Testing Methodology

Testing covers individual functions, series lifecycles and accounting properties. The tables distinguish recorded suites from coverage targets; they do not certify the current deployment or replace an external contract review.

Toolchain

fact

Test Layers

Status reflects the repository at the time these pages were written and is updated as suites land.

Unit Conventions

• Tests use the mocks in src/mocks: MockUSDG (6 decimals), MockStockToken (18 decimals, uiMultiplier and balanceOfUI exposed, raw balances unchanged), MockAggregatorV3 (8 decimals, arbitrary round history, negative and stale answers), MockFeeSink.
• Time is advanced with vm.warp to exact official close timestamps; no test relies on “now”.
• Every test that moves value asserts balances of all parties before and after, and asserts the escrow identity via getSeries and accounting views.
• Events are asserted with vm.expectEmit including indexed parameters.

Fuzz Properties

fact Present in test/fuzz: matching and requiredPrefund bounds, coupon index conservation across transfers, physical settlement within one wei and quoteToStock sum bound, civil-date round trips, day-of-week sequencing, DST rule, official-close and holiday/early-close logic, mulDivUp, bps bounds, WAD round trips, clamp, deviation symmetry, oracle walk-back, walk limit, answer validation, backup deviation and fallback, force timing, ExpMath decay bounds and monotonicity, router floor and current price bounds, previewSell rounding, sell accounting and sync split.

target Target property list:

• Coupon discovery: floor ≤ couponBps ≤ cap for all refBps, S, D.
• Matching: N ≤ min(D, S, notionalCap, prefundCapacity) and stockMatched × s0 / 1e8 ≥ N (rounded up).
• Physical settlement: redeem(units) delivers units × 1e12 × 1e8 / s0 wei within one wei, and the sum over all holders never exceeds stockMatched.
• Coupon index: sum of accrued over all holders never exceeds couponPool.
• Oracle: observe never returns a round with updatedAt > closeTs or < closeTs − maxPreCloseLag, and returns the same round whenever it is called after the grace (reference model in the fuzz suite; 10,000 differential vectors against the Python model).
• Calendar: isOfficialClose(officialCloseOf(d)) == true for every trading day; DST transitions match the pinned dates.
• ExpMath: halfLifeDecayWad(t, h) within 1e-9 relative error of a reference for t/h ∈ [0, 64]; equals 0.5e18 at t = h.
• Treasury: previewRedeem monotone in noteAmount; floor non-decreasing after any redemption.
• sNOTE: share price non-decreasing across any sequence of deposit, notify, warp, request, redeem.

Coverage

forge coverage --report lcov in CI; threshold enforced at 95% for src/core, src/oracle, src/token, src/libraries. Mocks and interfaces are excluded.

Static Analysis

See Static analysis.

Formal Verification

Properties proved for all inputs by symbolic execution, the compiler’s model checker and integer proofs, with the open ones listed, are in Formal verification.

Reviews and Audits

Internal security review completed by the build team (reports under audit/ in the repository; full test run at the reviewed commit: 77 suites, 900 passed, 0 failed, 1 skipped). The external front-end review is complete and published; the structured-note contract review is in progress, not complete. See Audits.