POSTHUMAN
Audit passed Retest completed August 26, 2026

Opentech OÜ × POSTHUMAN

SyncVotes smart-contract audit

Independent remediation retest of the Daml smart contracts supporting app.syncvotes.com. The review covered source, contract behavior, application validation, release artifacts and deployed ledger identity.

All retest stages completed. Remediation controls verified.

Review stagesFindingsOpen SyncVotes ↗

Completed review process

Six stages, end to end

  1. 01Completed

    Review target

    Release pinned to an immutable source revision.

  2. 02Completed

    Contract tests

    Governance-v3 and wallet Daml suites executed.

  3. 03Completed

    Security regressions

    Remediation paths and release boundaries checked.

  4. 04Completed

    Application validation

    Backend and frontend checks completed.

  5. 05Completed

    Artifact binding

    DAR hashes, package IDs and ledger metadata matched.

  6. 06Completed

    Release evidence

    Test and rollout evidence reviewed.

Finding matrix

Remediation verified

All six areas from the original review passed the follow-up assessment.

F01Verified

Critical

Proposal authorization provenance

Provenance and visibility controls verified.

F02Verified

Critical

One-shot execution

Proposal execution lifecycle verified.

F03Verified

High

Weighted ballot identity and lifecycle

Ballot binding and lifecycle controls verified.

F04Verified

High

Threshold and electorate consistency

Frozen-electorate regression checks passed.

F05Verified

High

Wallet registration trust boundary

Owner-authorized registration verified.

F06Verified

Medium

Operational policy enforcement

Policy, validity and proposal-window controls verified.

Validation summary

Executed checks

Governance-v3 Daml tests
75/75 passed
Wallet Daml tests
11/11 passed
Backend Go tests
Passed
Frontend type-check
Passed
Frontend unit tests
32/32 passed
Frontend production build
Passed
TestNet and MainNet metadata
Package identity verified

Reviewed artifacts

Release binding

Source revision

43a047400582f15eed65f3086b2edb6ad919b3ad

Governance v3 · 0.14.1

Package ID

13e79387c569479b4583a39b53dff28d81b81380964da5dc99c032a660a57114

DAR SHA-256

3a6a9290174b9a4969127fbf1e5ec9c9953337c72324ad7cc8a786b3cf72db7b

Wallet · 0.3.0

Package ID

b86d12d9b38588f06f6d52163ce2655a1f3c6a2606322af1d5f3c45f551a0738

DAR SHA-256

ee57a96c1b7389eb8f62ef491b22291fcf3fda0732350245b1be8a0411a6a7f8

Scope

Limited-scope retest

This point-in-time source-code review is not formal verification or a penetration test.

Visit Opentech ↗Contact the auditorResponsible disclosure