From 7bdf24a7cbb6f3fffeb76ef9694e4f4801abe583 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 21 Jun 2025 22:11:52 +0000 Subject: [PATCH 1/2] Initial plan for issue From 49e90d8ed13172e3b13ba83e4ab67373ab7109e1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 21 Jun 2025 22:18:37 +0000 Subject: [PATCH 2/2] Complete comprehensive security audit with Typst PDF report Co-authored-by: 0xrinegade <101195284+0xrinegade@users.noreply.github.com> --- audit_report.pdf | Bin 0 -> 58032 bytes audit_report.typ | 359 +++++++++++++++++++++++++++++++++++++++++++++++ audit_summary.md | 83 +++++++++++ 3 files changed, 442 insertions(+) create mode 100644 audit_report.pdf create mode 100644 audit_report.typ create mode 100644 audit_summary.md diff --git a/audit_report.pdf b/audit_report.pdf new file mode 100644 index 0000000000000000000000000000000000000000..4153758a167c7c979621c988a016a9dd852a1705 GIT binary patch literal 58032 zcmce-1ymhR)9@MGg1bAx-Gd~!6Wrb1-GT)O?k)-L?(XjHF2OBGu$`O#^UAZ|yWgJO zJ!fwhXJ)FayQ`|ZXW-5c$}b{f3@nUX@RVPH4?H{z3kfrcouMT>A0Ipk36rviy$K1E zn4PUN=t{}O(D|&p|^24V65coK0*bZB6Y+{-y=cDw>#C zI5|6dkWhaHyfC2wECH>&qcIRQ5E}J=g!ZorB^P^pYZDtF4J4qv0p0`FAb&tXJ6hN~ z+c}c3u>Fk;s1Q;6YsI8SqQwm8IGCA9Sb)O8%ud1z6b=p+5;jm_BM0W}AUr^4fB`TDD0*N3U>G1Gb{3Fu{T&e)6gUHF*+9Yt%n;xlT5+`SO8P|SAdKFYG6LNfhr(TfN%jn zfSUbpTMl4=f5rg90|ew12hbdtall)^S&+Y=E`R|*T>_o~odKxhv3>)Rqs2ygMwj0b12s9`CYNNqr+{hS` zuYCqYcw(()p@{fl+zLc6uf8^F5V`XrY2q%8t);Yb(SB_g1qe#Sr^>H;r@gMfr?6bp zI#1K5-P=mSf7Dd?)i0ux;XJ@Z6pJ++d@&a2^JSyfCrnf;r@pi#x7g>n7-Y7(yg% zrkU1hs{&+R*xSC#H=_`vE4R%7$For$`3F9dX6Qedu{)olQ6Ke1 zN<;g|r|=FrKjCMfqe|XlaDNaL$@mhGg&PB@2}X09@QDUR#WIKT3v>d6e|;WfUs@A= zm#Ao77bTb#6k`C2gT_05gb+$v60U3I$)V+Z=R_hQ9RZ@19Y0~X$9&T?i zj|g*+tw~ak!->Shr29@n%M2UgjN^%`zmhq@%pS7gMF<8aTCHZt-V(+l>b58wq2X5h zgum(V_L%)cedEAnebS5EiSQebneTnZ=7pB;;IzT1I*houxT8-@B{eHAH9M7MDK#tg zRwQx{(!=Uo)r#1%uHwhphU84bqbsBcO@42egZA4(W9J)6uH#PiiBTjZq>v9grMp4c zSHBOlGYeNY|D@l@Jo#;Y?A+PfI~v0De(vx~sWdO|q-N)(=JhpEclS1)dhI$Yme*xS zd0U0DqfhDFIxAiU7gfscV|P(9R<9aj@;rWGnf5n`Rk$G_7~tmS^^Qq1dtw%3BGw+0 zO|nGC&R4rWx-v>A9nQ`iEYAE;7Y(xrw`J-28d)Cg+yimBEBvG*J5w}|_awWt>$UF7 zbG&o;!)F8$$*|y@f*~+ zBUEeN0*<?(!m4RyBc@aLzLuQ65YtwCh9Y8tTX?c1tT zKTv!dn?~(Q?H4z4BCS-3-;C&G`zZ0yF(u&z!ind+sG>98r5*A92!~4Joz+^J>1JP? zcgw~kinM^Y$az7wDZgPlc*68^zYVg_slFOooF84pntA*V?;^+9sW%<#5rg|jWMVCiqZRRuauNrM4l%74P`>703d?BA_i|H)Lds(5-0K&cf zbIK!=y;FvbPWAWbl`p@x#-$_P^S*miU~)X<)XDnl_4}rxGGO$ z9KYJlJS9C$70Yc=Hr=zEqcq(_TWRy?+k(;wPn(#SE1U%@z9{f1QZBHZdH?I#$q}Me zlln3#%k>SiqqfC4;D(MFdZ3r$CxoY`aVnLZW-+i3|lUg=)P3`dQ8TAkb=GOU><0_AnZiG4{ewpp%N|E zOc^!Bi7S3r>~($YoG61|ns^mGI*zLqG?dv$EnBbfYOGjV(AoN@Sn~c?ev6h67#>On zP28t;Oe8mMaO{E&))(9Z-tL!>SxLc!v|r+qSMN>vDr+>WB_572H-0krb5inO+qNF0 z6|}!7HLQCS;7-zUTsQvexpi+fy<#*=yv=UI2!>=6x~G?mGp`$V&S2pY%v9Z{TXsCY zTMqc0xAt_lyBJc*u6<%t?X31keP2}mWz~lV zt3myDH6yYR zB9(EK0><%niJ3VcM=t(l*bLd=C|7(V_2=s2E8Tm`*9rv$(!|vpn8dW<3pQnBcR1P=YeoW(IRp)VT#YnJ;9n2`mc-euaYQj=B4hmqliJuOx>l>{-E2dMsF z#S0r==!q?5hqliAF1<3N9v7AB-^xB3qB@IrN<*lT*;l-tE;`Fe4ezLO%0K>sck!I^ zY)eGdCMZ#hi6lvAHxEm1fKL<F~nX0rS@~Uz#L8f1xGf*BpFOGd?NyYJqf-#97uS zuAEtk37^jS)jajJi6;UEoJFd!=ewX?a#v|NiG>P*!!Xz&=Dl9;{R=p(;+v53?dsjC zdCebvTWJN6Nb|{qt#lXv%YSG@@t_5fi-)T?i^hk(*{;a%YXOb5A-106^v_%$ed>O26^OhO@^VE!Gu!c7jDn3Zc#^Db<4hQ z5mw?An5y-JjCXoc2m(pI5O(zt1}@#pU#Vr(*-`rVSEWdXeL7ZWMKG>rSt~1uQ|Kc% zNP=W+o4e!QTrPFk(@D=|#V2m2@YAI^iLT88G`-L(zXT?ySKP69Tno`e*63puTd>w0 zVBd@)tEM^?l_Z6_nH*yzen)kdtXzJmj&idvX$!nsPl8gCaL>L^o>|2x?of&0VD>R^Su?jp-DJ;>E02)RAM921{e_x-TxP)O zt&$MuA;uo&mh8|3ZBC8TOgzF3ZI$viHHI-$HksiB zw-WK|6&V>8hhB{MSHUkbeuJ}Z`SSQbQ$)0tv<%;(jNJ93Nr&b9b=w49zNSq`a#771 zSV*(Je)O~P>KH~fL7)sA4P0%dO{cTUO~3aL4;MBETOoacw7u;s9w^d?VZ5~(1%>1#4A}fl{N{*>8D!aIX(bUmoK$(p}Hmq(m z2uGTDcJOsqd|R*Sz}tsYX>gXV-Z8ByaKM2hlHiO|r%}^f`S?=HjSXUk6+Ja*?2Cpe zuOOQa>TAUp{ZEpD6R)de!@{3)!%FQ7tvankja z!uNa4o0%ewcbBWWNMyUva~O)$7DmzUCq=?+%QVMp>cq+o>Tmf_9Mqo`$s_DW>oQm) zWKg?WYM%nL0@me%X=*L`V~Q4KKP=KYe{XxppwMuf<7|YWDZVnmsHW2`mM;)tL9M32 zv6@M#vz9g`N>nT5I$-OILvwQRkYmw%cV04(lTBDq$n$(^&p7^Lkdt&l6vpmHBhfc> zovH_?8e$x|tnMPFLVbkfP@+!=PWK@-Wb+srRCK-de2yO((k|F-2qCOTj}HEv1TH_2 z4=r*YC1vdq;Yj?55no2d7uxemP$G(^=`)HF#3i5cI6-o~>;}7wV@c($&1y!R&Y(X} zmKZ@z$;006;9$U_J#Dg8t0ms*?}VHZw#==A>r@ovL?&`L!nPOKXPF>ZBXStV!8U=- zM+xJ8*i4Y6EcFtVQFju(ey8G6&ej>kLPUj5LBvv=Q26#P;)Kf;d!9ulsU)yo*(8{? zDdRIelW=Cma1K<}7fadLPo^`94FgS)SL zWq$ax7)Kgaf$-}@)JVq0+A8%mw`zNg6%Lee%Y3;j`WUJUb$f{lg#20NYdtYs8*<_7 zs-mpmer4funwRH+7}{@^JxHU&QNnL~s9b+!Kg>DneiP71%aI5#;QHo+@%zqKR!G&b zBSFu#Oe0->9~U$0ean#6-tRe9zha(<nm1tomFRD&yRbViQv0S2(=lW@^L@^ z#N6Et{8`|1D9_f5S<1!|F_E@Lz$1*@g0a%CLH9OG7bQ|MrW`oc{x0CElt)*SpmAbQ zpFWbqTJ>j7RpYfQUh~e#4eHz*9Qp%WeRY2pGcIBaB`!k^--vb@!?5X=Nt60oqT0G$ z3M(t?H_TcVFtD`CL1wbA+27{m0{Ztu3|?ylKeUUi5j4=~@&&Hwqa-zQq%w5wsANsE z`?drbR4R63(TzJRocve|RQCGqckJ|BHKBR*VMB&k>bi7UhJ~Ap;qw$-RHDZ|qIE)s{V;d5T>$N2tLR>hxKI64BUDOcrEY)=)UVawi z!mX9%>dJD%^u_z>!4xt}1)RMWN{m8vnI3vs+o)9NL9fCnq}wdk$n!50_(RZt9?eB^ zKRQblaBnro`+aINY}ahEbyC;1$0J_2wpBTaJ~@gte_l!~%ies#6Ff|v>yU zk73&}JWmVtB5AZcDS11fRF*wnVKqoCP*A!lOI8Q}X)t&Lb8eRC6+$4t5wqJ|d^+~v zPw2vTFGe80`L^f&>cZ3MZOS7mOu0*DQyW>!n*}kk*yVQIohIEmx@CiQWg>cr4pW4` zsnuySR`k6>zvuW~<#ZqtLE6zLvZ}18sGwM(tvY~F`M`Wk`Lmyge= z-;j!zmw{dzCk|hQ;>Srq6wCtE&FZexoj6?oPLMru<#{O@uR?M+6|Mc}Hd21er#cAy z@6B=z7K+y!ndcvqQ>{IOZ1L((dnr*%sr&rUbpswR53rfxp2S^%=406Dsq2S++4j+BIgw2-SB_;ykM=7(VE2L&Jgan* z&A*G7dKsr!ATtM0od4W*3ZW3-K2=shV$ow({{Gav`|y<@Y}OTeFzg`Lsfjn6?%N?F zxjc6W-&^zr@%f=-2?ZzR*k^(*{V^_Z*)l(F?1wyqFrjw2VYM5vn%k-aBAkWTInm7RV8#*L*zGV+i_xt$CcLv%3F-JpH7&0NMftip+lx5@6=o?rzC%`qog{R%y}iU;JMNem3mGR zRkJqKC(EcKsHsEZ6IHpg7U|mf5KpLtL$>2;BZjbsQOp|IGlreBX>ja#7AR4=8||tT ztM7KSym<-Fu;i6=6;UP-mE{tI;KVB>&G09$h+Z>82X|S9BO#ffgxB6Z?S27L4>iyW zD$6OjnpQWak}nYM(BwGL#F=nBa=pKWT^ zYYzoM!`Hhw(vI~|7%c9$mS~P*ZP8>9&y<)+7zHE@KiI$Wq7cWD3`^3=8ttS%DS6VY z)i}2zj1_JiV&UQLoJ`DYyt4I76iJ6>RWmUw%MA97^e6=le>?g%u~y?r?n5C+hfUc{ zvG8t?xO=FUyv`N~`F?9A&btoqCe%!sUl7^a+q@~x%dL0ldEUX#8rd}c{sfC3!`2q1 zzG6gtB955PaAQ}KRBBTQV*qZEKKM~rW9@xbzBz7M_yXx5BAu$}o^DSl$49N}nAsz9 zt8a~&)_!&M@%x1*wY=i(O0Y?MhMP9>*F`GJ4AN+%c*|>OFX*jP2$#&|KSVck)33QB z&1zpew6Y`2mDq<6d`NB;lC^|XE9kRFCfP7dSpsHLbkyp5@gs8xZ7|!xP=}BgQ1AVk zi`SQjlLX~*P<#S@C0$DEx@59Wk0n5#P)*F(^c^<{?}e z1gG;!o6O+J0P!r^m}4orvdZ60*Z3-A4wue($}n8(I;%TcsF|sfsBIc&Uk>M-e?SRnJSG zo5DpVLwCg@wtvfq?HXj+y?syC`;uU#iZhFY0jEQ8EOg@GqqiQE{6}yfVJ2?@GR$Tt zaT|J#1NhF`9-`qFo~{C!b1bb2>CZ6X?`s4mNQuct6O)X4A$6Itu1Z@$>HS9f17Rs( z4hXZ=o1>?n2`^z2f>^6|7cX!M{a`g#zLe1AdTMze(94NE=l_^)HgSm9VxnEcY!qsn zugKowPvJ#2Mdx&X+s3%|xM_TOwmAIN)h-tK z>{kVvQs5DvN3its?P5jbMU(V~nC*E@0Nwx=Ps2crpFfrLI>eRJ#&5XSnB@`7F7c+A zYR4C>!P{sAITR~8GCNEh+oPjczNP*OlXh=cOFm+Rmsw%O_w`r0rCJ;)pPsUw(7jRu ze6YWMoqykVZHs9sk1HPXWE6sm)goN`bai=B6G+Ra-7jnuKZQ{@Hrkj+6|~`^{(Bkf z$CkjtbRZ$sX({}b9OBABm&nW=_(fZDek$X>uW6*Vt%2ir_9io-I%C(-=o%gGNU718 zz8qFqp5bIgbG&48ji>>9XEL#T#p;M2@#ENoezg<^YsPOAOy57!GAg#OVL5e)9iaN- zA6>g;TjmhYXLK%2-tkwIxw*hW(|@qJMG;IfVi684XB6C)(G1K!sXFVlu0@K4YRHsN zlP#v5ER+$hEx1qiF2RmA_nm1VWBf2Ir1F_o0L{(tXS2GJC5`kYLr#A)rU8SplBkN> z=#zNC*`37odN0c2{#{6f9(rf30V>CH!F|@(MCo9uF@X(9T$vu`r}xifPXsm|v}u_I zBK&uf%T>_(mzQR40>76z$79U|q_sDG$g}zcw_@0T7qP-??)$y{g>EUbqrjIC#;EWGo9D)HEiIjP>fT z_iM0O*9@lMhs0{W-v)@)vuVN&zjsCEmUaHDQ5+A}e8DX^NBmQzme1UwddRL(<2b3Zofl^mH0*w^?D|rm{%tVqRLo*L!lY)!OtjrxTPe z{qux6@N@1o+g(=gP1XnBD@dHslUQ6Y3f*Dv9an=OyY2-uH|lt7j7#H?sAn&qPuj!^ zu>HcBv0zmi)x)*}n62=e^ZZ)$c)}~H*P-dc%OY#Fhe}ePgsk7&gu&6?{j^V%O$mFF z2&S9(!yGFcNz)YVT(Mwm@ILfFK+k9nb0JRB;j`kJ%lAKn{?QAC{-{Z!okAmZe1=#b$2AvnnUYkW9Rm3L~%{oWv_G}zSlovTJ_H!!YeRGY~Ew1_@Qar-k%3oAE_vOk%|cA z^jYC{Z~Cn~secDYNIahlUDH-Cq9vhIqI(ua(ARqBWos3P>^O&+M$jrC-E4O~iO+$;sHM^gu4Vd#A~G zVwnlakLn5vTKWg+j*jde%H(4a_uyP&-cMQ2Sic)#);~)<*QQmS-C*ZwS53x zwK7Ae;)lNDUs3&+k_+gb68iU#5?Mb(eGc$eIY7T;m~nQ+5`gL`twD44!w@1y&Q8TgEEr25NUQ2P6QAYjkL`a* z`8ixR%4iH(J7C7wfiv74uc(TLp1F;&=9OlgF*Z4ckH9_>4<7ViK9!u+KH4E z2ePxR=Dc_)8_c*ai<6XRi6#xUY1$qXJ1UYO4UdSlt)m>E)z<9`4HPDCylzqQ39H4UIPF@=`UGa7*{>Z3BNVOdGMHb>jD`<^gwTE3*`C#=cy(_u-pOhZmbqUv-2T{&CkWdn@v50t=pKF6Q zXu8G25g2>Rl7kZ}`tjF_XH*mJmHj)c=RlM6s)jHmtG%4zP&V}TkcI8nVC8H3(p;=R znOhIN`+J^@aj#BvhXjiP`$%Er3qgDzp3gjMq>)&tv0P_J4dq^Zw@68Awusr0;Do_{ z9g`r*Ku_pZJ8N-SE)ZB5K+^~QlGBfiyYK$(BoV^Sel;3&Lh)9BlEyYl z>U$Nc)H7iM1F2&+ir)mRhUz%5 zU*mjtKJMg;yP!EjijxiBCE1{b9XkX~W<(+K`S4|7f`eHZ_Jh;=`J@{SZW5Ex_PTdX0ByX!a`JcD%!E>UTO;jyyG8dK4DI|S&Hwa% z6-2xI7e??8IPmX8%zrR4at1a4g!I1wjQ$#08<;r(+zJab7x#ZO6cVy?C(&ZyWaZ)@ zVPFI35l$8^0BT`oVP|9pKAeBiB1vZhYYU^#wr1A#fS5pt6+4LA0U=fZ!UNzo0J#HjGN1yWH6XZ(8-RpB za1|Q>GlAeLHlDv^6#!SU131<{a1|Fw_ZO~W2Pm6=;3^QD1u!{)aBu^5f8i=t(AxY9 zSAo!+f5BB;{{dHVfQ`Au0||;Os9%#lg(>cS{3^6hJ=#oE8wnKL8a6H!yR5 z0V*C4SoIg6VgsH115klrslNafCkWK~3sA8FIsXTs;sl{n00jmN0rUq91_(EhBtQ+S z0o_pkLRBF6>K~|ziy2V-g{uCpl)q3FJNG|C6#!`g@%{r<0sZ|uR0Y~~|Fy^d6RP@q z3;O>8RoU(^W31m`WB@rZ_wGSLJ`qHOclbbuXQ$pa&B1P?t|_j zU&h*1bo9Ej!Es>bNOp$LN(IqMkKE0o4;x;znhT5a!f(3;JgbWN^HdHS9p?tKN7s56 zlMAiJ3U1^9U9Z>0n!3W7b$oD`(U6KtI=yGwr&_%XeSc9|Yb!pFWj!3fONLJC)x>%) z(=Zq-v+EZ4otEhc?xoY-_;bEr)y@T!RIadXxgyL;So}X8bd)ztmfBjK+shly)!D)r z+1TfXpE;gx|3RuSKuFck>y3XQRn?o{{~}eP#(Wi;W;+-3DSoQ}QZ;mGlc-&@*KzA& zLBFnl_f*fR7W2t)Tdl=ZZ^`vS&h@tEg~N;q-)|gZSI{ND`plmG^>lTq%5T z51b#IAB-Q2;p=s19D#Z83bZ*PYGJGORG1Ii`(Zrl&mYdoL`59oDEuM6eD_fv{hFg$ z5~>K7R~?PQM{!Al{i!HlKY1!OfQb}R;K$dlWJi)qNq31bunna=iXZf%QrZxtl#-c4 zqQTG;4B*%W3Gsk1Eh2?b!1$*Yl>e*GWdA!$|FX*J#s6?}0A^G?BB-RxZ zo;!prem%h}#y&Rc9NkoMwGVEKBHx^HYJC4;^RgGVOCJ@>%qC@K=Tu#sUPb4-^QnE} z;OhpLADHY1|AGJE!4K@-|6!?fvGeeN9tHmsC-~nVj{p5J^Y36)um+4f#{7!hdo9Rw z&+(?ks$8~!9K+8dZHg7Jp(HcXBrzy6_`ghMYg>mGmX|kXye7{J&=e(LQ6c@ke)Z=_ zpf@ieWOc_sJ!K>2EqPqOA3o1uJM_Nsxp->7aBxd!A0A&{U$?R`{$g(EXlyMtlQh*g zRF%vb@~uz=hN`7QYj|r6{kRzNW>1;Rum-;p%q~JcN;0h$TNZBYEIX^l^0e%)%KC;K+ ztIdOPACnE~n}dn;x4DJTsltKe-*W?fO+`~%dxc5)6ykl9RO1d#UPI&SHqAo=^rKAG z{)6-r&(H|?2bw&6#>gj=O2n%2nKOJI<|8o<$D1j>9WX7pFIw9x(?)fgvaOt3nyXF~ zqdA4E@QcnTYv0#j){yx{JgWHj;@dv-*YK&ca*ki^UGj)Gmp1z#+hvcXWeD!i)1(z6 z6mC3eoo>>4*tTKllG;6>Zi?T%Wj@`AiA+7`q8fQ zW6Q+p%@=vYg!=_#y5;1zdq`q>FtI8~JdIxKg6NAsh%K++xLw@WgjVX4{=Qr9h#A44 zv6{vY&SJPz#WT(c7r)-6iNnC|P4dEN=nq`IB)Y;(*H@k{DRkebcW-V&9k2f&I{{wp-5wV+JSP+wagwKX zba$saBH&Wcox_-n+eGJVxQ+>Czq@xr9Uc&)%r%sDdH?78D(_I%`3kZCn!ejPZs4J~)2dFoq>O|FxklG9fd?#OhKNk45BcIp;WNW?Xu&@;-fiqBoQySq z2izwZ3&Pq$D4m`&WWU?AA{rC4y%Fv;WaHZ2_TPV*HZIYb^HF~%r9z)Rt^Y!Cpd>L7 zQU-O|&j7V?_l0$7I^G$p(|yV#CsSF|*b{X;I9MN@xJpVsz4UT{ar>khzBy$tOe%P+ z4uV=NyVVebIVcmts$1T>OqeRMcnrKmb^hRc;tR47RHGA?6bAlYZnb63szMoF(YI># z$0N#?XefO!n2!p!4XI-y(pGAs_`0fD@z&%F#c2;XVBXUl!>&A};_*j1@$5e&({$pG zrYRgD+`@HF(~LRIzD%dDNhlkOtdiNEu1zrTlyb(kCB_{PT(a&SUY-g=yR$r`c z*-LjnJ{LQDZaA)VDyEr77sv{EKe!Lqwt%*o#$vOA)>uCVBAX=w*zXScyNp%eW;N)nBd3s=8v4!Uw1a57UB`I4Cv28(TPUn%c*v0hB z<=DA1-(-=@x1+Foem(aB_eH^%dOaLJ{-j4Av!o();PG)~M_*+Cm-&SZYaRi%!?tjN z=}S(vx;cLo2OgqjVr;^~0krl@`!7?|+P{jpGwvt7dr0VV z5uq7P=Q*u3%|Bw7&Wk@`Sq~<+@3xvY^Z%J4x|T97X8u$)tA-<{A4y8{s0x>=NVD;w z^uSPoRTz&_xO>wYi`D7$TIGmtiR9@gn!PI%lUnEzI5g)$b)0SJ?SU?QjyjRGd1UNt2+?9C%5H_|7q*1q z)4pSBLXCsR&D;l^+}WG1L=)^JU6@fj{SQ&BsNMz^o*oXulEIQDUvS}0Ge)S{(jn(L z#t+k;(Dl^g+kAGR4VN9UT%GP}Q#ghVPPRfXTrTsHrpERu+MjmuyD z#E?F?gxjG{-isECf1sp#9q2iGq6=PzU@A}QYScSEG4qAjk_f-v;i$Px^E+EvA=lfT zQW|F3S+U)!L8{@lYUV>I~Tw*y|8su^XX)6C+T1v=ZH1T}^(`uJY?bA4Ew45ofpcd%}xf8cz+6?MN zZ{R6rq{I5U59ZSfY@(=X%+%UkP)ZvlpYFmX7~K0!CweGeHjRO48V*NrIUA$wsrpj5 zKt(z=lC)9EKGrZk@nK9F3aMfVs~{q9BJW0JSb;akb(kW@4zab6{XonjQ{}Tc2`By6 z+7b;C#WJM`E|>~JH>HVc!p?GR3k9c7j#bBaTKVNc)HSLrHciWAXz3ECF@5HvGy|oy zrKt4t$pworf1u8gB&n*rQ`K!}5ZplKL2ca=GE#o z*;@a-4#r$;ZTDFr+JJpzGf#0?SzG3oyTrbFRd$3*!}P(4d0jd!wRDUw9Y&~a=6*za z)9c;M8Z&JQd~`&ik~mEL=#7)r0t6QQHESW(d0b!EPZ0-=={02sS6jmdA-VyhT0;OR zO|9QQE7%>UK$cNk{=B4XDpk^oHFo!o3Hb`9n_jhJBd4_IGxrm-cP|!h$)$=MzERHS zmhxN|K3&ol2^%q{_l9yF`=YKG5eb1`=8saolxJ5I1tP3{ zdM7AaQhzjL=O1aJ|Awtv>pm&X8{nBL={k8pXT|8hDA33I$&E>HML+VQS1UbybVQO~ z(?ltyAG$&&jdZx%sJOuvjc*i;ZKFu1!`}b?fFix9rX!DUQvz3oH(*8)x-`e3vVML# z9!x_qUq}+Q5>7*X5J8fzu^f%wn`yhQwtH_$JOQ(sU7wKH)4|brh7XriCR8S>*DbG( z%Qew0n@KcvLxZ-haVDVTbOL3;5hiizf;|nr)T~`KLMj<sXy`!Q&pfal!fSYpdA%h=hrET#oAf*4T?rLhnjf&VQ9WuG za&U-L5a4K>jObnB0`5>vsOmae;dBxUH_y|uXP?urH?9TTZ>>Lj8SpI6HmPZS<5D}M zNREX{)wHPl3X`S6lY&fm?pDc~G0ETMbYF1Q+c@ofnN9A5&;O~h;Z%jR8m=Jl_aGS5 zLT_@Hv^`z3VJR)-1%berSsag?S+_5W4|E6A;U~X`Mnd~P)(#rzLciDsTJ=wK?q}Wj z<%qWjRVn8e)l}veKdAH%P*L`y<@n9m3G9vw|125&wc$z_q& zdWfW%kbWT7>zZ^ZimQN$pQ}9`uG-;{ZLiDN;PVby>XH~I)m#T0R6uf~Rjp5GFwIA& z*()Bj%LA8BglFeu9yfh*_ASU`578|1=o#%{pN{F{aG1{By@bu>Tr{v0GU64e`(|fY z6$2~8h`{|iuW&D)cQQ}x6+fw0uxHXkgll|HqVizc*qS=xl{i(LmMo46UQe>QOS0?j z?crE~WkqwX8iCey8Gi_SeRmW^ON~cC=wJtH3Y@^<;s)<4V#>mxs7ZF=hpaFS?52I4^OnY+hd(iv5xKjQyLMr~ zT+dc2q%XsQV%kn|$hb1}3>s(qACfVdPQM~Uoi8=J)ppk#SK5bs4laV6M75-?Sc z+7Ya+z4kcG9(Lo#__-2Y^09vT<3K!oB2vx0YAPi8#S!x(REJafV!YGZ%!-V171J#R zJq=Yk6g!!Dndl0`MPW-*os=-@5{(JPZOj{jUu0xGy?^}gl`o3dNn$yqblmw z35bJoI*cb3k6azu>xOVT@<=y2_}YA=0WZ#8R&PPDj2)fbW3dhH7zQZR-w+Mnz`{S{ z`zZ(Ay#>RT=Ms`5mcQJK9KG&+gCTQ1{Fb3|BKciW3FC+IkO?OkqN4gzFx-*zN%WM3 zdwps0QXbAl7RqbmijL2vIZVZns+3|%e^{zmP@H#oTq^B)Y-|3L4|{N zKrcNXQQ#K7s|^EMs+6lK>vlMrfnVj1=~+=mH{P1Ij#^(s(`td?_o<^?I|e zVpzaLt)s^YB~pG2>3w9!1aioyJq{6^aNL0CHq1zkcMFbH1#qPDe|lrg9E6ITO*n;K z`Py|2dJ&<+myH{i-dkERa+TM7KIrR&QnC$H1G`8>xPcI2+xaPJ#NJs`(5)R!e5Q5B zXMEv#)^Bbg>Ou=wH&j`@rv;~rd;Vdtu+8lcA}|8GV8$YU?LR%kGXQy(2aJ$KSydwS{t&!tYybHeb9A ztHkK2+%;YB%`Ny-H51_*8cr1X{hGdOGr>F%`!TwQv`?zK#x!+xe8Fg|38*VB!wV-` z*1wJ_n^d8y`1Ugq(p5Y)R-AHssxNB!Avr>JM}_fqe9djzD?XT9xC*%!1xi9pS> zMn!VYjxb@ykIbz_A&_v5+-mj1ubML?bZX?wvh!bDko-$~O0@4%J{O5udX_4t-pFSh zB06bx7359}ec}vwK-h>p3g*g$|Kq;=ZpowB7^PKt!rGYVFgYn9A+Zp%|HFf+2vy8d zvtvAUi8Z-^-S)TS_R^mxJCbGOB#bm{B#J1ySZeXY`iF;}7h$WIBq?tW&y-&S&E(!S z7L*+?(f*{_v*CR|I02dWp(H_)B9ZdPp1ZZkXS38FYpOD)YV(q-m-xhpzRU4C_^Y2Z zBTS$ko2HA#I7lXFCujGi%ed1Bvv9H|)HK7DA0u5>z}xJY5;f!-@|SARA?;+5eJG!Q z|A|MEb!kWcHRV_ZcDg@#C5_<4e?N9LJ3k&cNYIK!62;Z~H9JeJZND1%=<$^|1x{$| zW00s3tEKE(k?I38$*0(NB;hb9vg1KBWE|gP>$yx82%2yz#H(yO8sV#F(nEhon15r0 z8VVxaA{6>L5>I>6bob?wnL4(~*vA7nIs9wO&*wLJwj7NZj!SX@(EEai)|L%vuO-bT<|YI&+7 zP>S(wF|aQWl0eqBpkvLDbbM7S5?2-BNnQ))8PpbM)f-|oFGM_@J`5lZW+GT#*| z(vU_g_3zjtdPPfAP6{Cgppm|z+kD!yfAb!KXxk?{yj~@^5eYtW4MjX~R$IpZE`kar z(lVT;6NRmon2Z@N9VBWjDHOno;pa2q$esNDZaZ&uu>OcfeL^>;_%bW!HG_Pi%1P++ zsCFn~n|S#To=ty^A;Pp%FjsOn^MF`vB0Rw;FMh|;JnxV01iH5)oGHdwYu2n7xWjhu zeiPLfqhvwqgyA9h_;H4sYT*E-CW zmGBk^GtATJN@#$Bb!wM>D0`-Bi6cGHXY%7W-ogah9C|6MES|+A58DPcpHPNKEQiE8 zDd{HI!m{dET6{u`V(Gd5k2%=td-+pzE}s5!<$`j*Muiyh9@e=RcH>8Kd2MJtz!i(56~r7O zWXxr7g?$PQbIe!ehFRU@+=&@thX;R>z(AK4-LfAfy(1hl7WI4?Ow`?h`?dcG@#pL^$7hs^X-REw1te7mJlSFa zinVP^(grz+A=5r)n_WfVFK*xM$B2y3Q)wmxZlpaA?n?gz(o^sUc+aMdEj{xu$$mG) z1!+n-Rp0Y#_#BA*b%rF>s70x4m$OiuNRT`#`4HL<2m<|J*sRW=rCGvUR1Z$rg+8P4 zI?_l_n^3}4AutEV%MCl_1yS>4jr4JiZzAYE_+C5$|6lM;Q^BxbLJzUvo|zlGx+I)v z%n@Z!?_JB1&oO6Y*cS_RuO-E1nF^9cMt|+5OOpq7E@`V!yROe&qo+DQj=xshlY`%&Ee#fDTLvstiC9IQ^={{X(1#7BBab{Pc;%!}aaM<$HCX zl?wvbbdNa6!|Zid=JYPcam{w$;iQ$E+#klWRE~&7wNnoI@LbeaW7Q(N;tU`vexEEl4%=>l(m?fJ&JJVR%gv@PFAK6;+3tb+c_i7jlx6Izml5U-hv@ww9+$}TNFg1d? z;;x(6qa4Cpj$yj1c(|6NVrbG^)VpgK7-$SKKGjr>)2xz7o`#nY_zfEJ34EqSi=zw7 zRsEEu|KUjBmI-I*p*xtME-d+j)}m@Bm0 zU0}rCcxn=wOWnk@TsQi}dFMUkIDva&qQR83^%3NtX3>Xk#sZ#A4MiUAh9-4OHHm1Xm@bsd<s1?T$vV<39pmuw--$!rAx5Mw|7m<6%zq@O*vAXsJ zyUeK0eo zwr$(SD%-ZLRkg~tZQHfVwr$%sZhc?(J$rZb?(TC>oVb7AH%H8zIWuQO&hg|kScWO9 zut;XcTcz8Mij$L|Y5st`2l4mAyI5^+I#%fz7;G{V{5-L1ke}EaVUJ@`+XH|U_CNf^ zVz1kPjRil@-=gN4US7?mW8Lf;0u&L@{D-&}f{u=k!Zy?ls+=?&sgFkg`SfQGf;e^t zZpkD>4H0}q%s~r3eGjOgSy2}`e1KoWhJG=oPq@E#SGfP9$tZ)%)gl5*^riM#=}d^f zgc+D1NJ!Zx{f#1_}-Um*p#m^Pi^(HdZG~6 zk8sfQe9x1`!w;mWy32IcZnSmZ&Mwr&4ksz8E8EKh-y`CQ@e7luq^Z<}Y|r&{VBSN2 zy=Ug_9%VbM(HoBAR$y)zJOQyHTs99rY~oco<%|zu0NdX-yw|S?ya8Iv%GDFUt%ilf z7%ugwz~4?!Rf%m$Ajg8cR8}Xp3BS+;(b|NR6(3-I{i|{mz=hDU{XQ;Y;BU^r0Dkc>Q8eM(7O7Q7u-Red1I=3fq3p#?WXPOcnP86xtexIM%B zut#Jj7e_H2*r(DrjTBUkG3CzfN8-D7wcTxoCuTvCp zU)7>IovrA#Aei&$t}4Y68Qg|)MEJ?3Hvuvi-U#sZ>r)Spw{0R z>Hh#~eM2?>`hNfF#(xKD2@0!P4WC^DC?Vy z`Tp^rEj)iW`v)-ck0l>@_y?5rUv~66i=c2zAvq0 zD<&cQZ4df~8|<$Je|xb00%zzMY3W($|D%uS@3HyENc=B!hUu@!|8sOEK}vRy9y##o z<1coGI%U-!_cuIZgVL#AFnOAKa=$U*4DqPpj1ON^mnM2-NdMmQ5bx1?`g%OxRQlao z*)PYV$6^&a8?)k0r=##-Yc?(p^`?Uc*NNw2t%I_?OS{6>P8u+_vH_1jHm5U+OFv&2 zlrM*0q8yGk&kn=kndc2K2VJh%bkA=3=(6f^^2i#i+TD0?6L{|ubgS@AoBk*a`o9%v zG`#8Aq)dniO=Nc*4~Ac!7M+SnbbxN8N+>BO=jS}Pt-mGgTp!X$*mT*rRMyp$l_C}0 zPQ4F&aYcLxWQrP^mN{^_WWA0)INw#tM4NoAtV?S@?f6L)?v+`VJ-g!e^4UDeOpsh3 zl@%x*TAn;ibNtc!e9Ntj>ej2hrxI$W(eAR|+&I^GI}+8des@Gd{#u)Yit4x+IR|Q*M;ch8c8CV`q2Es!$CTAK zl*v*6N)D0<%-AS~%f3=I2gn4FP$~kCp{W` zDe1hlWzaP2OeuxEzNDC4s#GcrO-ftAB6FL1K%KC8n;L~Dqi{V{qIe`rUOW5@+7z_| z+7tq1yu?({mdPDzdQ6VKosMG#=GT-wz1v8kkKgp%Jd@beHVGQfpTJLbd4BEuEJYHj zFNYKK7l$&V;TS~{BIz=tV_jNX;v>kif*GoPoC4ZFqirn$jAKaxi~tH<*cV7f^jA6Y zVtW~doM~z@pp4GhDmYkA@sq}D24#DACU$TGZFTL z>Q2~0q3X>2`$stv4HR2{nz2}3CcHM^o_Nwan@?#QGaOGdu3l7-B*7VC5P^t)t=5O{ zR)ZN4>9~i(C-EBgC^`<+bEwv=M=U+^Jlxk|=vHKZVH4Cu#uU^u74xZQwCG(c3F1-> zzG<88f)++WsBQT^JTe{8YG6)ixz>0?pJ8QZ@m-AcPPo@YNZ{lx9`XKh@^up$?t3Lu zi_U)9Uq89fX#GSzOByzoaaORY_RI)72`)aK9am;Nm)8vG zk3Y>qosQKHUROlTHJPS4mV!`fWblQ(c+~;Yq_9d{!m|6~I2?ocmY<1WS?T>(*RTY& z3LVH4p7y9^>yOjTWfEER!svr`I>}N1T9CLtsE)ee?Nd=ufSRl24EWy4e0OEXWT)zHwkg61VzOqw!^u~ zU#4Re0|x>P_i<4L5Ex;t1lp438-b_7tt`KJ)d^OB{}QM1<_txV3%szL%~7vFTj?>G zX2ib0NjUU67IUbHR=Xipmx9}A32l#~MotG0CAJ-oBL~PYFl>JSxI;n3yXMnD{<>Ta zkiqd$iEJLd0UHhhE;7D(c)E%vM>OcK1?zVK>n_HI_u4G~IyqdB!2ydV534So{QT&h zc+8%Kql=>K&C}=`bL;ToyU1ES1Dpx|3RHycmrcj$nrWR``<3tP@g!4nm)b6wLUB2m zND<%C9KvtUD4ZATtc0+%O(|vBKAj;@ftE(cTr9SXXw?a#*(>b}f+i?^?WjYN?$h!R zk>Gcwr%83`L%J-FsWKZ?@Rl!vh@ov0MXg#k0dp^62Ptd-Y~|9|t!63ZSi`}@G@Jq^OxRk#1eIDQr@|`hD=h%t%SaWa*q%VpAAmaAC={ik8>$W6*Q1*-`3b zwb9tvaw)0Teer4NFihUi4DK|CHH|3Qsf&W9@ibw8IhP<`HKKjo)Ag4dd4DkXi5V`HOOD+K zRwGkcEX}x{aeGabjs`w~IeTC{8g5@lW#^0o+b8}Zm_rK>ps1ldZ!ohoTDiuIR1Brc zqt!+*i^rArCTcNT?DP#2V|KYRisf92bXxbjpUM-u-Vd7*7Oxwxjc2SjTFoxMM9$15 zbU7@beS){Pw{GVQk1wKWbu3!1o5RaC$jJ%w!E135_K=vq@Li(QGO=jRa;fQEX>n*PS#K)Hn_T3 zqvWpRkUxEX5+i~t=@ym8BIc(zLME&IpLV zAS2(DV-SRd~hL7Lj7{q!aQS5%7!^Z`z`HMW?@p$cv%-Ax;s(51J;vYgB$3#4H;! zCdLGRgZ040%0Sp7(7~Jw{n)tq979pLVla2yRz9HAXx)F+tDz5h`i%0$KSMDRw+$ko zBAdsL0ZL{#zuiyvAd{I@M&_@hVw9;UzwgySEhj)QB!Ws?D=2bm+y9JdHNU8?F=d%L zxgOjn->Z9*p1m|gikt9|Abs!Yq!ed5t$thYluA8AIo!c^yM-5KrJ)Q#0Yz z$1y(DmN?WTonhv1a`xH~D+n-0@z(!=L1`!{!QWUq>_D2H;Nb@<(?#?0_hyO%dm%Z^ z@7-GqMzKkK9_kZ&{JFA7hNkVxh8db|6YcEPCi~>$Wp`;2y?M$G9*r`2_otV% zcc&){dlDvgxK5Z*b>e>XG{W=}hOA&FIAV}tA3Tmh`{DMA95pPfrSCHtLrNtk-{am{ zmrtgTWc75JE>H7bul@6l`@LToA6|&Z%saGbsRI`U8|!kpHfLKQ-ZD;ywnmKg9nDF@ z&)4HjJZ%Rnlb5@xWL54juYrfFtMwM|BUr6J&+>DHQa|yu*L%K3zecKW;mpa(fLbQg zaP4@Ht@gHe~bC!4pazXNXaxfAp}M>RgJENM018R=+ZID@e>Zggw5nE zQRG_n)etj?NXB+ZiW$q-H zRd=wfaG=_13Y|&q!4~e%ZpAEvS1fB>YGAvld0vWFf>)kBVG_#pK($P%Mp}WG6y7yk zJ=-=7Yo*Sh^iiw>{IHl=@-k6{-!$c`CjgpbZ#hoQxlHl$=`otI!$JR;RNZ}}M z>;l60M$B+*t(?^)kG98pQEJfp#&7@l13ju*{%3|@Rl|*jlpIbWr;KKmwiN7p?TP)# z%?ZRwC`&=mVh!f6NPShM$ofI$y{b@FS+9OBqoW329ceg^>2vt&G1wjwIAfR&o!5=q z;^q#?EwB0^OA;S;&nw-nIcH5$94x*)aru=I9f=$2vt+0uy60=V(U`>r&oHvCjWC|-sKEJ9dL+Gf*>S= z&5Vz+1>=VY3{SMr9Tb$bdQOy#<|?$J^GwEzvZ6CWP7$>qZN2D|cLZwg-47S-jR27 z$CU0w`}rtq2JMH+ev1I}Kv+DI5NBtzCR81kpDO?U8nsj~df1cwSq@#)^D?UcP;F6{ z*Z7V~opgTOxBHH24(4JO2eC}DJ6rxqRj)qBH8|@;$sks+aq`n(Mf;qi#_b}F#nKW; zv-t<{8_VWi_>}t-oy{!LSBoH4dhG_pvW^`hQcTu16tyF=plciynhyA_t#D9YkLlq$j-q;Xp>@!BroGBFZX5yV^( z2RGC3j_cNmp%Zz~i9stt8bOVYFp-y6jZM(JdR_+CfNMy5;hV%WPtnd;Smzi@zv{H_ zWXu3DbNUHNbw>H{wZ+lq3Y|E#C6)@$=3w0A-6y$Kv$*Iu=}4=!b*!?AK_mkZYlSIe zr4kUeLp%HBFqBU!oRnLs@~I3d*OUiUJleq{n28+b#GucPPzPPeCNUelKR3_)5O^LB zVJXLdy&MFXy9*WdP56FH-BDFaEuY$=Rz0^nqiB9?06kDkr_M4}^H1P3U6-Gu9>NmV z!SMP7)Jgem#cI#;@_-X3jn>BDl0@RMqy$j}QG>Y=@lOz4g2>uroAi#8UtsJ0RPCYg z)=9jIczeNY0@}UBLZ?6}38sewPXjgNqKP~yLkcj4=}8wGD8f4mx={n{%qMdExG(~d zfYw*+j1YK^A(T`yVI>f1igoH>L5B<|n@*nz!rOHbczBnQJQ4PZi~nPEf9=5L4oziJ ze=uP6r@~d@_^}X3gFG@iSb9{(zAp#bJtHwoEzK= zOs{4YHSPlM>5Zb*7$4oh&j$W6(A9X{&wlVwki1VlmP8CTb>L8i9BpNTMmj+t%;b_g z^!RmqUQ76wtV1w?x2UlE`G^*pVnH|vjXL9I^8jSpx(c^8$XdksWu)?EEA@^lr;mm9 zpF+`@(&d>?BWz!Q!FEPcIap_k6;!n)WNcsWkmXqwTT?nPwY&ma>%yU$5+ZzD zdlZYa+J#{Z!`oOE78kP$GCk?wpmqOHbX~1PjGy^rIatYO)6L(gFrCaYsGkhEMK=NPt9>5YXZTFIPm$ zhu`fqXjYcez9S$XS?*0Ky#zYmJi3wWB6!D5XmuR~HWq5?Y+qGwdY$>-HM3S%t&Y4j zTE2fy=8}vhC0A(FRs>{1Tdk|%kZ;voga!ze!)EdM*e&D+1h~3(x?a@Ju@s-o7f$gs zJGqaX(kG9CK|a!pq94n;VDT`FaMmP?2%n7d$RD8c2W;179NWFu8nMMj028=c5IoV74Uv~#Oqp~MV>{cL4rbQa zg6JV^Llr;&L+M&pmFilx@#kem_gW=H+8Vf5pSSS>c@%)fMp;b zX8|`?ozKewQ4Bg%35{7(C21JC_+(x8)p=7#sQ39r^;kB@aO>bK96q#6$i9wpZN0eX-+zn#FX2UH&)VRdY@E(2- za14IT%Uj|og~|w%3f2dXOF-6ET|Yc6bDB$~Vf4PwIdp*#N6{x1W$Zr0iQLR0aMt7K zy;8bc3mzy^3H-2QQz#LP@7V#`?x;PBOR#0o``2^ai|PC$-?2VmhB zJqrbOO{5G3nC}LmhvZaOSe${8h6zJPYyijv&|$5IxY@|InVUO0YTWdGZ9ld~*5m9NCJ&=E8k$$tAamHW_N~X?$HGzzbw78!m zp9N#r`N#?|)y&pQ*T~iv^Ou@;lb2h2Rkt4AbgaFw#*}60&lXh93VSAQ07q@Yo-nu# z6^A1*21p2@{wb~MPGw3y{|Q#rTYQSf25ve#a`dvj=5_s|!GHqOC~w1 zWI_ZIBRdHgE$!eWiZU1cNIWl>^`b|6+B9c=JRm!>z73H!CcC3`Sy@(z(p#$!+{A^r zrX0g@we2bns7(Q(Mr<%M5@S9d!?Wn*iPa8e%ZHy7c4bjdO5$dXfT^C~w`LqX{P85S zMWz^bVzwIHHDLMj!t*4j=zq1LNmz7K*$#5ji6-bsA;g#E>%AVyWj=GcG~81HkfOtc z+wj9lnUW{boESsFqoFLDz6w(0!$(Lquorq(5ktr|QfzY%WFo(I&lLtoiR;zKaBn0} z6|!DY!3;&4|7hkkA;GcZU0kGd>Z_OU`f1kb59rXWR39OQcQNRBi)ATPOIc;Zyy49< zV@hy=XTwW5FvP`U0GnrqMuVbntcLPV3??ww9F1v2(z9{?5cSU*^sO7FEn(kJveLm`*SsQDyIsG+hf${&N% ziIzV7&#O)E-18Vafs@S26A4JncEJGL0b|vXQe9fv^Lu* zuDLzA96oV*<7qw34bFblo?Q8CcmzaRcf6cAm$T()@eTedXPRBzMywL!M8VD!gi2g)=EUTIDyCF^jvJtBJ1=Ep*zQkocv91qREW^opcYV+q zANER?$?X_qv&rk+H(bjT#yB{6wslpxZZo8VS!dFF{7&Xkc%!LR-$tlFK#i1?11E94 zrYssC(p!EXUDwYEPK=Q$GG&4yR`zbw11t+^9Sk}Y;vDbz6&VSnP zUC@)UFZ-g29Xd`H&Dy#D8%qMg58}ir&A&R9;W#DKdBSk^sQs0Y-hVm(jw-Rc(Q%JD z^AzI&9!kd6K7a{2n!!_@1!k zezSGQHSv|SRr`VWj6+f9+$?%6HyiPRGvCr4|9Kh4gp8Gmj^#Y;OF0}0)Rzgg&yR75 z0x&kz4Q`jwUXqMVEJ(6{Rp>3e0cs|iM1YN2{XtE=+jWgkZa}YO#4;b9kdi0NkbJCA zr;b)zuF!2#GjOhsa3U;XPxN(xxS`N+uE5D(w=8f8$V2ZrmFSotAV(gZI5_I4mqag> zMndObxXWmsx-K)3UT>w5QcyRsw$9J@28PE!LngB^jW6;;b^6Xr%Mx%*cj69Q(dVvz z()>)Zn31DKN253hIfml4!^1k5v0uczd+LXdoa<(a-QZ2!-Z(}?OV>W#>`CPV_CZRJ z!+N0gNI~Wnbs(yzD|GFKh)CgRdShjpowy)aJSp{l=A<38RikVA{07D?5?9v6ROsD+ zFb0ieM9)qWxB)l3t2T7$T_=*`sDi2I#?mCtMNJ8{Rzsg9nz&O&esUr@$V42|OhTXN zyR9`xLTA7^#|8$g9>_KvH78|LiyZr-X;f%x6eRE2j8O& zdD*l6P!al5(bl`1ywab8TUX^NC0a-?Pj}1VwiBTg7F&PX~@!3nG>L4@m>e#EL0=w7Z9 zO8;qx)Nh+LiZJZzC|&htD+)xA!VNqk_&elRog3`er*88zPHT!y(U`f2*4dmjv42r; zs#ik|<`d+3!Qj@`K6Co~1rYEY#sZ3-<7()}X@gp*N1gglllTF1*7Vy-1X6>=#4$3f z!#xDn@__*E1}oL`z{5`j${Fm{@WoxzOIg8bS>OD_-;Ktz6IBETJ+Bps6s!Z6tgSyK z4vD4MG;=Gbc^3;*5o(EI(l+A&#H8TIm6r9Gqf)YC?potx|w0+h-mo zO2Pvk#Y>|GX|Z0A$TsRzpYI2k8+@rSc(v7bla;dQVRN?HsQKvSa&pV3`4sf372(2= zYh8`unhb;r&R#~nKpSU%PHDVauMIaXY6e$gJqMPEcO#C$TCt_m;r;93@d3|!Yt`fE z4d2E@w>XeF&8KIp+q##oBpvnkpdI8%RqDh;qgP6>i=vwYZr+ag)*MS9`yAOiouO6<59@W)E$=^ zYQ)fyQ=t(9F$!fFg;pT~=$IeFd-@S-#3&<%2^=-pNu!h5?qV6kakd)KH8V8p9om@_ z(oK~Q%{`Ed?QM-&0gvO$1+V3@aBJKvvv;haiu3AmKI=T$Yc8GN8nb~Pg;9ern$C zh(?e_i5+`(segUrqOKg+l#LsB?*C!UEn$SaBBJd?xgkSW16#qSIrO+&qzfnwzZTF~dv%B{Fb-bJ*fz&&bnKsTz|TGd+G+I%1TTKZZa%a~1#KQ_!{gz64?P!FDc$zMdEi7Lw|!RcLB!;F$0LiX}JPFM%uH5GHR zFR|Wy9HI&(A2ug$O8r0}yGNE4;WfP|SjmbrHFuL~dZQL0dn&<4Ju!$Xn$Nm>bCIf+ z6?`SVwCSc`$%m_%8axF0Jg#Kripq-?eKj@Yojrf~(Vi)j&lrUe-x}j z-p7wbLk>YMgZtk6pH!NS`GHnL`RY{Zu--iU=X?32b%>UtS~A0ZdUyN}8lIdN6oDx> zl6q!&BUS2L%r5r({UhQt%; zLXTE^bn~`N6)~nK06WHftzZ~%}A-3&~r<6xe`PNOEaZw~*LeI~k zLrxdOh^&zc$GWNq9IOC)#!;bZiL_*|X6gSmpbrzQyLLOE8|}A%Et%9?cBB$k&d%M8 zsN%7$imj5O&k;<5opn&-7Avo1DFGD(hNKb`ivKd$$)eQ|h$ARpa!n!~tvqzt(Hc*P|7T1Ri8_yw) zX$nu4s&Bv`?S?jJXzWEC!33b;Bu^Z%L!Z`1XRy9Y$G8Ilo6jDxfBh_p-lOkE482F6 z;DQ+JfbIbD!}Yg7Ag#R|Eb?PxcpxqM@)il~K0SaXa9A#YC8$_V7u4%cpf|@f+ZO3# zqtKSe;nP{bJ1;83){mEm2))YaE$YWw{%j8qXvilNp2Lo|wR5YS`3g zJ`vP;;{+o>oh4o~OL(iA-D3nZ1_($T#Qm;_NGgI}WFc74xaTW<1W7_% z3D#V&3?+%^Y{HIqj&}BT22hhgAr4N6`L{g?<|sIs__L4*&sxI7%QwHcz_2FQli*a& zdn|x0#a&SA4S|-1y@q<^#oUN5a~f#%9;|1(AkgeNj+d&$>l2W z9YO3eg+u+(Ls$4+5iSXjHYAKTV)q-u8j#?rrad&;oBWDCzwX2ozP3KYNxrbSYJ^?? z73}u^)ere!60QG48ngYyg#HEo{<|6SyG|)B3kTERdPp{AS{4R|Z}%G;0~;;dcWuva zJs&+IJ1r9>2L7(AI`{sZu_rs-_$mru}JbWUl|W`10@CvER7!xBik9pPiY3mYtpBo1Og* z68av3?+E1?{O!>EEADSFSHQ-`_Pdehe^Ax^9rB-eTPD{3Qs4E@ z5Mrg$AB8@8_=^t|%{anITux1soE#T0WOz~~iP(ajD|y6`8A{0>=)KydxF@%_%~6n) zDw0AmdgdT_;ELwH)3KGSk0H1UxbJU-9at(;;1TrJK||&_h$wsLBX8gWqF2}$DNTK6 zeOQD=>2(KIB%1M+){C^7K26yc%AL4VQya$7v>0p~?QiFMY3E9hXf^lOIgA7c77;5Z zwv#+H$5vLT_$HGIdDeU$Q4W|`ZY}#T2Fdc7*EX{5?@UX#m1D5xnd1 z0w{mTL}deTPe2bvD>Y^dHPg!~*b>m%r741}APkg$V?A489{y3>EpgvZ5|bh8*5?Ft z^0*;Isdh6eEj(0jwL!xu(gTKLp%YAWHBmsWR^X0&4KrBqzHxC3FJo{bYD<}<;E+J_ z^AP-;S1*(;4pv9MdAQ`(cE|)a8MxS~A5ZV!_~`#jbLoG{HUIbL(tkWx@b5$`BRea@-wXABAX+E1q#V~< z5IWCP<>IU>8xRB8x-HA%glsemHA#b)DK5;F6B+1Up4Pm4k461K9%`Dk3U{CZ;Xj<& zUM0pvySu<3eEedq!L`jgKkRS1pg1;TBGIhvWYQjhZ1_HxR<@?TUVQE@-U7`!eLVlT zy@NqFRhnmI(S1HLPvItCtje4nor7Qm@c6u+D^|EG&d4sXNrwk(J5i+0MwDH|^nqleBi)Xjr5z*3as9#y z2a_YDz(nYS4S~j`CH$4#mrd1>7`p4|Kog*IVsjYDE^P%OfKNYp$0lUr?y~6qYyG{! zk~>?lGbh1@zRFu>sZ--eQ8Q}M_}VE0gooBU(yBn$7q>n`aN+>7@MN0v;?d2mdk419 z2O@$QBH}eC8@4u~qyeGtoVN}A8hFjzyRHq^$xVa)M1qk(KQm%S$P>tjs%S9t>K@ap z3)g!`UtC|AC9*k%$XWYOV-FNMQ5%sWU2c4+B~ppEM!yRXJlIM%#+YEJ+c)3FNiHLJ z5vjl+NT}F3^AXSXzLLw(c52Ms>-=30@#fkxYb#43Ym{C6GAyI?qX0j@{^H;Xp(2{G z2AAi%mMVAk&9&Tk+Rszj^jVHbq;}*>@{qbpJ4~u!L9g|~gRJDSA9)X%5q(fyi4SH+ z&rhMrEU);X_7@y75EYaO(Ps#0keI*V!Th#+@X5wGQW2*#;y=X!;Dd5Wlu;|X?ZN9n zM_dj~f3T&H|J+y1+oIb`az|6coRg%3Dm{FZEnN0kd4U`=dhS4|tU6b!WJwJPpMIb7QU@Q&mX%2+Je7Ro$8y0^ zW*NEDjOJe2+<|YbgvF@|`D=^CYxLZ(CtUKJw8yrWrS`g?k9^gHH;UUB;UU+}!9GWu zGm4#~or4#px73eJyw~@KERFlTmN?U;pDVs1HwQM8YyjB>Y+oB=gti7L!(dZ}1{_6N zT=S#}yiF81N>n9798au@12=+Cq;D0Og2hW9B|zovgjCdpAG5wGCv@c!k^H%OnWaw#GQ&8s+8W1Mh@+S~6*BGLRh;PC}Qt!|LI@y>Gp z0O$!3P)}>(%^~OQ*59+H{&*J7RFSbEa#3yVyT&DEe`+8%@9LjT;tao+D4BSyl&)p* z$TFQs%8Dbs<7|xmg%ps>Zzl5NKN11P<&&R~nu^_s3KxsY8fu)Z35{qw`6o9ogV+}l z`%oi`@_p|6Ils2X``a>>y6h*Z3TD^z)_YQ@p296xk2gz6pI=9hVUYpLgzLD}Fr(zg zvkj2a9JJj6exRh&G0gb=*uFEhqHN$!A%Q2W#YwN^Ep)x4j}F+W9W+I}uo@RFu3F3$ zm2AJQ&dDRJ&MZ{d9vhpj!%fUB8A!s*UaCHY+EZ}@CosaiVd^bcw0MNn&jh;5hqBC$ zAMuX}v|>%@P&Rj&J#aOciWBtNVx+ye)Aa89@SZxxqKp|+TdA&8)Ic%oJcF%9X#*`G ztHtK>j$UBFj*VG_$g9bBC|<@bF93~}1KEaew(93CE8S9Rf8Z^n8rt&I0ot{&0Rt%v zUJQe`!U$kff}aBY)E6s}%@V}kTd%ML6$A*fw8jxBs1iXSq7i}s1XObs@GZ@tD%x=5RWF#j(U|kR;>jHPOx=G z?8E!>t)8Bh%KR$pFJ~!=Zx?r|SKTOgoh0?^)&uN*zd~ z)S1S~?IS;S;OzyPuhN22k`0s;;0LY7dwloX1Wnp^FYO300g`~^So#?sH{xM;Qmy_M zfbd4%5U*sG7+bvx6mv`HAX;K5n1Urw%-o6)zr{vlZ@nWXtO%EZDb{6J9AGdL_2$U7 zx$;w-Dz%!0g15#NW(h?{;@}(cj?|@KJP48k|5=r2~E9}Y6an{e?4>?LD6q7c>ufs_v!r!5aSen6o!@vCo)stT%Pul+tM|VZakPBp@IN#dfvip`(!g%Rgp>4%DwP^vfCsZ3 zSA`<&B-tG@d<>xgV@?cO&&{YGnf5dhRgev$ajn_u&b8^@$vY%g{&@oU;bJ@p3a+)GdCIuPzF| zpQ*_W6Csimfn#EhGyxa2lLawF0c8fXq@S95wK5!sKy;?s)huLKKj4YkwROcJ05smW z0ER4ln|L-xuwIq4A&$GXqDhU)Q?*oYG#@wxRsZD0!v^w$b>FkqF!2?J&KBxXr7`$` z0CR4)TG4ytQIWQj+9HHafnKad1oR=%s!?H&t-JPhnU67&}mlqc`%#e5B$obUy5GWsMo(IXF+f{vO= z^cF4x2}EPCM-2(pinQZs>HM~GE|xXv0@?h4f+_i#xWdBz;0{>P*;Cr9>zrPXqm;Q4`4u-!=Ec`1e^gr(^FR({!utpxLs?FBwjNK^~ zI;Gkrj6(i6y)7?GYEuR-|maA@vgx;(D)>k7=Z*2E?Q&Gwc@WDfQ z4^;_8S3Kwa@^F6gx$<85xO%$0OQu@+_401#{1kthaC+&}`8xEGm}UY>k@qy}LI6oZ z)Bfk{;grwTlcKQe!`Ahyy4+_oA3`3o5||6{GkCAOY47MpIdZBHx9e%Iyl<}&dnk3s znT=PuS^K<*X51Pr3XeB#Lq)qJ4c8!>4`+fs4@!r^NK!lvA%Ns2m4a&Y%F<2?OA!igQ@Iw4u zP?leRu#53m-GBta#PA`wi6$esE{seYwmyiL_9ZB2;$lZz13`#%B6`v#djmb#&%&+9 zWE>JBdPRzqy%D~0fAW6P~ zOL1=@!0^j1$;#?R8T|d5vx24gB4KJJCC_>{?L_&fm~%i9>Wrld#~kO-4V3E#t6!>+ zc_IA{z(G%3%{o~denY6{D>=j-3J##gIdiLFe}UeHyl0(TVx~&3(!7OrZioJ|Uyi zksxO_yW%vChtjgVmFo2%SNmxhgBkpRas?LMeiI6>L1q*W+gkRpTgGDMN;?b{7bGsh zvs62#e6=UDXU}z)I!Z#j90P@`lE8H)Qj?M(#Cevw9QP}lXswaF&an}5=6&7%;OEf| z2=3laPOj-9BWGU;;pN=8EmA0q&I~(ul!g7RSAYA>nc5uw$;g?6eV?nIjbw%IUJTP= zMB|Nem4Q4~EYLA*-7rG9?H!5EzL@@Y(L+&T^-MAs zw+Mm41_AD-@v|vRdlM`E$N$ZX?E>g>6Cr2ov~ z6yPTNr6TR}UVYD;H;duRgx~JL&P0-JI`(su4(7KMIc+8vhDZYxkZKfCl9Y=(wfRKZ zAJ6q`KJgKbuHht+dCITofM6jz6MuF`w76>rMps>zE-%bkZ9%dLQZn@o{e!3uy)ZV3({)@NK(Wf zODdld^ilO>dl49k6vVHD9Nr}&%!R?pUG}USs)7(;Rba@KdhqmcHkSdedUupx5f8Ri z+^P-B&gn(yi1BmSvpb8EYPH(1=kt79lC(65{D3^= zb2m7ih1Q7iHwsYNhODUyCLxJBs)ol3_X8drVOk&rZHEo0Wp`CAuvV#FXT1U7HgYCQQ>7 zIfZqy$Mzr-^JGB5OE7o_s1)#P5O9+1fuf|(3Xq%P*Iq+2rw1{2`cePc5(du#ZN;)1 zSsfmhRcG6%XPZ>$hH2rI%kgrJJHSEYpmPJ@*+=8guAsy{<%!QoE^X1dbHwz7-XhCO z3kv3|d0`k%(nLrM(+@$`!1h-4SXxuvN;_HLRX8x`MoBN)t^RE`|;NG*lC4(SC^q+NHrJ_l|iPSv~qQ= zlD&l0lBDj0@|S>k6QLfx-0-vmSxwc}%i3lx{LM zO-bE6dF2?2xIGO~zLG*+Tn`*c`PIeZ8HLi5rXh~Ip9=_(hNrA>_Cc=tmoBMD8X8hK zp`pC;r7D(?N0Uo7i_U=%mO~*3U?<`KQ`=WSMfJS>ONcb00@5oT0^2l7cO$L1zyd41 zEG3}`C?TTKf+8)A0fK^*N~eM#0wRqPidcyJ?=HAXygz^MIq%_{%e=e!o)f?L#y+z0OIyGj^i?l^b4L^# zeoU!!@loJPR_>~LZ_&bdAFc7jt*|v>?g9Jjr&{2rY@%1b5=$CE=4rtAj^g+)C!70@5N*WHXbT*c`uBhI|l{ox=I z%76U6Eq{1j%tae&!T!ZNA%(~Cg(75sKm+a-);+5b^l6J{Kgv{2VP}z+B&>%VdT{WJ zSJ2?Nzx5I-D`P&MxjYa#8Wfi9BO1mttmOUBs|NMsDoY|V2U<3AT5$@@ybq*Da z(PH^KkE6pM@*X%OUFko0zt>~`+VdrZ5{*M))wS85KkE+UyPSPIYe90ty2&fS*zIxt z$Qr$SboLM0YsSV_%W7m(P%B9oRkp@;pDv*W6iA@RXDU}aGSV8cKjzGIL!$fSyJsaL zA}0PPr@;vo%k8ciI)Qd^p_#D(N`YRmAU}IQSi5>pho}x%*;?XBtZ`<$SuJCxb)1+J zO}5)$lzUkGVawOgWEwHcKAvn>Zt_xNspl#cvT4W_+j|{d%tYn5L>8NU&%C!ALT4Wd zKnmukg&teM3mUZc_^i^|yNk3&oVexf6 zL+%L3EWI`Ne4Ldg_c_d6pV_d1!0V#fU!|xuSkjOIYvLR-)}NYx8tI*@GQLLUlz4wq zoK&2ZSHM)z@-sksp;RQ#i` ztj?pur;6UbePlwvZhrsp0_BsI$=PPD(!9opbMA|vBGszaV}mCoNMvqxi;KJlJ?tZ!n-a52lH)Yy>+pE)RJ$-2;Fm|M$LS%5GnQwV zto`}o2OS@G4ER!wL?Fqm5#5+EZ>3sdp#<9#M2?i}a2ia=aVFOK{hqWRRaT4azwa>teMgLTS?2$`fj@FbFKQTR5pI+GNI~E+1cg`p(S^LR+i^CP0 znZlK&i^>sXKiy{!35kFO6i1SR*xX`Vs!Iy4aJ49g%O&?Kx0P@@SXo1Ae{f|Ia!C zaG28nc1?=Vj((Q#)98J))9u;+prvnrG?UDDf)`gVvXWg5u{P-^&wUTfp*eY z4aUL>2R?+?s>?FOJjz34aejE3YxHs9gGRAwE%)^^_CI|K-=+5p^;BfIj;wos`I<6! z>dtfR9+|xM&-_nvw%8xRME} zmu~F$Ek63tKCugC$3t+3YFm#~H)Fc5#*pz$+!Ay?wj%S%poLl?8O6+3QPbeE=Tb}Y zwvwz-F2CpBfNR&6P(pG!C_1{=Rogr1do)8+Epa+9a)Qw!yUa z6OH#Z-z^|zWR#QMBwrL#0}sXcAcrFMAlG|PwmFIi+`%pB8I+QKb+otBd9_2xfPF6+-%XrffTdnr_3S_te#I+=RsI-324R3`!J0?w+^4SN+SY^p!m>Gxz!} z$)(v3DlkbX=Filb4Be{JF*tRennXcNlC?Z?UGcEL%GezVCN0v6&lUp(28f9kavG(} zq}8(2reB|Z`_{pIEGIRRObVrRIYozL=n7xRQq}6m!V6_&0zS621&6x(DHko>X|SDf z!Wu`i`lx>v#ZAP!9S`8qO>Dk2zAQKt)f_>3l7=KkN`nw5ei{`bV{qZKP zm-aHgcB?g6EL@f?3t+NSzz>;l+Jc??!S)S?sl& z3~ZeHNrE*$ckzF&<-TgG`w00|>WbP+cSwCopu4aCp8dusZgbKqEzd|A)fnvcm7lt~ z;qI@n%u)j82QJ*yhKogHo4Y;WXFDfit9|_y|1FH2(KzUn8nXeHameAD&uz){R1GwO zLR!h-l=^o%doSNm5qkEEGrsLzCTEQsC56uCpBmC8*i%=%SRAQVB0G!*=wvMQye3Ro zeB4FAHSFnn;u3Thi^$4MPG0A$Z_XLPrrk`k;nPx#yVfBpoAqG)OrP{cS!2$I_`C0t zSOQEx52-RZ()KUz6PfoYQ)lJ&d=^&G_9cI(t3^-b<3opLtM7>YI!)EZou2yNik~Kl194 z$xLO*?+%d$hrdR1w6tB;QGFrLs`QRsh?jD1K%=W{oH@`~bkI^HLs3C6y(1$nI=FU3 zTK(h2gHKW(TAHy|D5wU4P`&MzhO_2{Nv;X+Tik3%pB9YhDmK7L6eZ)XT4Kj!Esek;vIi&WfY~Ryc%WIGiS%c5_&r7ZtpIR2V*5leo^WOYYZ0r6vynZNp zpP&b1yStba!3G zhu%JveKGVAl?9uhl0Y}M#QVsSw})q2MbqEsRTf~3f|KR<HvL-LRPlix8dLL@{685AsIypBOh5e35m}txhX<{=hgz4o~*tp-T zD~a0sD%@Xo1Z(M($&Q>w#Q~ekS8{y9f{yr_v#K>-e?>Dh_ux}`@IY3}M5wU-%L&y$ zq@$ov-<5uq^~vJKvH2H14>(%K8IN^kX|;tvI1G%MX-otfJVV0XEqzx-wY0Hu58HUG z^P^8Hs6JXi1Bz)|$h`$U?JxY@$e{YsmnDs|LYi>f%cSzW;GBC^Z?X?wSyAX}9e7DC zR^Xx#-!*>v)%3$R9}epK;nJU3v*eYJPT6iIXnua)| zn<%-tMm&b@+SJGa>eSMxlLa-E2+PCkms^Lu!elQ5hx7Z1zY`9eU~jj&>3JkG@U;BN zHV~hf223l!n72$2^Fdg}DoUh?4l*ZM?-DC=J$>--3EZ-w$&tHK&bZ5CG(5{Es{C8O z$@d(JA3K*aeFJ`+#Jd1{bHCFA8En10){&c`Yv1Nw_?GUd){DHhe4F(;>+s%SS&5}| z#uWNlZlA21vs~vsP`oMaUhu2qeQIu%5NUR2x;R^?Z<0jNyFIb}pa=u_a7QcIqp9p) zCEaUw*uq|jKufcE0WFhu=KanLt$TM1tLE!la3k%*9_bSZ(iU%Q$Ox0@<9v&f$UJeC zYwY3vq-8H1r6*LXk35d!jd~SBw>DDPD7bIR?>KU1`rvU-q4aLoWXb+~bZ6JIp8a|I zj4Feb7@nCV&gPDjW}m!!`_hN8uonH0zY0_xZRxA^_L4I-yL-zQzUo%RtC_toMaD|R$Gc1UNiC^|%-y^1W>$Y(0k^=v{vSvlG zN6H{vAwh>-%_l%OL$~Axm09<3%Ua>V0O?V_gVenWISrMj z;Kr8KN$b}Y`zLRO-qg%R&3XuZfabawr93*>d$*J_5u0-GkTTZBKV!|pKi6|C?2gDv zYt*G%ETs~qSHFq*OxIHnY7Kwe9~S=86n5G8*WO~4%MW%Lu?f=b-FTi1`|LXzk z)(s{%2dofjDEPm5@nzVm!|e@n|C2>yp_1kC?A-5yhC0!Qgu1!TioUgacu62UASy)U z$>;gD1eGWlhgQ7L%>`x((|#=u`b(qjlFC@sXTzh#9^A#uMXs(^K|iV=uinpJpZoPK z@5g6!Q=vpUm#^=!Wvz(0U#PF+YkJ>IFW#@fgq7&Dk-u6ZdS4%$SQd6+*d-?D&XKk<3Www^tMVs+c zP3tu(=bA!FP^3zNa?GbPE;%u0(^C8jcyK0+v@p4^GuJydgUt3&oF6quuQ}&X5Jx;4 z#cI!J_?36hdsj}snE)}q3d)ju{^zVO*7gNz^-;3cIVX0z^B+{34D&U79~wTCUFBfvkh<@j8QUrKR5_BE zV+Tg%xfE=;6cj#lUsG7lH4-xxTbg|6akjxkG{WEg`P(;5ds!xVgu0w2vZB?Guo&d@ zPz>8g!s-1c=tpgM>k9a|R7iVo_tj^3A;#FlOD`XK%iwU`pKc8N`cdeWu}j>?)|e4G zwhZ0uQRyyZ)jv<38hmW)*VoCCUCoEhGFiAv9YJ52EHw*>O{5S8zW3=wW!{j{Jazme zxjp5976B%OK`I{jVaUSESoX+$<5wALxhN3I{tZt3@O|3uxz(?JIq;6J%#(}-kqP97 zCQ~0AsXdeNmG(Hg^Yn#%2E6)K&ulBarxYW{@-;4Bt+~(`(a-fGyMkn_(F^5u}m)7zP`pS`8#V9|b zG{YcatvGln@`%rbRQeUtX#OmkSlOw&8c_ZwUNHgj{G){kmX*o>|DUT8EmDRw)Z;1>ESZMgIvMl;_#4FFDA;U*lS%L zv`J&(?~>8QZPvpaHyOHe*oq4#59oh#H!PHf^+ZQ_4?OeItF90TyU{^mOcE7P-5*b- zc-LG6eU9hB0>5?6Yi1MXSEt_^7Qgd)W2<)JI?Uo>($hQft&~qJl;E(4j|_%4gB)s^k01}t< zXw88mRLtRgs>_q(pU!@mQdxhA&i46ImRps*qOUc1eYhr*waNR~F=2SE0PWO(Vf4lF zOivUJCVMfp?}Jne=|p8ZGYKEL&XosC^dkGB)14qzB)!#&l!^yXAzz;yYMSK8FJINa zZN03*q1mF=cCAKQu7K##5UI`ucWrDS1O+ajj@xy=mF=IqiZqp@e|K zpJkXwaa5gdl)O?7tWg7lC#BBcqkJ@ub&8@a_OzI*k4TMNl0A3-t`4Ajf$9c|7}4cy zpKSe-_M2y^N+>*aD=hAFn`@6<9+cA_Q*RL;W#B`E&MFO1J)Na|O=g|V)Obj;{5Im^ zH+5%7m(@k=2j^zlL;*9JOZH-&7b}dzFM2-V=<__q>w4a+Jz^q+0{W%M%Btpuzy9-m zOZ^LxQ{XZWdyn^ALRCV7BrQ|Oc*>Y4=}MoMx#96i%JpH-Ye=kmrJ8Ym2@HHjLyo6e zRrgjd-o6><$22A;?;Jlt=0$Fu+Rs0#&UyFy$fyh7+b8lzRn@hHS#=wK(xaR%+zSrR z?Arj5r8Re?TEdnMsrPBau;Y-(~v64r>?kxsm(8Z88`=BQl^xA7E`&ed{my_*`_3Abw(K`6IGtg!a&|=b*X`WZk0=vzn`dk44KQ!LYI~~aA8-1_ zLxUM5&V>qs`AOg*{l>2#HTg`1R-TGF`c52q8BR)Pr1*3aQ%3JLQ#s5cX}_-?n$uWP zSSvoHpGS?RsQfi!)q8C2^{J09TA>;p|Ld^@zRAvH7+mVVdP95IT08Dd1>=*&(%ZiL+RlqgesS%}o<>aESg*d31`gXC zq+p@Qc-6${J{aF|TvjS*nqPYIQ+wytJt4t?z^k=t1=q%E9hpwa6so*hIk`NW^mzSE z{`lU$2S&INQQ37y@pIpjeAh?TmTNomY!>a8-{*DtatG5&vS*|wy?R_*t&`P+38x7? z6bm$3L;7Eey=X+)I?9^#vh!z?U*zxDR1QeR)IpK_wcvQDl?;Af9Bcp zZY`|ytuP16v&9%Oijz$j`AY4>jz3)ec_IA%)35gBJ{8%V-k6^iWUK4a>skUW2kL@7 zaOfJWy8SV#rqO2%f(_q1<&J-Rt2uJ|<&`>?4xvn}$#+F*O-VJ!&g9IHqmw@HPqd|? z3-7G2n&!PRBkOt^^*m;c@wJw97u)A#zGc?S1JmgvS5K8U8c&mXb=}ZezdikJrfaXC z1GLS0kKB9VPO^ndv4=(ct|l(kNjZ&8QP#vs7WmJc{potslJK~o$2RbaqyR9zsD)h#+(k4IT zQuL-AF+HbCsa53kATPE`DAorGdDiSiwLe3wlO#+3+ch`Wdo4+O9w{F9_)LfF`8yvU zYB`$gFy-*6mDZ33+5NhVbGNi|n3~?zsaYI57Rul}e&t-sC_R_4_LbKRnUr@f9Jpsq zQx3MU?3c%go#!;rTRP|bQ`=KnmfzCf^i71C_n9|RSN3_1hd>|FoHx7K5FtxS`ZDd=1N;xnZk|F!CEEfWP8HQKQWyVeRxHdMw|eFu{r-R(}Soz@D8OdQK#sc8XEFvKBeB5qfA*Yx-qaJ77DZLaJztDK$K zn;o88D2716jW4e@Tl0(D&3ktxDjhbFr^51@$yKARLbado(d?H0LLV#mwLLBR^w!_)Tvad%P*rqxWI+?Ls)A8B?bhlTbFak#g(p^0Eo+XQ8o0 zE;0^&Ck41oX5f`lQn#L~m6ivtr5z9@w@4N_oP9JD9{U0V>c_oku0ONirDi6;xcOZK z(tRH(^TA$YRm@@AyyW}blujJe{+7#SzGQGEn(T+6r^4Th@u@A-IzoJpSghX~7`LR) zoVE;V)YDQe;X&Ot$>yX2Ltk=*y;6Abx7(WM7_A{KYxJF<1>87ri=L43Gs#DEydL47kUPY&5 zRv1;gcMX($RAR=w*Lv~HZoGF!V^)YvPx)$x?TkW?X`>9;VV3vg6=y|1Sr$rM?`TW- ziQ~E(5zF$f>$0%4aM8>A$tx7b4R&!S4-G0%c4%h0hZqjW3z!LqP}?8>j*XU`Ic$

T=P$@Cjv%VSKJW8#p?U9x#sq!Zr0ZMW+Aa=!isooR%+-JKji z)Tfm3{)LSAC^_zW>r)pCFQhQ*723u$M@5w#@3TDo_#MVtQCK55-mb&pZNWZ$m#9a< z{qLyeB@g=cJ02A^=_yQv2|J(7P|E2}yY}Q3?(9Oro=Zm$=jG}wWG7$us6N%ERZO!M zTftc<0`eo z-fQ1J{b`T8l4>0%$Gt$447WUzy=Ob@lavbvnZz)WFAI`flJ54lzlbC&n@;1h*Qil3 z70iEz_2)_ndg(Nvd#|oY5;_=m$ugtmL554Lx@u_W0hFZF!}UB>XITO7K$`IAd39*o z;Xbi5-`Qqz9Rc3hb|~(N(vAL;G(P zLEjrGa%wF;aWtyu#-io;6k*xb>QN;S?34k6mpz-Ia~j>DYkQO4Hoth$OvyNV`UXD} z{Q_>OyMp2SO5(!M%g3W{f>ud&M`gTy^dc9ovbnV=T_?}=trEKS?4Zcgi^A9@bTtS>*(!Q4!7em4PT|&n*~{^ z`FrYT(2tTb;nedj>xO~{70?K*8G{0Oo^O=4yVE@z4mO*jx|YDmb6jX0E^UE3)hi1mKIhVu-EA!Su_jyXe(9m0xkhWtFG$~2;YNG;rMGw9+e|#MN{&PQ?>4=HY`3JP=U0m_L&A@JfRDC(x zYL#VSlLjyMcnCGRJ~%ZKa=9y2XD`#WGM+pf-ClT{Aq!=F6TFs`n4P_Qj z?bS{WxK_Gcluv5ouSdRoh#1D2D?}*XG#O)XPP2aKq)hUJ->=(}`2=l~s)AnJ_=5999io=UCF=H)J}?bbWBGC~|H9A< zk0`tJj-m3$0;6`a)tIG^z&=R1{Bkpoe^kPe=?Ouz1w5S&BMN*tOy$$eJr$Iynrp9r z%<9Yrqe_CQ!~^|?=*7{gDFSU4VrD&4U93XUoUcj+ev)IH7Q;SdQ#H&nT)N8<@58Zj z?4Hu(*e-+8t*=!6pAJfiM|b?!FL=VXe#7`X;Uxtod?5L+7d*=?wcQB`uhP?LQtx$L zZ%AA-iOww!{nDLEGFrf8$ucWU@n}$cJt&{$87sZ&Je%tN7Ew&|Si7XY5tQ-QaEr%B zHSD5Q*R9$QzXn^z!tM1u+>7CD++!@KMCxY4;ozac|mpL$)d!~?t8V1)7+Ov2VayvPEX%c+*|E!G{!g*qoSny)uEC* z&!(cbjqLu7;mfhvoQqmI_h&!9h&|m*=EXbceeQckZ5i&ySC0i34VZlTD6mrX?dIW` z;LC;QvdI@YA6mxml}L%N8sId0EulmsN8eTx>qW=bMj1*U?uI>srayYe_E+ES$5PN@qI==ZVm{DoDY;v0}22TEms!t3@*z^#!O-1eFVnqVB856=W)5RxJtkquL+`}Rm z5tH)Df3UUgE3X7?%~Mj->~P9lzK5*>96<`oZLA+rH#&O2{l`Cy8c|34I8nFy0v}l9 z+n-=)@XC3ew#-WvKQ=qxj=Nx(!SbQw@I3zo6mzOz1J>x zk0%7pBwGZMoDaEwMPyW6{)G&NTvAEQI3I>P;B?}JfXkKO$-M=9XH{tBX>!7EV&l)$ z!)&`O%XR9D#!B`ws;A$5bKEtiP{{xkZ(BA`5N8rk`nS#fLAoM}sO zPTGME)^{`$Yhp12%uDAv?d#i6sWB~aWEIYsmt)hAsfAkmx z7H-*O89t1wP+jU&p^iHV&*pD`*06{|>CP~;9h{3xCP@)=5b4-6y7!E5_h*CRl=H?@ z&1tcdS;G>_L22FxVF|MFgC&CCeayX4W3!jg1{F^x%6ZV%qcqn!EoR^K)hgddIN$fp zjxl0g*U>zyU~eLr%^6KX=|ok;^pliJ2srb+->$(X^O|lViCZB|GI>v!#i=C?qv01? zPiCRZEomShyGKRPi#ehGE!77axC_L|J<5(p=fy|Mr@03TQI_#uxx$H-XzULBzWgN9 zPP7VYIVZ-*9{w;YR(R~QO8#k^9x~FXOwyzM()Efr%otnJ?%jG{k))8UXJ!71 zQa00S?>U@eSSfGxSK6OfDtO+s8cmW%;#~RD7p~FqB+;SnJ&kyH(&4!jHBY1ohj|Tu zc?M%Rw)F&Utx4lL^ZE<)M}ID^u?$Ve*9YIwH4YysP`qeHc_Fd8Lm0i5m@I0Pa&JMx zh0)cC*1wWGvS9AP$Gv+fyvU)q`2_6FG?Q6U%q}SGJEwaD=OWl(2`Rh;xp1Upr9e+a zjOP)AT&UrkNKU^0k2Au!?DDW;p%(`Xv*Vqkb@PME5B|_-GAkb1PyQe*h>^|*3jQK~ zB~4Uwx-jm2ADlj3Z*?M)Vy{OH_;!_cA*Ui%u{BJqw;rZdnWSP@K>Ap9zi3j#UZ=$3 zbL?;$v8Z-^f#Inf%$-+Z*A86(n_254yt9-e61op1rrcT4npmk|VV)pe{3T(~8_eK3 zo!u>)gKey@Y)Mk?|MuQOnN-rMr6wiLm6n*%3X2M~ZOUbsg#_e<$yL!-_#G_^{M~r$0 z{BQn>5@ye-!ro?GF>6c8ZybSuweP?*T-fdQv_x;>*#V61xh?LJ?8wfL7EDPWA0+ za}Iq)PpUF2X?GQ~*!_$uIYEYg7spV)gpM(+P&7|>{jwa=N-Q3K{w2oFc5V1>rV-PR zB(20d`X0qO%ZlIbP?X=h*PA336s4tk_R2fM#~+V_I%cH!_kWtX`{J^9U@#qh7F%V(50T5yP01#m}01)9j zZV=%kjxAsQ!~T3b4t#xqcC*KKNDce*A<5sRf8G!KtCX;{z#o|A`nG4#b~q5>#)KUQ z3{W^68tVok+>}tF>W5P|#-VU%5RACRfwH@cJJ#3(Wd{@zH!#3&>j09I1D+T7@I(y^ zg8W{U!~cYUAirDVe*&8<{JsjH`wJl9c7FhRVI6HjRuY=Z%J`Gh>_LP^gdG&@kqAdD z%Kz_+n+Lc3b+=s?`GEZ-@H){05e_IbLb*AjK~?}yd^LwuA z$eDT`t&e_+GBt(2JNhwOmm<?fGLzZ!w7qN`IHY#IEvy+^_jWhv*lnMvlL6VD`N5?d_3Ny#qG;*-Mt6 z3a*FI*-9^pD040Ffv#PsTTW}A6N=0BB@dJA8sS+MY#J{f5bkpk>Koq2Q(E^{H~-gT zqfmz9rN%4j=~T$px$K-kl9@nKc7d{!B>nD}2Dmgo>>_N~)~U(n7A7#_{tboA_F&4r{D_I7neVf}^i_W?F% z!GWwcSWm*-!V)A27MDUIA#jkS6hs^h#S_dH!XtF~hYfz?BrqfXhMT= zjuZ#Oz(_zQTVZTnLiitGZ0u75$bkT3hrWoD#0`BBgG|v_dkhe))V$s7a2R*De?de_0UPgtcWM~l{SKS@gKS2u#_e;W{qQdPqc z-1B#QmDo@>(MdMdO*nIP^Jz3Nj!qzBv=5r_7{6WTFYp^yIW;Wq-j&Q;vKZ2`70MY&+?H)N>e?ufAiDS12o3ky_QTpB951IyNTjDFkS zHY`ME-jE|vZbWE+s!zCiU;&G?!vTYijnR(@7C227@Dg`7uYZ7pOG3nvNJ%N6pRG=f z@A#jRBI<1e-A=*5WI(zYFE4=XKt}jsnGVJkfCc;lZ198^8Vgb+xW~Ux!VpMt2oxp- zbg&iWuCW15l;H*}q6~>bgUf(4-MqXV958km{DxSjfcXAaE#NsS7%vZR9Qt3#pm4A_ zLK0x-ZO8}?utR>^q85TEunnL@+#6nkAO3v&b%s}DG=gNwT_foi<)+-QXMMPUI8 z_4mS|UH>x6U2y^a3q|bkUqYAv#6{#of>i%Vkq8s;8BI5oJ=)V7ZpB&L})ltYC9_;c8w<6B}R-U8_0GF@GpN+^}$=F3JQn%2P6axE-ne(;lYSq zW5;$xM3dVPsm;<2Q5^-;G z2_dt-`3yRM*Z!w~yPFiDU`cT)Y2*&*_-=O!k;r=+L_!QBzX9NhMA_XQ4Knlw;w>y&d3t zK%_>a?f+#|Fo4xz2n1eXTP3wStrI1+0e~neA^<5F&_>`>b;XYxfng#LX*O)i?(Yb* zn>9fJCP%^~cg&&))VM=7+xQdM%k^)q{b7d<{zMXy6Zlh-Xl$GON!WU3^C>jl9Ne+4 z1ZD0%OWh4TL`q6r8t?}|CtC%Hue<~NAGY5hukCE5iDytnH#=bRho6gX3ewdB0A-88 zGwMI=A3ynn;L{!3(d^3S+tCoIYD3FJ(fyW>7(k^eXb&JMjCQm02PUcZ7~Efg2oJNJ zNq0}WAa|wqZFnTNQae6KZTKe<55S}*_?>bNh#AkYF%iI6HCdO6c2Na2q`lVmv;_u;GG|M7r8=K_Yo`6mh>*#`kqLE8zH(8GU#v7t$#h&DC(mmB~pBIJOuTXF)s*%BNA1@^SY zJJD9_-j&j~>yT*98-R$cx~W5=PB(N&bj3{_5|%kOu^XX*&%TD?P_VC_R*M|0XFci=)urW3;XxPk8fP{W$9VPJjDB*vY5)AMH@Gg-^a#u3n zj)o|d4G|JWwkem*slEvs>k1OuHt+uzFnpAO?h>vg@qO;JE~1z=kZc!|jypgO8#sVD zgT$7&_cs!PP5gI+F1ahA|1q)+AVgf7BEcKBi#I;X{iT@QdPO3Eyn@t@aUJ3Qe;$8h zMO5D#2P6d0ghkN}>;02F->_byt#4Q_1pN2vpcFppY`-V|8$unFE!qW7YsSDT1L6NT zV9n^Sl|U){;Nq{A8_N{N?k*@d6vzN-0A!i%oCr&SL~);Zh+t~ z1Uw56*Z@ue0y;rBge!ogfXo80_@N>L1(Lh~-9VsFh$IYQNvNaiZvQ`C{u}64R{#B; z7Gz^1z6~h?>kBBrgHePB^|r^3r z<60gN#$KMs4516w^-xATVKmNS(Z*->Ozh4&+ezE=98-|_~c*baUAI&>F>w6P^>Gp&j(=Ks{3VSoP=E^n6c|ubLC)Sz28XxF4N)q(03QnD zMc{(LKaUJxr9hW{V)keUl(!3xN8!IVTseu2+bC@OLAbHRpUwa!%50joiMzXt!rzuH zC$asi98jREEAx9GrKzIe?`n?4>HEW_&q$m_nqZ`Kbz!Dm&yd($wmN8IK+Z>%MK*S~G@OAz!!`}%n zPH%uUHe{@Xa{Mi91+?2Xfe|j^yZF-v5CUKUGJ1I4@lpVK*jljpoJK&9C9D=GyP&+h z6oAzPcL3{#0JmMkx7g4E8qW|4c=iwjBgLQ)6DU*$A}Iqyh=Rc~VDMiW*{Dfq2@ng$ z!T-N$`B%-2$NbCVHVp)DV&E?#4=DWM5#V{`d9VOW?6RILg&!mR#jXTGQU(|bSOUe9 z6hTyf9g$&*LHnYyK-_Ua1BYke&%F5k-iQhY3yd)F3?QKc#jmLXlm^`3H{*fuDaFl1 zz;D|B(-_Fv0Pog-L4+`2gnvn3qxJ8o1Nsy5bN~|o388`5_80g10f4B1=5T5-@gE3S z_5xmpaiH5MgG<8kX=(gFkQ=c~3g6?FGGI*?3WTz)We^}7Y%haDrGat6)_TA^Xh$Dl zU;w+V9vlk8zt6L!EgS)cZ0{E?2?dtex7GuG;Uo5zwm^|IFbddOCJn>ClC!l80>+P= zx0Ollcs8&!0v~p_){`dW61J2CTEdok zFfa^1@!nDfkw)TE_gl(d)2Ha?epCf=bHMaMG0K*a6F#|)tUFu2Vr?=bskj5W1w6zSFZf(bmfB>V( z9ra*%(%se;0o`r~fVtrFIos;(^i>4l3_I!p1K1sXK%w}w-PZd73${DUfV|s|dXjho z-qu!Xhwmd`VCZ)LMZk9Q9|8uj?DqS?;LV1Q&1H6ct&7-P<&@lgs0j7IM6 zI1nNH5?(;UPZvRixz5H<6_AzC|1?Gu2K~>M2uTWHpoYZ}Vj_@>2E(cO`BnAR{vQ~M BV(9 MAX_EVIDENCE_URL_LEN { // Redundant check + return Err(error!(ErrorCode::InputTooLong)); +} +``` + +*Impact:* Potential input validation bypass + +*Recommendation:* Remove redundant checks and rely on the utility function + +== H-2: Unprotected State Transitions + +*File:* `offers.rs:152-166`, `disputes.rs:167-191` + +*Description:* State transitions lack atomic guarantees and could leave accounts in inconsistent states if partially executed. + +*Impact:* Inconsistent program state, potential fund lockup + +*Recommendation:* Implement atomic state transitions with rollback mechanisms + +== H-3: Missing Rate Limiting on User Actions + +*File:* Multiple instruction files + +*Description:* Users can spam the system with evidence submissions, dispute openings, and other actions without rate limiting. + +*Impact:* System DoS, increased computational costs + +*Recommendation:* Implement per-user rate limiting with timestamp tracking + +== H-4: Insufficient Vote Validation in Disputes + +*File:* `disputes.rs:245-320` + +*Description:* While PDA-based duplicate prevention exists, the additional vote counting logic has edge cases: + +```rust +if vote_count >= 3 { + return Err(error!(ErrorCode::AlreadyVoted)); +} +``` + +*Impact:* Potential vote manipulation or dispute resolution bypass + +*Recommendation:* Simplify vote validation logic and rely primarily on PDA constraints + += Medium Severity Findings + +== M-1: Integer Overflow Risks in Reward System + +*File:* `rewards.rs:232-242` + +*Description:* While checked arithmetic is used, some calculations could still overflow with extreme values: + +```rust +user_rewards.total_earned = user_rewards.total_earned + .checked_add(reward_amount) + .ok_or(P2PExchangeError::MathOverflow)?; +``` + +*Recommendation:* Add bounds checking before arithmetic operations + +== M-2: Inadequate Error Handling + +*File:* Multiple files + +*Description:* Error messages provide insufficient context for debugging and monitoring. + +*Recommendation:* Enhance error reporting with contextual information + +== M-3: Missing Event Data + +*File:* `state.rs:161-340` + +*Description:* Events lack sufficient data for proper off-chain monitoring and analysis. + +*Recommendation:* Add more comprehensive event data + +== M-4: Insufficient Access Control Granularity + +*File:* Various instruction files + +*Description:* Some operations lack fine-grained access controls. + +*Recommendation:* Implement role-based access control + +== M-5: Potential Timing Attacks + +*File:* `rewards.rs:346-349` + +*Description:* Rate limiting based on timestamps could be susceptible to timing manipulation. + +*Recommendation:* Use block-based rate limiting instead of timestamp-based + +== M-6: Unsafe Account Validation + +*File:* Multiple files using `/// CHECK:` comments + +*Description:* Several accounts are marked as unchecked, relying only on comments for safety. + +*Recommendation:* Add explicit validation where possible + += Low Severity Findings + +== L-1: Code Quality Issues + +*File:* Multiple files + +*Description:* Clippy warnings indicate code quality issues including: +- Missing error documentation +- Large error variants +- Potential performance improvements + +*Recommendation:* Address clippy warnings systematically + +== L-2: Unused Code Paths + +*File:* `offers.rs:266` + +*Description:* Some variables are declared but not fully utilized. + +*Recommendation:* Remove unused code or add proper usage + +== L-3: Magic Numbers + +*File:* `rewards.rs:352-355` + +*Description:* Hard-coded constants without clear justification. + +*Recommendation:* Move constants to configuration or document rationale + +== L-4: Inconsistent Naming + +*File:* Various files + +*Description:* Some naming conventions are inconsistent across the codebase. + +*Recommendation:* Standardize naming conventions + +== L-5: Incomplete Documentation + +*File:* Various instruction functions + +*Description:* Some functions lack comprehensive documentation. + +*Recommendation:* Add complete function documentation + +== L-6: Potential Gas Optimization + +*File:* Multiple files + +*Description:* Some operations could be optimized for lower compute costs. + +*Recommendation:* Optimize frequently called functions + +== L-7: Hardcoded Seeds + +*File:* `state.rs` and instruction files + +*Description:* PDA seeds are hardcoded strings without versioning. + +*Recommendation:* Consider versioned seed management + +== L-8: Event Emission Consistency + +*File:* Multiple instruction files + +*Description:* Event emission patterns are inconsistent across functions. + +*Recommendation:* Standardize event emission patterns + += Informational Findings + +== I-1: Anchor Version Compatibility + +*File:* `Cargo.toml` + +*Description:* Using Anchor 0.28.0 which may have known issues. + +*Recommendation:* Evaluate upgrade to latest stable version + +== I-2: Dependency Audit + +*Description:* Third-party dependencies should be regularly audited. + +*Recommendation:* Implement dependency scanning in CI/CD + +== I-3: Test Coverage + +*Description:* Limited visible test coverage for complex scenarios. + +*Recommendation:* Expand test suite coverage + +== I-4: Documentation Gaps + +*Description:* High-level architecture documentation could be improved. + +*Recommendation:* Add comprehensive architecture documentation + +== I-5: Monitoring and Alerting + +*Description:* Limited monitoring capabilities for production deployment. + +*Recommendation:* Implement comprehensive monitoring system + += Architecture Analysis + +== Positive Security Features + +1. *PDA-based Access Control:* Proper use of Program Derived Addresses for access control +2. *Input Validation:* Centralized validation utilities with length constraints +3. *Event Emission:* Comprehensive event system for monitoring +4. *Escrow Architecture:* Secure escrow implementation using PDAs +5. *Error Handling:* Structured error system with meaningful codes + +== Architectural Concerns + +1. *Centralized Admin Control:* Single point of failure with admin authority +2. *Complex State Management:* Multiple interdependent state transitions +3. *Resource Consumption:* Potential for high compute unit usage +4. *Scalability Limitations:* Fixed juror count and evidence limits + += Recommendations + +== Immediate Actions (Critical/High) + +1. *Fix SOL drainage vulnerability* in execute_verdict function +2. *Implement multi-signature admin* control +3. *Remove redundant validation* logic +4. *Add atomic state transition* guarantees +5. *Implement rate limiting* for user actions +6. *Simplify vote validation* logic + +== Medium Term (Medium Severity) + +1. *Enhance error reporting* with better context +2. *Improve event data* completeness +3. *Add comprehensive bounds checking* +4. *Implement role-based access control* +5. *Use block-based rate limiting* +6. *Add explicit account validation* + +== Long Term (Low/Informational) + +1. *Address code quality issues* systematically +2. *Optimize gas usage* in frequently called functions +3. *Improve documentation* coverage +4. *Expand test suite* +5. *Implement monitoring system* +6. *Regular dependency audits* + += Conclusion + +The Solana P2P Exchange program demonstrates a solid understanding of Solana program architecture and security best practices. However, critical vulnerabilities in the dispute resolution system and centralized admin control pose significant risks. + +The most pressing concerns are: +1. Potential fund drainage in verdict execution +2. Excessive admin privileges without safeguards +3. Complex validation logic with redundancies +4. Missing rate limiting protections + +Addressing the critical and high-severity findings is essential before production deployment. The medium and low-severity issues should be prioritized in the development roadmap to ensure long-term security and maintainability. + +With proper remediation, this program has the foundation to be a secure and effective P2P trading platform on Solana. + +--- + +*End of Report* + +*Total Issues Identified: 25* +*Estimated Remediation Time: 3-4 weeks* +*Re-audit Recommended: After critical fixes implementation* \ No newline at end of file diff --git a/audit_summary.md b/audit_summary.md new file mode 100644 index 0000000..d5c471f --- /dev/null +++ b/audit_summary.md @@ -0,0 +1,83 @@ +# Solana P2P Exchange Security Audit Summary + +## Overview +This audit analyzed the Rust-based Solana P2P Exchange program, identifying 25 security issues across various severity levels. + +## Code Metrics +- Total Rust source files: 9 +- Total lines of code: ~2,200 (excluding tests and generated code) +- Main components: Offers, Disputes, Rewards, Admin, Reputation systems +- No unsafe blocks detected +- 4 instances of `.unwrap()` usage (for PDA bump retrieval) + +## Critical Findings (2) +1. **SOL Drainage Risk**: Execute verdict function lacks proper balance validation +2. **Admin Centralization**: Single admin key controls critical operations + +## High Severity (4) +1. **Double Validation Bug**: Redundant input validation could be bypassed +2. **State Transition Issues**: Non-atomic state changes risk inconsistency +3. **Missing Rate Limiting**: Users can spam system operations +4. **Vote Validation Edge Cases**: Complex vote counting logic has potential flaws + +## Medium Severity (6) +- Integer overflow risks in reward calculations +- Inadequate error handling and context +- Missing comprehensive event data +- Insufficient access control granularity +- Timing attack vulnerabilities in rate limiting +- Unsafe account validation patterns + +## Low Severity (8) +- Code quality issues (Clippy warnings) +- Unused code paths +- Magic numbers and hardcoded constants +- Inconsistent naming conventions +- Incomplete documentation +- Potential gas optimizations +- Hardcoded PDA seeds +- Event emission inconsistencies + +## Informational (5) +- Anchor version compatibility +- Dependency audit needs +- Limited test coverage +- Documentation gaps +- Monitoring and alerting needs + +## Key Recommendations +1. **Immediate**: Fix critical SOL drainage and implement multi-sig admin +2. **Short-term**: Address high-severity validation and state management issues +3. **Medium-term**: Improve error handling, events, and access controls +4. **Long-term**: Code quality improvements and comprehensive testing + +## Files Analyzed +- `src/lib.rs` - 204 lines - Main program entry point +- `src/state.rs` - 339 lines - Account structures and events +- `src/instructions/disputes.rs` - 406 lines - Dispute resolution logic +- `src/instructions/offers.rs` - 356 lines - P2P trading logic +- `src/instructions/rewards.rs` - 383 lines - Token reward system +- `src/instructions/reputation.rs` - 92 lines - User reputation system +- `src/instructions/admin.rs` - 26 lines - Admin operations +- `src/errors.rs` - 41 lines - Error definitions +- `src/utils.rs` - 54 lines - Input validation utilities + +## Security Strengths +- Proper PDA usage for access control +- Comprehensive input validation framework +- Event-driven architecture for monitoring +- Structured error handling +- No unsafe code blocks + +## Risk Assessment +**Overall Risk Level**: HIGH +- Critical fund loss vulnerabilities present +- Centralized admin control risks +- Complex state management issues +- Production deployment not recommended without fixes + +## Next Steps +1. Address critical and high-severity findings +2. Implement comprehensive test suite +3. Security re-audit after fixes +4. Gradual deployment with monitoring \ No newline at end of file