# CashOps sample functional review

Reviewed 2026-09-08. This is our own local verifier, not a customer engagement.
Scope: one boundary condition in the receipt verification function. No live chain queries, wallet actions, or third-party systems were involved.

## Finding: empty receipt accepted at zero minimum

**Priority:** High if the result unlocks a paid resource. Actual impact depends on whether callers can supply a zero minimum.

A successful transaction receipt with an empty log list returns `verified: true` when `minimum_base_units=0`. The observed amount is zero. A caller treating that flag as proof of payment could grant access without evidence of a token transfer.

## Reproduce

Download [sample-reproduction.py](sample-reproduction.py), inspect it, then run:

```sh
python3 sample-reproduction.py
```

Expected demonstration output:

```text
minimum=0, verified=True, received=0
minimum=1, verified=False, received=0
Reproduced: the zero-minimum case passes without a transfer.
```

The script includes a frozen copy of the reviewed function and two local fixtures. It uses only the Python standard library and performs no network requests.

## Why it happens

The function initializes the received amount to zero. With no matching transfers, it remains zero. The comparison `total >= minimum_base_units` passes when both are zero. Transaction success and sufficient block depth satisfy the other predicates.

## Suggested correction

For a paid-transfer contract, require a strictly positive integer minimum inside the verification function, and retain a separate requirement for valid matching transfer evidence. Validate direct function inputs as well as CLI inputs. If free access is supported, return a separate free-access decision rather than presenting it as verified payment.

Regression coverage should include empty logs, a zero-value transfer, a wrong recipient, a wrong token, an underpayment, a failed receipt and an exact valid payment. These two demonstration cases do not cover all of those conditions.

## Limits

This report demonstrates one local behavior. It does not establish live exploitation, a complete audit, transaction finality, RPC trustworthiness, or the correctness of other payment paths. A confirmation count alone should not be described as finalized settlement.

Source snapshot SHA-256: `dffa7dfe6b572ad4888c871933b8de3e291cf0e035a97a4922ce558350123f6e`.

Permission granted to use, copy and modify this public report and reproduction for any purpose. The paid review offer applies to a separate, agreed endpoint review: https://cashops-audit.pages.dev/.