From 0570b1397dfe21d811933497faecd812fbddcc73 Mon Sep 17 00:00:00 2001
From: kingofclubstroy <100493790+kingofclubstroyDev@users.noreply.github.com>
Date: Thu, 2 Apr 2026 14:45:27 -0700
Subject: [PATCH 1/2] sapience-2

---
 client/library/library/audits/sapience-2.html | 48 +++++++++++++++++++
 .../collections/public/sapience-2-issues.html |  0
 2 files changed, 48 insertions(+)
 create mode 100644 client/library/library/audits/sapience-2.html
 create mode 100644 content/collections/public/sapience-2-issues.html

diff --git a/client/library/library/audits/sapience-2.html b/client/library/library/audits/sapience-2.html
new file mode 100644
index 00000000..0dc9dae9
--- /dev/null
+++ b/client/library/library/audits/sapience-2.html
@@ -0,0 +1,48 @@
+<page
+  clientName="Sapience"
+  reportDate="April 2, 2026"
+  auditTitle="Sapience A-2"
+  auditVersion="1.0.0"
+  repoUrl="https://github.com/sapiencexyz/sapience"
+  repoCommitHash="cfbaaa8045706ed96a604cb4484b55f11809553b"
+  finalCommitHash="162a139e60cbdcb52761865a45723e7fe3ae5db1"
+  customRepoInfo
+  layout="/library/audits/_layout.html"
+>
+
+<content-for name="schedule">
+  The security audit was performed by the Macro security team from March 26 to March 29, 2026.
+</content-for>
+
+<content-for name="spec">
+  <ul>
+    <li>Discussions on Discord with the {{page.clientName}} team.</li>
+    <li>Technical documentation available in the repository.</li>
+  </ul>
+</content-for>
+
+
+<content-for name="repo-info">
+    <ul>
+      <li>
+        <b>Repository:</b>
+        <a href="{{page.repoUrl}}" target="_blank">
+          {{page.repoUrl.split('/').slice(-1)[0]}}
+        </a>
+      </li>
+      <li class="break-words break-all">
+        Commit Hash <b>(initial)</b>:
+        <code>cfbaaa8045706ed96a604cb4484b55f11809553b</code>
+      </li>
+    </ul>
+  </content-for>
+
+
+  <content-for name="source-code">
+
+    <p>We audited the following contracts with <b>f2b6bd9231ae9915f9ba88f6bef02e7a914e6288</b> commit hash:</p>
+    <template type="file-hashes">
+      1bec137aef2a1f962c40ae22f12e754e4cb958cf131a3e4db024662569acbcc9  packages/protocol/src/SecondaryMarketEscrow.sol
+      25b8666dc38cba5f9c6f5077e31c07aa07f76a12ae11fa8291f421238f56ff25  packages/protocol/src/interfaces/ISecondaryMarketEscrow.sol
+    </template>
+  </content-for>
diff --git a/content/collections/public/sapience-2-issues.html b/content/collections/public/sapience-2-issues.html
new file mode 100644
index 00000000..e69de29b

From 06db706d0dcc93cb0ad5baf7d50c3e44a087edba Mon Sep 17 00:00:00 2001
From: kingofclubstroy <100493790+kingofclubstroyDev@users.noreply.github.com>
Date: Thu, 2 Apr 2026 15:05:48 -0700
Subject: [PATCH 2/2] fix

---
 .../collections/public/sapience-2-issues.html | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/content/collections/public/sapience-2-issues.html b/content/collections/public/sapience-2-issues.html
index e69de29b..863a126e 100644
--- a/content/collections/public/sapience-2-issues.html
+++ b/content/collections/public/sapience-2-issues.html
@@ -0,0 +1,38 @@
+<item>
+    <field name="topic">Verification</field>
+    <field name="impact">medium</field>
+    <field name="chance">low</field>
+    <field name="status">fixed</field>
+    <field name="commit">TODO</field>
+    <field name="content">
+      ## [L-1] Add ability to view `tradeHash` to verify parameters being signed
+  
+      Users can view their trade approval hash via [`getTradeApprovalHash()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L185-L198) to verify the data hash being to be signed by the user. This requires inputting a `tradeHash` which contains a hash of important trade data including the token and collateral types, amount and price. Allowing users to be able to input this data and generate the trade hash used in the trade approval hash would help verify what they are actually signing, since a malicious hash could result in negative outcomes for the user.
+  
+      **Remediations to Consider**
+  
+      Add the ability to generate the trade hash with its input parameters to more easily verify what exactly is being signed.
+    </field>
+  </item>
+  
+  <item>
+    <field name="topic">Duplicate code</field>
+    <field name="impact">low</field>
+    <field name="status">fixed</field>
+    <field name="commit">TODO</field>
+    <field name="content">
+      ## [Q-1] Duplicate code used to generate `TradeApprovalHash`
+  
+       --- | --- |
+      | **Impact** | low |
+  
+      The trade approval hash which is signed and verified in trades is generated in the public view function [`getTradeApprovalHash()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L185-L198), as well as independently in both [`_isTradeApprovalValid()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L262-L282) and [`_isTradeApprovalValidWithEIP1271Fallback()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L284-L315). Although the result is the same valid hash, and no branch calculates it multiple times, it is best practice to reduce duplicate code where possible to prevent issues creeping up if changes are made in the future.
+  
+      **Remediations to Consider**
+  
+      Use [`getTradeApprovalHash()`](https://github.com/sapiencexyz/sapience/blob/cfbaaa8045706ed96a604cb4484b55f11809553b/packages/protocol/src/SecondaryMarketEscrow.sol#L185-L198) wherever the approval hash is required to prevent duplicate code.
+  
+      ---
+    </field>
+  </item>
+  
\ No newline at end of file