================================================================ PROOF REPORT PR-2026-0612-ASHLAR-0098 Issued 2026-06-12T14:03:00Z · Sapien · schema poq.attestation/v1 Envelope poq.envelope/text-v1 ================================================================ SCOPE Project VireoSwap v2 audit for Ashlar Security Datapoints covered 14 Reviewed 14 / 14 — full review Manifest sha256:3abda28d07b8d7ee3abda28d07b8d7ee3abda28d07b8d7ee3abda28d07b8d7ee RESULT Quality Rating 78 / 100 Consensus Strength 90% Label Verified — customer band SCORECARD Dimension Weight Quality Consensus Validity 2.0 86 94% Severity 1.5 72 90% Exploitability 1.0 70 82% Reproducibility advisory 64 71% DISTRIBUTION Quality Rating 90-100:4 80-89:3 70-79:4 60-69:1 50-59:1 40-49:1 Consensus Strength 90-100:10 80-89:3 60-69:1 PoQ Record sha256:5e7a498a241cd04c5e7a498a241cd04c5e7a498a241cd04c5e7a498a241cd04c — per-datapoint detail via Portal POQ RECORD EXCERPT -----BEGIN POQ RECORD EXCERPT----- {"datapoint":{"canonical_hash":"sha256:b3f1e6a92c045d7eb3f1e6a92c045d7eb3f1e6a92c045d7eb3f1e6a92c045d7e","consensus_strength":68,"dimensions":[{"dimension":"validity","quality":52,"strength":75,"weight":"2.0"},{"dimension":"severity","quality":41,"strength":63,"weight":"1.5"},{"dimension":"exploitability","quality":40,"strength":61,"weight":"1.0"},{"dimension":"reproducibility","quality":55,"strength":70,"weight":"advisory"}],"escalated":true,"id":"F-11","quality_rating":46,"quorum":[{"round":1,"votes":[{"id":"v-ag-01","model":"claude-opus-4-8","type":"agentic","weight":"1"},{"credential":"Certified Smart Contract Auditor","id":"v-hu-07","type":"human","weight":"1"}]},{"round":2,"votes":[{"credential":"Senior Security Auditor","id":"v-hu-12","type":"human","weight":"2"},{"credential":"Senior Security Auditor","id":"v-hu-15","type":"human","weight":"2"},{"credential":"Senior Security Auditor","id":"v-hu-18","type":"human","weight":"2"}]}],"settled_round":2},"schema":"poq.record/v1","shown":1} -----END POQ RECORD EXCERPT----- QUORUM ROUTING Round 1 quorum 2 — escalation target 70% 1 agentic claude-opus-4-8 — prompt sha256:4c1060768bf96d4b4c1060768bf96d4b4c1060768bf96d4b4c1060768bf96d4b 1 human Certified Smart Contract Auditor — instructions sha256:037a9bccc248dcbc037a9bccc248dcbc037a9bccc248dcbc037a9bccc248dcbc Round 2 3 human Senior Security Auditor — weight 2 — instructions sha256:5c14b887215515a75c14b887215515a75c14b887215515a75c14b887215515a7 Settled 12 / 14 at round 1 — 2 escalated CONFIGURATION Rubric evm-audit-v3 Config poq.toml sha256:41f9185be86f5bd141f9185be86f5bd141f9185be86f5bd141f9185be86f5bd1 POOL & PROVENANCE Validator Pool 40 — start 34, +8 / -2 Participated 18 human + 1 agentic Credentials authority-signed Independence blind review — 0 COI declared CHAIN OF CUSTODY Config locked 2026-06-12T09:02:00Z Manifest confirmed 2026-06-12T09:05:00Z Review window 2026-06-12T09:05:00Z → 2026-06-12T13:55:00Z Issued 2026-06-12T14:03:00Z ATTESTATION Root sha256:785e226d8dc36bc7369fed7f7de61ba7a01663beb2e13301e2c7558b2875c37b — over config, manifest, results Score leaves merkle sha256:572419963bef2bbe572419963bef2bbe572419963bef2bbe572419963bef2bbe Signing key poq-signing-key Registry validator keys + credentials · onchain Verify poq verify — offline, or via Portal WHAT THIS ASSERTS This Proof Report certifies that a Validator Pool was assembled in accordance with the customer's Assurance Policy, and that a quorum drawn from it, one per datapoint, evaluated the referenced datapoints (in whole or by sample, as stated) against the customer's rubric, reaching the Quality Rating and Consensus Strength shown. It covers only the datapoints enumerated here; datapoints added after issuance are not covered. It is a record of how the work was validated: by whom, over what, against what criteria, and with what level of agreement. It is not an assertion that the work is objectively correct, safe, complete, or fit for any particular purpose. The Quality Rating is relative to the rubric the customer authored. Sapien sources, manages, prices, and invoices none of the underlying labour and makes no representation as to it. -----BEGIN POQ SIGNED PAYLOAD----- eyJhbGciOiJFZERTQSIsImN0eSI6ImFwcGxpY2F0aW9uL3BvcS1hdHRlc3RhdGlv bitqc29uIiwia2lkIjoicG9xLXNpZ25pbmcta2V5In0.eyJhc3NlcnRpb24iOiJU aGlzIFByb29mIFJlcG9ydCBjZXJ0aWZpZXMgdGhhdCBhIFZhbGlkYXRvciBQb29s IHdhcyBhc3NlbWJsZWQgaW4gYWNjb3JkYW5jZSB3aXRoIHRoZSBjdXN0b21lcidz IEFzc3VyYW5jZSBQb2xpY3ksIGFuZCB0aGF0IGEgcXVvcnVtIGRyYXduIGZyb20g aXQsIG9uZSBwZXIgZGF0YXBvaW50LCBldmFsdWF0ZWQgdGhlIHJlZmVyZW5jZWQg ZGF0YXBvaW50cyAoaW4gd2hvbGUgb3IgYnkgc2FtcGxlLCBhcyBzdGF0ZWQpIGFn YWluc3QgdGhlIGN1c3RvbWVyJ3MgcnVicmljLCByZWFjaGluZyB0aGUgUXVhbGl0 eSBSYXRpbmcgYW5kIENvbnNlbnN1cyBTdHJlbmd0aCBzaG93bi4gSXQgY292ZXJz IG9ubHkgdGhlIGRhdGFwb2ludHMgZW51bWVyYXRlZCBoZXJlOyBkYXRhcG9pbnRz IGFkZGVkIGFmdGVyIGlzc3VhbmNlIGFyZSBub3QgY292ZXJlZC4gSXQgaXMgYSBy ZWNvcmQgb2YgaG93IHRoZSB3b3JrIHdhcyB2YWxpZGF0ZWQ6IGJ5IHdob20sIG92 ZXIgd2hhdCwgYWdhaW5zdCB3aGF0IGNyaXRlcmlhLCBhbmQgd2l0aCB3aGF0IGxl dmVsIG9mIGFncmVlbWVudC5cblxuSXQgaXMgbm90IGFuIGFzc2VydGlvbiB0aGF0 IHRoZSB3b3JrIGlzIG9iamVjdGl2ZWx5IGNvcnJlY3QsIHNhZmUsIGNvbXBsZXRl LCBvciBmaXQgZm9yIGFueSBwYXJ0aWN1bGFyIHB1cnBvc2UuIFRoZSBRdWFsaXR5 IFJhdGluZyBpcyByZWxhdGl2ZSB0byB0aGUgcnVicmljIHRoZSBjdXN0b21lciBh dXRob3JlZC4gU2FwaWVuIHNvdXJjZXMsIG1hbmFnZXMsIHByaWNlcywgYW5kIGlu dm9pY2VzIG5vbmUgb2YgdGhlIHVuZGVybHlpbmcgbGFib3VyIGFuZCBtYWtlcyBu byByZXByZXNlbnRhdGlvbiBhcyB0byBpdC4iLCJhdHRlc3RhdGlvbiI6eyJyZWdp c3RyeSI6InZhbGlkYXRvciBrZXlzICsgY3JlZGVudGlhbHMgwrcgb25jaGFpbiIs InJvb3QiOiJzaGEyNTY6Nzg1ZTIyNmQ4ZGMzNmJjNzM2OWZlZDdmN2RlNjFiYTdh MDE2NjNiZWIyZTEzMzAxZTJjNzU1OGIyODc1YzM3YiIsInNjb3JlX3Jvb3QiOiJz aGEyNTY6NTcyNDE5OTYzYmVmMmJiZTU3MjQxOTk2M2JlZjJiYmU1NzI0MTk5NjNi ZWYyYmJlNTcyNDE5OTYzYmVmMmJiZSIsInNpZ25pbmdfa2V5X2lkIjoicG9xLXNp Z25pbmcta2V5In0sImNvbmZpZ3VyYXRpb24iOnsiY29uZmlnX2hhc2giOiJzaGEy NTY6NDFmOTE4NWJlODZmNWJkMTQxZjkxODViZTg2ZjViZDE0MWY5MTg1YmU4NmY1 YmQxNDFmOTE4NWJlODZmNWJkMSIsInJ1YnJpYyI6ImV2bS1hdWRpdC12MyJ9LCJj dXN0b2R5Ijp7ImNvbmZpZ19sb2NrZWQiOiIyMDI2LTA2LTEyVDA5OjAyOjAwWiIs Imlzc3VlZCI6IjIwMjYtMDYtMTJUMTQ6MDM6MDBaIiwibWFuaWZlc3RfY29uZmly bWVkIjoiMjAyNi0wNi0xMlQwOTowNTowMFoiLCJyZXZpZXdfY2xvc2VkIjoiMjAy Ni0wNi0xMlQxMzo1NTowMFoiLCJyZXZpZXdfb3BlbmVkIjoiMjAyNi0wNi0xMlQw OTowNTowMFoifSwiZGlzdHJpYnV0aW9uIjp7ImNvbnNlbnN1c19zdHJlbmd0aCI6 eyI2MC02OSI6MSwiODAtODkiOjMsIjkwLTEwMCI6MTB9LCJxdWFsaXR5X3JhdGlu ZyI6eyI0MC00OSI6MSwiNTAtNTkiOjEsIjYwLTY5IjoxLCI3MC03OSI6NCwiODAt ODkiOjMsIjkwLTEwMCI6NH19LCJpc3N1ZWRfYXQiOiIyMDI2LTA2LTEyVDE0OjAz OjAwWiIsImlzc3VlciI6IlNhcGllbiIsInBvb2wiOnsiYWRkZWQiOjgsImJsaW5k X3JldmlldyI6dHJ1ZSwiY29pX2RlY2xhcmVkIjowLCJjcmVkZW50aWFscyI6ImF1 dGhvcml0eS1zaWduZWQiLCJwYXJ0aWNpcGF0ZWRfYWdlbnRpYyI6MSwicGFydGlj aXBhdGVkX2h1bWFuIjoxOCwicmVtb3ZlZCI6Miwic2l6ZSI6NDAsInNpemVfYXRf c3RhcnQiOjM0fSwicG9xX3JlY29yZCI6eyJleGNlcnB0Ijp7ImRhdGFwb2ludCI6 eyJjYW5vbmljYWxfaGFzaCI6InNoYTI1NjpiM2YxZTZhOTJjMDQ1ZDdlYjNmMWU2 YTkyYzA0NWQ3ZWIzZjFlNmE5MmMwNDVkN2ViM2YxZTZhOTJjMDQ1ZDdlIiwiY29u c2Vuc3VzX3N0cmVuZ3RoIjo2OCwiZGltZW5zaW9ucyI6W3siZGltZW5zaW9uIjoi dmFsaWRpdHkiLCJxdWFsaXR5Ijo1Miwic3RyZW5ndGgiOjc1LCJ3ZWlnaHQiOiIy LjAifSx7ImRpbWVuc2lvbiI6InNldmVyaXR5IiwicXVhbGl0eSI6NDEsInN0cmVu Z3RoIjo2Mywid2VpZ2h0IjoiMS41In0seyJkaW1lbnNpb24iOiJleHBsb2l0YWJp bGl0eSIsInF1YWxpdHkiOjQwLCJzdHJlbmd0aCI6NjEsIndlaWdodCI6IjEuMCJ9 LHsiZGltZW5zaW9uIjoicmVwcm9kdWNpYmlsaXR5IiwicXVhbGl0eSI6NTUsInN0 cmVuZ3RoIjo3MCwid2VpZ2h0IjoiYWR2aXNvcnkifV0sImVzY2FsYXRlZCI6dHJ1 ZSwiaWQiOiJGLTExIiwicXVhbGl0eV9yYXRpbmciOjQ2LCJxdW9ydW0iOlt7InJv dW5kIjoxLCJ2b3RlcyI6W3siaWQiOiJ2LWFnLTAxIiwibW9kZWwiOiJjbGF1ZGUt b3B1cy00LTgiLCJ0eXBlIjoiYWdlbnRpYyIsIndlaWdodCI6IjEifSx7ImNyZWRl bnRpYWwiOiJDZXJ0aWZpZWQgU21hcnQgQ29udHJhY3QgQXVkaXRvciIsImlkIjoi di1odS0wNyIsInR5cGUiOiJodW1hbiIsIndlaWdodCI6IjEifV19LHsicm91bmQi OjIsInZvdGVzIjpbeyJjcmVkZW50aWFsIjoiU2VuaW9yIFNlY3VyaXR5IEF1ZGl0 b3IiLCJpZCI6InYtaHUtMTIiLCJ0eXBlIjoiaHVtYW4iLCJ3ZWlnaHQiOiIyIn0s eyJjcmVkZW50aWFsIjoiU2VuaW9yIFNlY3VyaXR5IEF1ZGl0b3IiLCJpZCI6InYt aHUtMTUiLCJ0eXBlIjoiaHVtYW4iLCJ3ZWlnaHQiOiIyIn0seyJjcmVkZW50aWFs IjoiU2VuaW9yIFNlY3VyaXR5IEF1ZGl0b3IiLCJpZCI6InYtaHUtMTgiLCJ0eXBl IjoiaHVtYW4iLCJ3ZWlnaHQiOiIyIn1dfV0sInNldHRsZWRfcm91bmQiOjJ9LCJz Y2hlbWEiOiJwb3EucmVjb3JkL3YxIiwic2hvd24iOjF9LCJyZXN1bHRzX2hhc2gi OiJzaGEyNTY6NWU3YTQ5OGEyNDFjZDA0YzVlN2E0OThhMjQxY2QwNGM1ZTdhNDk4 YTI0MWNkMDRjNWU3YTQ5OGEyNDFjZDA0YyJ9LCJxdW9ydW1fcm91dGluZyI6eyJl eGVjdXRpb24iOnsiZXNjYWxhdGVkIjoyLCJzZXR0bGVkX3JvdW5kXzEiOjEyfSwi cm91bmRzIjpbeyJlc2NhbGF0aW9uX3RhcmdldCI6NzAsInF1b3J1bSI6Miwicm91 bmQiOjEsInNsb3RzIjpbeyJjb3VudCI6MSwibW9kZWwiOiJjbGF1ZGUtb3B1cy00 LTgiLCJwcm9tcHRfaGFzaCI6InNoYTI1Njo0YzEwNjA3NjhiZjk2ZDRiNGMxMDYw NzY4YmY5NmQ0YjRjMTA2MDc2OGJmOTZkNGI0YzEwNjA3NjhiZjk2ZDRiIiwidHlw ZSI6ImFnZW50aWMiLCJ2b3RlX3dlaWdodCI6IjEifSx7ImNvdW50IjoxLCJjcmVk ZW50aWFsIjoiQ2VydGlmaWVkIFNtYXJ0IENvbnRyYWN0IEF1ZGl0b3IiLCJpbnN0 cnVjdGlvbnNfaGFzaCI6InNoYTI1NjowMzdhOWJjY2MyNDhkY2JjMDM3YTliY2Nj MjQ4ZGNiYzAzN2E5YmNjYzI0OGRjYmMwMzdhOWJjY2MyNDhkY2JjIiwidHlwZSI6 Imh1bWFuIiwidm90ZV93ZWlnaHQiOiIxIn1dfSx7InJvdW5kIjoyLCJzbG90cyI6 W3siY291bnQiOjMsImNyZWRlbnRpYWwiOiJTZW5pb3IgU2VjdXJpdHkgQXVkaXRv ciIsImluc3RydWN0aW9uc19oYXNoIjoic2hhMjU2OjVjMTRiODg3MjE1NTE1YTc1 YzE0Yjg4NzIxNTUxNWE3NWMxNGI4ODcyMTU1MTVhNzVjMTRiODg3MjE1NTE1YTci LCJ0eXBlIjoiaHVtYW4iLCJ2b3RlX3dlaWdodCI6IjIifV19XX0sInJlcG9ydF9p ZCI6IlBSLTIwMjYtMDYxMi1BU0hMQVItMDA5OCIsInJlc3VsdCI6eyJjb25zZW5z dXNfc3RyZW5ndGgiOjkwLCJsYWJlbCI6eyJzb3VyY2UiOiJjdXN0b21lci1iYW5k IiwidmFsdWUiOiJWZXJpZmllZCJ9LCJxdWFsaXR5X3JhdGluZyI6Nzh9LCJzY2hl bWEiOiJwb3EuYXR0ZXN0YXRpb24vdjEiLCJzY29wZSI6eyJkYXRhcG9pbnRzX2Nv dmVyZWQiOjE0LCJtYW5pZmVzdF9oYXNoIjoic2hhMjU2OjNhYmRhMjhkMDdiOGQ3 ZWUzYWJkYTI4ZDA3YjhkN2VlM2FiZGEyOGQwN2I4ZDdlZTNhYmRhMjhkMDdiOGQ3 ZWUiLCJwcm9qZWN0IjoiVmlyZW9Td2FwIHYyIGF1ZGl0IGZvciBBc2hsYXIgU2Vj dXJpdHkiLCJyZXZpZXdlZCI6MTR9LCJzY29yZWNhcmQiOlt7ImNvbnNlbnN1c19z dHJlbmd0aCI6OTQsImRpbWVuc2lvbiI6IlZhbGlkaXR5IiwicXVhbGl0eV9yYXRp bmciOjg2LCJ3ZWlnaHQiOiIyLjAifSx7ImNvbnNlbnN1c19zdHJlbmd0aCI6OTAs ImRpbWVuc2lvbiI6IlNldmVyaXR5IiwicXVhbGl0eV9yYXRpbmciOjcyLCJ3ZWln aHQiOiIxLjUifSx7ImNvbnNlbnN1c19zdHJlbmd0aCI6ODIsImRpbWVuc2lvbiI6 IkV4cGxvaXRhYmlsaXR5IiwicXVhbGl0eV9yYXRpbmciOjcwLCJ3ZWlnaHQiOiIx LjAifSx7ImNvbnNlbnN1c19zdHJlbmd0aCI6NzEsImRpbWVuc2lvbiI6IlJlcHJv ZHVjaWJpbGl0eSIsInF1YWxpdHlfcmF0aW5nIjo2NCwid2VpZ2h0IjoiYWR2aXNv cnkifV19.RKetDigsgl66VY2qBq4nxoP78GjknkcPo6YP7Icc353FmsJYPWXmJCh nK7izXJWU85eirReLQKC7mSR7NtGTDw -----END POQ SIGNED PAYLOAD-----