Alberichtoken

Audit Scope Excludes AlberichToken: The in-scope set is limited to AlberichGovernanceController, while AlberichToken remain outside this audit. Wrappers on AlberichGovernanceController assume the Foundation ABI of AlberichToken through IAlberichTokenControllerTarget, covering acceptFoundationRole, withdrawETH, rescueERC20, ringForgedBurn, setStakingContract, toggleStakingBonusRequirement, setVesting, snapshot, and transferAllocation. Behavior of those out-of-scope token functions determines the real effect of every in-scope call.

Operational Dependence on ALBRH: Core controller functions keep no independent balances, vesting records, or treasury accounting. transferAllocation, setVesting, ringForgedBurn, snapshot, setStakingContract, toggleStakingBonusRequirement, withdrawETH, and rescueERC20 only invoke ALBRH, and acceptFoundationRole also reads paused and foundation on ALBRH. If ALBRH reverts or is not a compatible AlberichToken, those Foundation operations cannot be completed through AlberichGovernanceController.

Single Governance Role for All Wrappers: onlyGovernance on AlberichGovernanceController gates acceptFoundationRole, transferAllocation, setVesting, ringForgedBurn, snapshot, setStakingContract, toggleStakingBonusRequirement, withdrawETH, and rescueERC20. No separate roles split allocation, vesting, burns, snapshots, staking configuration, or treasury movement. Control of the single governance address is sufficient to exercise every retained Foundation power exposed by this contract. guardian can nominate a replacement governance and cannot call these wrappers.

No Timelock on Controller Wrappers: None of the onlyGovernance functions on AlberichGovernanceController queue, delay, or allow cancellation of a submitted action. Constructor commentary describes governance_ as a Governance Safe, but this contract does not implement a timelock. withdrawETH, rescueERC20, ringForgedBurn, setVesting, transferAllocation, setStakingContract, toggleStakingBonusRequirement, and snapshot take effect as soon as governance lands a successful transaction. transferGovernance, acceptGovernance, transferGuardian, and acceptGuardian likewise apply as soon as the accepting transaction succeeds.

Multi-Signature Is Not Enforced On-Chain: The constructor of AlberichGovernanceController rejects a zero token_, governance_, or guardian_, requires each to be a contract, and reverts SameAddress when governance_ equals guardian_, so neither seat can be an EOA at construction. NatSpec labels the parameters Governance and recovery Safes, but the bytecode does not check Safe deployment, owner count, or signing threshold. Any contract, including a single-signer wallet, can be stored as governance or guardian. acceptGovernance and acceptGuardian do not reject a nominee that already occupies the other seat, so both roles can later be the same address and then call every onlyGovernance wrapper and both rotation paths.

Allocation and Vesting Without Beneficiary Action: governance supplies the to and beneficiary arguments to transferAllocation and setVesting on AlberichGovernanceController without a transaction from those addresses. The wrappers immediately call AlberichToken, which transfers unlocked ALBRH from the token contract to to or writes a new vesting record and increases reservedForVesting for beneficiary. Named recipients have no in-scope function on AlberichGovernanceController to approve or reject those Foundation actions.

Forwarded ETH Withdrawal and ERC-20 Rescue: withdrawETH and rescueERC20 on AlberichGovernanceController pass caller-chosen destinations and amounts to AlberichToken. On the token, withdrawETH sends native ETH from the token contract’s balance to to, and rescueERC20 transfers a selected ERC-20 other than ALBRH to to. Once this controller is Foundation, GOVERNANCE directs extraction of ETH and foreign ERC-20s held by AlberichToken.

Governance as the Single Privileged Caller: After deployment, only the governance address can invoke AlberichGovernanceController operational wrappers. governance and guardian can be replaced through two-step transfer and accept, and guardian can nominate a new governance without calling the wrappers. After a successful acceptFoundationRole, AlberichToken foundation is this controller, and the controller exposes no pause, unpause, or initiateFoundationTransfer path. Capture of governance is a single control failure for all retained operations, while pause and further Foundation transfer are unreachable through this contract. The signing and key-management model of the governance and guardian contract wallets is off-chain and cannot be verified from this bytecode.

No Token-Holder Governance: AlberichGovernanceController implements no proposal, vote, quorum, or DAO execution module. governance and guardian rotate only through two-step nomination by the current seat, or by guardian for governance. Staking configuration, vesting, allocation, ringForgedBurn, snapshot, withdrawETH, and rescueERC20 on AlberichToken that remain reachable through this controller are decided solely by the current governance address. Token holders have no in-scope path to authorize or override those calls.

Foundation Acceptance Cannot Be Reversed Here: acceptFoundationRole on AlberichGovernanceController sets foundationAccepted and later calls revert AlreadyAccepted. IAlberichTokenControllerTarget omits initiateFoundationTransfer, so this controller cannot start a further Foundation change on AlberichToken. After handoff, ALBRH.foundation is expected to remain this immutable contract for the lifetime of the token, and the current Foundation on AlberichToken must have already called initiateFoundationTransfer with this controller before governance can complete acceptance.

Pause and Unpause Are Omitted from the Foundation Path: IAlberichTokenControllerTarget and AlberichGovernanceController provide no wrappers for AlberichToken pause or unpause, which remain onlyFoundation on the token. After acceptFoundationRole, the Foundation address is this controller, which cannot issue those calls. An emergency pause of AlberichToken transfers cannot be performed through AlberichGovernanceController even if governance later requires that control.