Security Audit Report for Pharos Labs's Prosper Contracts

The target of this audit is the private code repository of Prosper Contracts of Pharos Labs. Prosper Contract is an on-chain launch protocol designed to integrate external R25 Vaults with dedicated pToken campaigns. For each integrated Vault, the protocol creates and manages an independent campaign that begins with an internal launch and continues through liquidity migration to an external market. After the migration, the protocol supports reward claims and uses collected channel fees to conduct pToken buybacks. This structure provides each R25 Vault with an isolated campaign lifecycle while using a shared framework for token launches, liquidity migration, reward distribution, and fee-funded buybacks. Compared to Version 1 (68c547), Version 2 (b8ef7f) introduces asynchronous R25 deposit requests with user cancellation, canonical pair protection, and time-locked LP positions instead of permanent LP burning. It also extends failed-campaign handling by burning reserved tokens and converting accrued fees into R25 Vault Shares that users can reclaim through a Merkle-based mechanism without an expiration period or administrative sweep.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we did not find any critical issues within the audited codebase. However, we have identified some non-critical issues that should be addressed. Additionally, we have put forth recommendations and notes that should be taken into consideration. It is important to note that the scope of our audit was strictly limited to the specific code versions mentioned in the report. Any updates made subsequent to our review would require a re-evaluation.