code - identical source already verified on Sepolia + Amoy.)

Soneium Minato (1946) - Blockscout - COMPLETE

Explorer: https://soneium-minato.blockscout.com/address/<addr>. TLPT-ecosystem contracts verified: OperatorAllowlist 0x5fe9d900945b60b3becede4382bed2653ec99d40, TLPTFaucet 0x8c57abe7cf1330346eb760edaee380a66d3f42f7, TLPTSale 0xe5e1e4b594c343c1e9bac0730b25fd4ab21f7389, TLPTStaking 0xf3186574c8a0c0b3e235704bad389b78604b2745, TestUSDC 0x71a8e443f223cfe59498968758db49f2d114dce2. (Minato’s MBT/bridge is currently hidden in the UI.)

Solana (devnet) - Rust/Anchor

Three Anchor programs (mbt-defi, mbt-bridge-delivery, mbt-allowlist-hook); program IDs in webapp/src/config/solana.ts, source public in solana/programs/. Security review in SECURITY-REVIEW-2026-06-17 §6: cargo-audit (advisories are in transitive toolchain deps, not our code) + strong Anchor access-control review; no exploitable findings in our program code.

Stellar (Soroban testnet) + Stellar-bridge helper

Grandfathered: these went live 2026-06-03/04, before the verify+audit gate existed (2026-06-17). Recorded here for completeness; the Soroban contracts are being brought onto the non-EVM standard.

Non-EVM verify/audit standard (set 2026-06-17): Soroban/Solana/Stacks have no Etherscan-style “verified source” tab. “Verified” therefore = published source at a commit + the on-chain code hash (WASM hash for Soroban/Solana; Clarity is on-chain-readable) + a reproducible deterministic build command that rebuilds to the same hash. “Audited” = cargo audit (deps) + cargo clippy + a structured access-control / authorization review per contract (same method used for the Solana programs above). The owning session runs the legwork; session 5 records it here (single source).

EVM helper (Polygon Amoy, Etherscan V2):

Soroban (Stellar Testnet) - VERIFIED (reproducible WASM-hash) + AUDITED (0 Crit/High/Med). Explorer: stellar.expert/explorer/testnet/contract/<id>. Source: soroban/<crate>/ @ commit 7d46c531 (on main, merged via PR #58). Reproducible build: stellar contract build && stellar contract optimize (stellar-cli 26.1.0, target wasm32v1-none) reproduces the on-chain code hash for all 6; each confirmed by stellar contract fetch + sha256 match. Audit per the non-EVM standard (cargo-audit + clippy + per-contract access-control review) summarized in SECURITY-REVIEW-2026-06-17 §7.

Contract Contract ID WASM sha256 (= on-chain code hash)
sMBT CCYOGL2C7OKWDEN7XTIVLS6GFGOUEQQHER36YV5BHLPDCJJM3FIO3TD5 029c83b1707474897734c4399c166415ef6e114011e7f760846e40b17ec6d263
sUSDC CAS5G444JM4CDTX33ALSMAEJDMKMNKKUIHC3PV7N24KDRENRUVA4DCPO f89ba0deca1c5bd0d5ad5b0136ac7abb605f38d91f92f6d0419c56ef9b9843e9
LendingVault (Polaris) CB7WBLOFLDFJYKCYFOJYICDW3PUJ66IWIGJMP3P7MDDSXNGY5ON3JINS 9140af1a878cc74603a105e1516c628b98fdb5a78e03e4ede1a616ee18b45983
YieldIssuer CDOHKXC63NMVZ6BRK3MYCCEK5LQCUB227YI53EEPYMBGUZRONP6PCAFG 42c05a8acce0b3e487a3e3126526e94569d9bad0ad6874addb2cb9b8727ed83e
YT CBTRU54726K5WJV6VMIBFY4WW4SHRJF6DEQB7KKAWF4HAXECAVBISPVC 1b4609b03ad2912561123d353d92be527c658ab162da2fd33b0326bb6c8465ed
YTMarket CCXKKM7IVCDAYNI2FCN6DILBTDY37ZVUJB6TUWJEF4TS3IBCMY6QDFKD 88c17661175614faa61894c59e04e437a46cff80972ef482edac26fe4ac52a1f

Source is on main as of commit 7d46c531 (PR #58, feat: add Soroban contract sources to version control, 36/36 native tests green), so the cited commit is reachable via git checkout 7d46c531.

Not live (documented for completeness)

Last updated 2026-06-17 by RWA Bridge session 5. All live-network canonical protocol contracts verified; source-based audit (3 analyzers, 0 Crit/High/Med) covers all EVM chains + Solana.