Executive Summary
bench3.ai assessed the recorded runtime, configuration and representative execution evidence for a Solana Token-2022 mint whose metadata identifies State Street Galaxy Onchain Liquidity Sweep Fund with symbol SWEEP. The mint, transfer hook, MMF controller, ProgramData accounts, authority PDA and ExtraAccountMetaList form a coherent live graph, and Galaxy's public portal IDL strongly correlates the application family. No issuer-approved artifact was found that maps this exact graph to a specified onshore, offshore, master, feeder or share class. The deployment remains a candidate and the opinion is provisional. [E01-E06; S01-S04]
Recorded work covered Token-2022 extensions, current supply and token accounts, upgradeable-loader state, ProgramData payload identities, EAML configuration, PDA derivation, role/user accounts and representative subscription, redemption and transfer-hook traces. The exact deployed hook/controller source, mainnet IDLs and reproducible-build correspondence were unavailable, so observed guard behavior cannot be generalized to every executable branch. [E01-E04]
Provisional assessment conclusion
No reportable vulnerability was confirmed in the assessed candidate runtime and configuration. Two control observations and four material limitations are reported. The evidence supports a bounded configuration/runtime assessment, not an exhaustive mainnet source audit or an authenticated opinion on the SWEEP legal product.
| Classification | Recorded result |
|---|---|
| Confirmed vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Control observations | 2; upgrade authority and protocol authority-PDA trust dependencies |
| Unconfirmed candidates | 0; unresolved branch completeness is reported as a scope limitation |
| Deployment identity | Very-high-confidence publisher-correlated candidate; legal mapping unconfirmed |
Material qualification
The authority PDA controlling mint, freeze, metadata and hook configuration is deterministically derived under the MMF controller, and recorded production traces place PDA signatures inside role-, attestation- or payment-bound controller workflows. This is strong negative evidence against a simple ordinary-caller path. It is not proof that every dispatcher branch reaching invoke_signed is correctly authorized because exact deployed source, the mainnet IDL and a complete control-flow reconstruction were unavailable. [E03-E04]