Add September 2026 audit reports

[hieronx]

Three reports for docs/audits/.

File	Auditor	Scope	Date
2026-09-Sherlock.pdf	Sherlock (lead 0x52)	v3.3.0, collaborative audit	26–28 Sep 2026
2026-09-burraSec.pdf	Burra Security (fuzious, Taridoku, Alex Filippov)	September diffs across src/**	30 Sep 2026
2026-09-FV.pdf	AlexZoid, Certora Prover 8.19.2	Formal verification of src/core	30 Sep 2026

Sherlock and the formal verification run both finish on 74e16461c, which is the v3.3.0 tag, so they describe the released code. BurraSec reviewed the diffs leading up to it.

Findings

Sherlock, two low.

• L-1, future timestamps can permanently DoS normal price updates — resolved, fix confirmed. A price written with a computedAt in the future would block every later update, since the setter only accepts a non-decreasing timestamp. SpokeRegistry now rejects future timestamps outright.
• L-2, SimplePriceManager cannot recover from issuance-delta overflow — acknowledged, not fixed.

BurraSec, one medium and one low, both in hub asset registration and both now fixed.

• Medium, OpsGuardian can permanently poison Hub asset registrations
• Low, an asset can be permanently bound to 0 decimals by registering it before its decimals are set

HubRegistry.registerAsset now accepts a repeat registration when it agrees with the decimals already recorded, so a registration made too early can be corrected rather than being permanent.

Formal verification continues 2026-08-FV.pdf against the newer commit, widening the scene set from the hub side to the spoke and messaging sides: SnapshotQueue, Escrow, EscrowFactory and MessageDispatcher, plus the linked-core scenes.

[hieronx]

Superseded by the v3.3 mirror sync, which carries these same three files. Closing so everything reaching public main goes through the one channel, as in #831, #832 and #838.