Clique — EIP-7702 Delegate and Penalty Hook

Audit report published Nov 2025. Solidity.

Findings at a glance

Severity	Count
Low	3
Informational	2
Total	5

Summary

Safe Edges reviewed Clique's LinearPenaltyHook and DelegateMultiExec contracts, built around EIP-7702 delegation, in November 2025. Five issues were identified: three Low and two Informational, one of which is a gas optimisation. The Low issues cover the hook's reliance on being called only by the distributor, a signed-batch nonce that is never checked on-chain, and penalty rounding that slightly favours early claimers. At the time of the report the findings were under review with fixes pending.

Read the full report (PDF).

Findings

Low (3)

• L-01 Weak distributor access assumption in LinearPenaltyHook.execute — Open
• L-02 Weak replay protection in DelegateMultiExec.multiExec — Open
• L-03 Use rounding up in LinearPenaltyHook.getPenalty to better discourage early claimers — Open

Informational (2)

• I-01 Potential Gas griefing risk in DelegateMultiExec.multiExec — Open
• G-01 Avoid zero assignment in for loops counters for gas efficiency — Open

More published reports

Related services

Get a fixed quote in 24 hours

Send the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.