OpenZeppelin completed a two-phase audit of Flashbots' Flashtestations protocol, an on-chain system for TEE verification and Intel DCAP attestation. The audit covered smart contracts (FlashtestationRegistry, BlockBuilderPolicy) and deployment scripts. A total of 24 issues were found: 2 medium, 6 low, and 16 notes. No critical or high-severity issues were identified. The medium-severity findings included a fee incompatibility with the attestation contract that could prevent TEE registration and a version check bypass in block builder proof verification. Both were resolved. Low-severity issues involved missing zero-address checks, lack of deadline protection for EIP-712 signatures, and missing nonce signature invalidation; most were resolved or partially addressed. The system aims to enhance transparency, enforce priority ordering, and mitigate MEV on Unichain.

Key facts

• Two medium-severity issues found: fee incompatibility and version check bypass.
• No critical or high-severity vulnerabilities were discovered.
• Audit covered two phases with 24 total issues, 20 resolved.
• System uses Intel DCAP attestation for TEE verification on Unichain.
• Missing deadline protection and zero-address checks were low-severity items.