[A26] [MEDIUM] Nothing records that the Protofire-audited commit has drifted 74 commits behind main

[thedavidmeister]

audit/protofire/rain.solmem.228b35c6725877e7fbcd2432b4c692357f16f510.jan-2026.pdf is an external review of this codebase, and the audited commit is encoded only in that filename.

Verified against the clone:

$ git merge-base --is-ancestor 228b35c6... HEAD   # YES, ancestor
$ git rev-list --count 228b35c6...HEAD           # 74
$ git diff --stat 228b35c6...HEAD -- src/
 src/lib/LibBytes32Array.sol  | 10 ++++++++--
 src/lib/LibMemCpy.sol        | 18 ++++++++++++++++++
 src/lib/LibStackPointer.sol  | 18 ++++++++++++++----
 src/lib/LibStackSentinel.sol | 16 ++++++++++++++++
 src/lib/LibUint256Array.sol  | 10 ++++++++--
 5 files changed, 64 insertions(+), 8 deletions(-)

The hazard. "This library is Protofire-audited" is load-bearing for ~23 downstream repos deciding how much to trust it, and it is now true only of an ancestor commit. Five of the nine libraries have changed since, including a functional out-of-bounds fix in unsafeExtend. Nothing in the repo — not the README, which never mentions the audit at all, not a manifest, not a CI check — records which commit was audited or that main has moved past it. A reader who finds the PDF has to reconstruct the drift by hand from the filename.

The reverse risk is equally real: because nothing marks the audited tree, there is no signal when a PR touches code the audit covered, so audited-source drift accumulates without anyone weighing it.

Proposed fix

Make the audited commit machine-readable and let CI report the drift.

Add audit/audits.json:

[
  {
    "auditor": "Protofire",
    "date": "2026-01",
    "commit": "228b35c6725877e7fbcd2432b4c692357f16f510",
    "report": "audit/protofire/rain.solmem.228b35c6725877e7fbcd2432b4c692357f16f510.jan-2026.pdf",
    "scope": ["src/**/*.sol"]
  }
]

and a non-blocking CI step (a report, not a gate — drift is expected and legitimate; what is not acceptable is drift nobody can see):

      - name: Report audited-source drift
        run: |
          set -euo pipefail
          jq -r '.[] | "\(.auditor) \(.commit)"' audit/audits.json | while read -r auditor commit; do
            echo "::notice::$auditor audited $commit; src/ has changed in $(git diff --name-only "$commit"..HEAD -- src/ | wc -l) file(s) since"
          done

Also reference the audit from the README so consumers can find it — it is currently linked from nowhere:

An external review by Protofire (January 2026) is in
[`audit/protofire/`](audit/protofire/). It covers commit `228b35c6`; `src/` has
changed since, see `audit/audits.json`.