Baofa's contracts are a rewrite from a complete specification of the reference programs, built to be compared rather than trusted. This page describes the programme and states its status plainly, including what has not been done.
Method#
| Layer | What it is |
|---|---|
| Specification sheets | one sheet per instruction family of the reference (maths, buy, sell, create, migrate, creator fees, incentives, errors, multi-hop, state, events; fees config, lookup, sharing, social and donation, buyback; Frenzy state, trading, sweeps; relay donations, epochs and swaps), each with numbered rules and the deviations the EVM forces, adjudicated and recorded |
| Differential tests | the curve and fee arithmetic checked against an independent model, vector by vector, over the reference's integer domains |
| Unit and scenario tests | every function path, every named error, every event schema |
| Stateful invariants | custody identities (coin and quote per curve), the diamonds' zero native balance, fee ledger conservation, checked after every call of randomised sequences |
| Fork tests | graduation against the real PancakeSwap v2 factory and router on a fork of BNB Smart Chain |
| Symbolic proofs | Halmos proofs over the checked arithmetic and fee splitting across their full operand domains |
| Static analysis | Slither, Aderyn, Semgrep with rules written for this code base, Solhint, forge lint and gitleaks, run in the gate with their results recorded in the evidence folder of each run and classified by the engineering team |
| Mock mainnet campaign | a campaign of one hundred thousand randomised scenarios on a private chain with the launch parameters, including the attack classes catalogued from published launchpad and AMM incidents, run on dedicated servers |
| Release gate | a deterministic script that builds, checks selectors, ABIs, scenario interfaces, idiom rules, relay errors, event schema and storage layout, runs the tests and records the analysers; every step writes evidence to a dated folder and the run ends with a summary |
Fix Discipline#
Every finding, internal or external, is handled the same way: a proof of concept that fails before the fix, one commit per finding, the proof kept as a regression test, the reference behaviour compared and any deviation from it recorded with its reason. A fix that goes beyond the stated root cause says so in the response.
Current Evidence#
The package handed to external reviewers, baofa-rewrite-2026-11-04-a727bfe, contains the 75 Solidity files of the launch contracts and their documentation, cut from the same commit the deployment is built from.
Status#
| Item | Status |
|---|---|
| Automated external scans | two completed, all findings fixed; see External Reviews |
| Manual external audit | commissioned by the protocol owner, in progress; report not yet published |
| Mock mainnet campaign | running; results are published on this page when the campaign completes |
| Static analysis classification at the release commit | in progress; the raw detector output is retained with the gate evidence |
| Mainnet deployment | executed on 4 November 2026; see Addresses |
| Bug bounty | not yet published |