Executive Summary
bench3.ai assessed the official iBENJI deployments on Ethereum and BNB Chain, including the Fund Token, Registry, Authorization, Transactional, Transfer Agent, Intent Validation, MultiSig and related token-writing control surfaces. The work addressed deployed identity, role and feature authorization, allowance-based transfers, request creation and cleanup, privileged settlement, multisig execution and upgrade boundaries. [E01-E08]
Assessment conclusion
No reportable vulnerability was confirmed in the examined public-contract scope. This conclusion is materially qualified: both live Transactional implementations remain without exact verified source/build correspondence; the production CX settlement builder and account/requestId composition are private; and the issuer's authoritative allowance lifecycle policy is unavailable. These gaps are preserved as limitations rather than converted into clean findings dispositions.
| Classification | Recorded result |
|---|---|
| Confirmed vulnerabilities | Critical 0 | High 0 | Medium 0 | Low 0 |
| Control observations | 2; privileged token-writing authority and policy-dependent allowance persistence |
| Material technical limitations | Unverified Transactional runtimes and private CX settlement builder |
The examined public paths support a bounded conclusion about current deployed authorization and the tested ordinary-caller hypotheses. They do not establish correctness of every Transactional cleanup/replay transition, private settlement record composition, legal shareholder reconciliation or cash settlement.