{"id":"ship:b6e0b82c-38c7-458f-a7b5-175ac15ce95c","withdrawn":false,"project":{"slug":"dobprotocol-distribution-contracts","name":"Distribution Contracts","url":"https://heyresearch.xyz/project/dobprotocol-distribution-contracts"},"domain":"build","claimType":"GITHUB_RELEASE","summary":"v2.1.0 — V2 security audit 2026-08","sourceType":"github","sourceUrl":"https://github.com/Dobprotocol/distribution-contracts/releases/tag/v2.1.0","publishedAt":"2026-08-06T23:43:20.000Z","detectedAt":"2026-09-30T08:14:29.819Z","precision":"EXACT","verification":"PUBLICLY_VERIFIED","countsAsBuilding":true,"countedAs":"counted","countedAsSentence":"Yes. It is one of the records HEY’s activity status is built from.","recordedAt":"2026-09-30T08:14:29.819Z","metadata":{"summary":"Security audit of the V2 stack (August 2026) and the Base mainnet deployment that carries it. Every fix carries an `AUDIT 2026-08 (<id>)` comment stating what was possible *before*, so it does not get \"simplified\" back, plus a test that now requires the attack to fail. ## DistributionPoolV2 - **B-1 — `createDistribution` was owner-gated only on `Reward` pools.** On `Treasury` and `Payroll` anyone could pick the moment of the snapshot, and with it who got paid. It is now owner-only on all three; opening it is an explicit `setPublicDistribution(bool)` opt-in by the owner, `false` by default. - *","releaseVersion":"v2.1.0","prerelease":false},"sources":[{"evidenceRowId":"f52cf365-253d-4bbd-a1fb-d842422d5f19","sourceType":"GITHUB_REPO","sourceUrl":"https://github.com/Dobprotocol/distribution-contracts/releases/tag/v2.1.0","observedAt":"2026-09-30T08:14:29.819Z","metadata":{"tag":"v2.1.0","prerelease":false}}],"disclaimer":"Public, source-backed activity HEY recorded. Still Building means counted ships during a market drawdown HEY itself tracked — it is not a prediction, not a ranking by price, and not investment advice. Few projects meet Still Building or Under the Radar at any time; both are strict by design, and list responses carry the counts."}