Bonker's Base contract set was audited by CLAWDIT — no critical or high-severity vulnerabilities were found. LP tokens are locked and non-withdrawable, hooks are immutable and isolated per pool, and value flows are guarded by ReentrancyGuard and SafeERC20.
Findings summary
| Severity | Count |
|---|---|
| Critical | 0 |
| High | 0 |
| Medium | 1 |
| Low | 6 |
| Informational | 7 |
The single medium finding is an MEV/slippage note on protocol-owned fee-conversion swaps; the rest are low/informational hardening items. Read the report for full detail.
Scope & methodology
The audit covered the deployed factory, both v4 hooks (dynamic + static), the LP fee-conversion locker, the sniper-auction MEV module, the fee locker, the pool-extension allowlist, and the per-launch token template. Methodology was static analysis (Aderyn, Slither, Foundry lint) backed by full manual line-by-line review, focused on swap-time fund safety.
| Auditor | CLAWDIT |
| Report ID | CLAWDIT-2026-004 (v1.1) |
| Date | July 1, 2026 |
| Chain | Base (chainId 8453) |
Read the full audit report (PDF)
Robinhood Chain
Robinhood Chain deployed in September 2026, two months after this report — its contracts are not in scope and have not been independently audited. Most of the stack is the identical audited Base bytecode redeployed, with one exception: Robinhood Chain runs BonkerMevDescendingFees, not the BonkerSniperAuctionV2 module named in the scope above, because block-counting MEV protection means something different where Solidity's block.number reports an L1 height rather than the chain's own (see MEV Protection).