Midwest Smart Contracts & Audit Solutions Technical review · Published findings
Review published
MSC-ONWARD-TR-2026-001Onward
Presale
A point-in-time technical review of presale payments, recovery, token custody, claims, staking and reward logic.
Version-specific recordThis record covers v60 at source commit 58265a299d249e539c64539275040470826d264a. Later Onward versions are outside this review. Finding status and balances below describe the October 15 snapshot, not a fresh assessment of the current website.
01
Executive assessment
Review completed, findings disclosed
The completed review ran 240 existing tests and two additional audit tests. The production build passed and the production dependency advisory query returned zero known advisories at review time. No Critical or High vulnerability was confirmed within that scope; this does not prove none exist.
One Medium capacity issue was reproduced. Launch readiness remained conditional because the additional launch-staking program was intentionally deferred and not yet deployed.
Review disclosureOnward and Midwest share the same operator. This was an AI-assisted technical review, not an independent third-party audit. The numbered badge identifies this published record and its scope; it is not a clean-pass or KYC badge.
02
Confirmed finding
M-01 · Admission exceeds finalization capacity
MediumOpen in reviewed v60 · No remediation retest published here
Observation and impact
Final allocation processing rejects more than 16,383 distinct buyers, while quote generation and purchase reservation do not enforce that same count. Checkout can therefore accept allocations that the normal finalization workflow cannot process, delaying claims until processing is expanded. No token theft was demonstrated.
Reproduction
A local ledger with 16,383 synthetic confirmed $1 USDC purchases finalized successfully. Buyer 16,384 received a v3 quote, signed a payment transaction, passed reservation and received an authenticated acceptance receipt. After its synthetic ledger entry was marked confirmed, finalization rejected the buyer count. RPC availability and simulation were mocked; no live sale with 16,384 buyers or mainnet attack is claimed.
Recommendation
Support a larger or safely partitioned allocation process, or enforce the supported distinct-buyer limit atomically before accepting payments, including pending reservations. Reconcile the separate 100,000-purchase ceiling as well. Do not truncate paid buyers or remove proof and packet safety limits without testing.
03
Evidence and controls
What was checked
Payment acceptance and recovery
Authenticated v3 quotes and acceptance records, sale-cap reservations, transaction validation and recovery were inspected and tested locally.
Delivery custody and claims
Finalized mainnet reads compared the supplied delivery ELF with deployed bytes and checked mint authorities and vault balances. Local signed claim tests rejected altered amounts, recipient substitution and duplicate claims.
Staking and rewards
The source and supplied binaries were tested locally. Launch-time staking was deferred and not deployed in the reviewed snapshot; weekly rewards depend on reported fees and funded pools.
- Total supply
- 4,000,000,000 ONWARD
- Mint / freeze authority
- Absent in captured mainnet state
- Presale + bonus vault
- 2,600,000,000 ONWARD
- Team vault
- 200,000,000 ONWARD · Clock not started
- Other reserves
- 800M liquidity + 200M development + 200M listings remained treasury-controlled, not time-locked.
- Delivery program
DCiadKRWCT7oYGDBsdjkMe3LaCSi6D5dfw4MjGJvphh1- Supplied / deployed delivery ELF SHA-256
1316e7c1ed8100c5f8c6a02aca10d17e59676bf332b4198d253bb92808cfb252
Finalized custody snapshot: 15 October 2026, 18:43:47 UTC, slot 457341743. Reserve snapshot: slot 457341992. These balances are historical observations.
04
Launch and operator dependencies
Conditions recorded in the report
- Deploy and verify the deferred launch-staking program before launch; seal buyer and staking allocations and verify launch-time funding and clocks.
- Payments go directly to the treasury. Allocation completeness and actual trading-launch confirmation require owner action.
- Weekly rewards calculate 50% of an owner-supplied fee figure; the implementation does not independently prove all launchpad revenue or automatically fund every distribution.
- Unmatched incoming transfers require classification and settlement review. A transfer alone is not an accepted token purchase.
05
Scope and limitations
What this record does not establish
- No mainnet transaction was signed or broadcast. Attack and payment scenarios ran locally, with synthetic ledgers and mocked RPC where noted.
- Source-to-binary reproducibility was not independently established in this completed report. Matching deployed bytes to the supplied ELF does not prove a fresh source build produces it.
- No exhaustive formal verification, comprehensive fuzzing, full device-wallet or browser penetration testing, infrastructure access review, or complete production payment-ledger reconciliation was performed.
- No independent third-party certification, KYC verification, project endorsement or guarantee of safety is issued by this record.
Subsequent attack-testing work was not finalized into a separate completed report and is not represented by this badge. Changes after the reviewed snapshot require review of the affected components.
06
Numbered Midwest badge
Download and link to this record
The badge carries only Midwest branding, “Technical Review,” and the report number. Keep the image linked to this page so readers can inspect the scope and findings.
Website embed
<a href="https://midwestsmartcontracts.com/records/MSC-ONWARD-TR-2026-001" target="_blank" rel="noopener noreferrer"><img src="https://midwestsmartcontracts.com/api/badges/MSC-ONWARD-TR-2026-001" alt="Midwest Smart Contracts Technical Review MSC-ONWARD-TR-2026-001" width="360" style="max-width:100%;height:auto"></a>