From f03c14eba86f5f957d198df9f096bc2130120683 Mon Sep 17 00:00:00 2001
From: Gilbert <gilbertbgarza@gmail.com>
Date: Wed, 15 Jul 2026 13:37:45 -0500
Subject: [PATCH] Veda-92

---
 client/library/library/audits/veda-92.html    | 34 +++++++++++++++++++
 .../collections/public/veda-92-issues.html    | 12 +++++++
 2 files changed, 46 insertions(+)
 create mode 100644 client/library/library/audits/veda-92.html
 create mode 100644 content/collections/public/veda-92-issues.html

diff --git a/client/library/library/audits/veda-92.html b/client/library/library/audits/veda-92.html
new file mode 100644
index 00000000..e035f69a
--- /dev/null
+++ b/client/library/library/audits/veda-92.html
@@ -0,0 +1,34 @@
+<page
+  clientName="Veda Labs"
+  reportDate="July 15th, 2026"
+  auditTitle="Veda A-92"
+  auditVersion="1.0.0"
+  repoUrl="https://github.com/Veda-Labs/boring-vault"
+  layout="/library/audits/_layout.html"
+  customRepoInfo
+>
+
+<content-for name="schedule">
+  The audit was performed by the Macro security team on July 15th, 2026.
+</content-for>
+
+<content-for name="spec">
+    <ul>
+      <li>Discussions with the {{page.clientName}} team.</li>
+      <li>Available documentation in the repository.</li>
+    </ul>
+  </content-for>
+
+  <content-for name="repo-info">
+    <ul>
+
+      <li class="break-words break-all">
+        <b>AccountantWithRateProviders constructor bound checks (from <a href="https://github.com/Veda-Labs/boring-vault/pull/748">PR 748</a>)</b> </br>
+        Commit Hash: <code>ee1bbf1b4e1a223d9d624dc8eb709d3b421a2ecf</code>
+        <template type="file-hashes">
+            532c78d6e6cd6dc27335067009dab8b63f7ac027640bd372e02a3cbc7773ba8a  src/base/Roles/AccountantWithRateProviders.sol
+        </template>
+      </li>
+    </ul>
+  </content-for>
+</page>
diff --git a/content/collections/public/veda-92-issues.html b/content/collections/public/veda-92-issues.html
new file mode 100644
index 00000000..77989da5
--- /dev/null
+++ b/content/collections/public/veda-92-issues.html
@@ -0,0 +1,12 @@
+<item>
+  <field name="topic">Scoped Impact</field>
+  <field name="content">
+    ## [I-1] Constructor bound checks apply only to newly deployed accountants
+
+    [PR 748](https://github.com/Veda-Labs/boring-vault/pull/748) adds five input-validation guards to the `AccountantWithRateProviders` constructor so that an accountant can no longer be *deployed* with parameters its own setters would reject.
+
+    Previously, the five setters (`updateUpper`, `updatePlatformFee`, etc.) enforced these bounds, but the constructor, as written, would write those same values straight into `accountantState` unchecked. In theory, an accountant could have been deployed in a state that normal operation would never reach.
+
+    This change closes that gap by creating consistent checks across both the setters *and* the constructor. No onchain behavior is affected with this change.
+  </field>
+</item>