[Audit M-05] Failed slashed-fund routing is final and has no retry path

[hmzakhalid]

Finding

Severity: Medium

Confirmed against baseline commit d4277510d. If routing slashed funds to the configured destination failed, the baseline finalized accounting without a recoverable retry path.

Full audit report

Required remediation

Retain failed routing obligations as token-aware claimable state and allow safe retry without double settlement.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit d2f99125b55b9cb5aec891c85f931aa991b7d00b in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit 068547b (M-05): failed slash routing reserves the liability and is permissionlessly retryable.

[hmzakhalid]

Confirmed fixed by retryable routing in e1c6d3d. Dead legacy slash routes were removed in a72a5be.

[hmzakhalid]

Final remediation in PR #1727: e1c6d3d makes slash routing durable and retryable, and a72a5be removes the unused legacy slash routes.