RefundableProductEscrow v0.3.0.3

Polygon PoS Solidity 0.8.30 Independent audit, commit 89018f0 · mustcompany/must-pirateship@89018f0

APPROVE

For deployment on Polygon PoS mainnet

Reviewed by Mohsin Zahid · linkedin.com/in/mohsin-zahid-dev · 21 July 2026

This is the public report for an independent review of contracts/RefundableProductEscrow.sol at commit 89018f0ee3b04538a7baab4cc58e7d03325bf7f4 in mustcompany/must-pirateship. The contract is a 30-day native-POL escrow for a refundable product pre-order.

Full report

Scope, path analysis, findings, verdict, signed-checksum section.

Verification procedure

Reproduce the bytecodes, fingerprints, initcode, and authorship.

FINDINGS.md

The raw technical dossier in markdown.

Fingerprints at a glance

Artifact	Size	SHA-256
Creation bytecode	4992 B	`9a2fdeedce6b4758e554a5c7a5e2978a8e74591ff5aedf93cbad1633d02b21ab`
Deployed bytecode	4555 B	`9b9706867bfde369562f64c1c1d5779b8102c2484da3fd520e05ddf6472687e2`
Metadata	7637 B	`b359e617193751c11ad8b29b2b9ba06cec9dd3fcdb868f183716d7960c66bb89`
Initcode (creation + args)	5056 B	`33a7aae97e9b7a982c75dc4598469ac4e3ed9bffc8d182f1c1467e65bec55478`

Deployment parameters (used to derive the initcode)

`beneficiary`	`0xcF9178cA7360066B25de9c142A4c155abf151D6f`
`minimumPledge`	`300000000000000000000` wei (300 × 10¹⁸)

Findings summary

0 high-severity issues
3 medium: M-1 (irrevocable approval, design), M-2 (no approval grace past deadline, design), M-3 (no sweep of deployer-attached value, operational)
5 low / informational (style, DX, clarity)