Opentech OÜ × POSTHUMAN
Source-code review of the Daml contracts and signing path behind syncvotes.com/app (v2). It covers browser-side verification, balance accounting, release artifacts and deployed ledger identity across MainNet, TestNet and DevNet.
The source code is public on GitHub. All review stages completed; Opentech OÜ approved the final assessment.
Completed review process
Release pinned to an immutable source revision and one Daml package ID.
The syncvotes Daml package reviewed module by module: authorization, signatories, ensure clauses, counting and execution.
Browser-side prepared-transaction hash and root-node checks reviewed against what the server may execute.
Memo deposits, charges, marker deductions and hourly sweeps reviewed against ledger figures.
DAR hash, package ID and vetting on MainNet, TestNet and DevNet compared with the source revision.
Smart Contract Upgrade lineage 1.0.0 → 1.0.3 checked against prior DARs; deployment evidence reviewed.
Finding matrix
Seven areas reviewed; each control verified in source and, where observable, on the ledger.
Critical
The browser recomputes the prepared-transaction hash and checks the requested choice, contract and arguments before the member signs. Unnamed fields are refused. The server executes its own prepared transaction under that hash; its ledger user cannot act as a member.
Critical
Voter and provider sign ballots. Membership records votes to block duplicates; a permitted change withdraws the replaced ballot. Counting checks the DAO, deadline, rule, member and share at voting time, and rejects double counting.
High
DAO_Execute carries out only passed proposals under DAO authority, in bounded batches. Dissolution waits for other proposals to finish, and blocks new proposals while in progress.
High
During an open secret ballot, the app serves no totals, turnout or member contract IDs. Ballots cast since 1.0.1 are not held by the DAO creator’s validator.
High
Ledger memo deposits count once per event from the configured start time. Charges use participant traffic net of rewards; marker deductions cannot make a charge negative. Balances are provider-signed statements; the package moves no coin.
Medium
Text and picture-link lengths are bounded in Daml. Shares and ballot weights are positive by ensure; membership changes require the founding table or a passed vote.
Medium
Each release since 1.0.0 is a compiler-checked Smart Contract Upgrade of its predecessor; live contracts carry over without migration.
Validation summary
Reviewed artifacts
Source revision
3c14e2522a760101dbab4c5919c377752f55f961Package ID
1450e874679f4ccd07c7d9f1aeaff75bdcb186fc0cdf750c3606bddb4f0ecfcc DAR SHA-256 · project build, September 26
34c272f0672edda5ddc4a1f8499479cd4fdd747931703685f4aaece414ae9d0a Project build hash; an auditor build hash has not been published. DAR bytes may vary between builds.
Upgrade baseline DAR SHA-256
790774527d26620c5ef4ed36eb3e3bbdbf965fa7cecd8be61c89776eafe2fe7bDeployment
MainNet, TestNet and DevNet reported commit 3c14e2522a76 and package 1450e874… at their /version endpoints on September 26, 2026 (project evidence).
Daml: daml/src/SyncVotes/ — Types, Rules, Tally, Markers, Governance, Account and Billing (909 lines). Application: src/lib/verify.ts, src/lib/server/participant.ts, tally.ts, billing.ts and deposits.ts.
Scope
This point-in-time review covers the v2 Daml package, signing path and accounting at the source revision above. It is not formal verification or a penetration test.
The operator can read every DAO hosted by its validator. The published trust model ↗ describes that boundary; the project’s review compared it with the code.