SMART CONTRACT SECURITY ASSESSMENT

Abstract

This document serves as the formal security assessment and mathematical verification report of the Kernax ERC-3643 smart contracts. Operating under the guidelines of the International Financial Services Centres Authority (IFSCA) FinTech Regulatory Sandbox, the Kernax protocol enables the fractionalization of physical commodities bundled with retired, high-grade carbon offsets. CertiK has conducted a thorough code review, static analysis, and mathematical verification of the target contract suite.

1. Executive Summary

Kernax Asset Architecture engaged CertiK to conduct a rigorous, end-to-end security assessment of their core asset tokenization smart contracts. The target of this audit is the implementation of the ERC-3643 (Token for Regulated Exchanges / TREX) standard, which enforces on-chain compliance, KYC whitelisting, and a unique physical redemption protocol known as "Burn-to-Wear".

The audit was conducted between April 15, 2026, and May 02, 2026. The methodology included:

• Automated static analysis and symbolic execution.
• Manual line-by-line code review by tier-1 protocol engineers.
• Mathematical and logical verification of the dual-collateral valuation formulas and token burn states.

1.1 Audit Scope

The following smart contract source files were analyzed during the assessment:

2. System Architecture & Mathematical Model

The Kernax HDG Protocol introduces a unique mechanism where each digital token represents fractional ownership of an unheated gemstone (e.g., Asset KX-882, a 3.208ct Royal Blue Sapphire) and a bundle of retired Scope 3 carbon offsets.

2.1 Dual-Collateral Valuation Formula

The total economic valuation of the tokenized asset V_totalis derived from the linear combination of the gemstone's spot market value V_rock and the prevailing market price of the retired carbon offset allowances V_green:

• V_rock is the spot price of the gemstone fraction, updated continuously via decentralized Oracle networks (DONs).
• C is the constant retired carbon credit volume (tonnes of CO₂ equivalent) permanently bound to the gemstone block (e.g., 45 tCO₂e for KX-882).
• P_carbon represents the current trading price of EU ETS/CBAM compliant carbon certificates.

2.2 Physical Redemption ("Burn-to-Wear") Logic

The smart contract guarantees that the physical gemstone cannot be extracted from the independent, bankruptcy-remote Heritage Gemstone Preservation Trust unless the circulating token supply of that specific asset is reduced to zero. Mathematically, the boundary condition is defined as:

This is enforced in the redeemPhysical() function of the smart contract, requiring the caller to burn 100% of the circulating fractions associated with the target gem:

Our mathematical verification proved that the system is immune to fractional front-running or locked-state deadlock.

3. Vulnerability Classification & Matrix

During our static analysis and manual code review, no critical or major issues were discovered. The four (4) informational observations identified during initial assessment have been fully acknowledged and resolved by the Kernax engineering group.

3.1 Detailed Review of Standard Attack Vectors

• Reentrancy Protection:Deployed contracts utilize OpenZeppelin's trusted ReentrancyGuard library. All state changes occur before external transfers, strictly conforming to the Checks-Effects-Interactions (CEI) paradigm.
• Integer Overflow/Underflow: Deployed under Solidity compiler version 0.8.20, which native includes arithmetic checks. No unsafe unchecked blocks were discovered.
• Identity Whitelisting: Transfer functions verify KYC credentials of both sender and receiver wallets by querying the decentralized IdentityRegistry contract on the Polygon mainnet, successfully neutralizing the threat of sanctioned or non-KYC transactions.