Sample report

Business logic audit report

Does the product do what the pitch says? Three gaps between the documented model and the code, and what each one costs.

In short

Three gaps between the documented model and the code: reward timing, fee rounding, and liquidation incentives under stress.
Two were fixed during the engagement. The third was accepted with a plan to index the liquidation bonus to gas.
A contract can be correct and still not be what was promised. That gap is what this report measures.

This is an illustrative deliverable, not a record of a real engagement. The subject, the Lumenswap Protocol, is a fictional decentralised exchange invented for the purpose. Names, figures and findings demonstrate format and depth; they are not real results.

Executive summary

The product largely delivers its promised mechanics. We found three gaps between the documented model and the implementation: one affects user fairness (reward timing), one leaks protocol revenue (fee rounding), and one threatens solvency in stressed markets (liquidation incentives).

Two were fixed during the engagement. One was accepted and documented by the team.

The business model, as a chain of dependencies

Lumenswap earns a 0.3% fee per swap, split 70/30 between liquidity providers and the treasury. Liquidity providers stake for time-weighted rewards.

Growth depends on deep liquidity; liquidity depends on reward fairness and withdrawal confidence. That chain frames every finding below — a code change that looks small can cut the chain anywhere along it.

Promise against implementation

A business logic audit is mostly this table. The code can be correct and still not be what was promised, and the gap between the two is where users discover they misunderstood the product.

Documented promise	What the code does	Business impact
Fees split 70/30 LPs to treasury	Split applied before rounding; dust accrues to treasury	Minor LP shortfall, disclosure recommended
Rewards proportional to time staked	Snapshot at claim time only	Early stakers diluted, retention risk
Withdrawals always available	Pauser role can halt withdrawals	Trust gap between marketing and mechanics

Revenue and incentives

Reward timing, fixed. A large deposit made just before distribution captured rewards earned by others. Loyal liquidity subsidised opportunistic capital, which over time drains exactly the users the model depends on. Resolved with per-deposit accounting.

Fee rounding, fixed. Dust-sized swaps rounded fees to zero, so high-frequency bots traded revenue-free. Bounded by gas costs, but a real leak at scale. Resolved by rounding fees up and enforcing a minimum trade size.

Liquidation economics, accepted. The fixed liquidation bonus drops below gas cost during congestion, so bad positions stay open in exactly the markets where they hurt most. The team accepted this with a documented plan to index the bonus to gas.

The user journey

Each step read as a user meets it, because a mechanism that is correct and unusable fails the same way as one that is broken.

Step	Experience	Note
Deposit	Clear, single transaction	No issues
Stake and earn	Rewards visible per block	Fair after the timing fix
Claim	One claim per epoch	Gas-heavy for small positions, batching suggested
Withdraw	Instant in normal operation	Pause powers must be disclosed in user docs

What to watch after launch

Share of rewards claimed by deposits younger than one epoch, as a gaming signal. Fee revenue per unit volume, as a leak signal. Time-to-liquidation during gas spikes, as a solvency signal. Withdrawal volume after any pause event, as a trust signal.

Each one is the earliest visible symptom of a finding above returning.

Recommendations, with an owner

Two of these belong to engineering and one to product. A recommendation without an owner is a wish.

Recommendation	Owner	Status
Per-deposit reward accounting	Engineering	Done, verified
Round fees up, minimum trade size	Engineering	Done, verified
Gas-indexed liquidation bonus	Engineering	Planned
Disclose pause powers in user docs	Product	Open

Questions

How is this different from a technical audit?

A technical audit asks whether the code does what it says. This asks whether what it says is what was promised, and what the difference costs. The same contract can pass one and fail the other.

Why is a rounding error worth a finding?

Because it is permanent and it compounds. Dust stranded on every trade is invisible per transaction and material across a year of volume, and nobody notices until the treasury and the LP statements stop agreeing.

The work behind this

Tokenomics and yield review

Emissions, incentives and yield sustainability, modelled under stress.

Compliance and business logic audit

Every feature traced to the licence it triggers, in every market you plan to serve.

Investor due diligence

Independent technical and regulatory review of a product before your capital moves.