security(mainnet): commission an independent security audit of the mainnet eERC deployment

[akash-mondal]

Tracker: #154

Context

README.md and docs/MAINNET_GO_NO_GO.md repeatedly state the mainnet deployment is a fresh, unaudited deploy holding real Circle USDC/EURC. The eERC contracts are vendored from ava-labs/EncryptedERC v0.0.4 plus Benzo peripherals (PrivateGiftEscrow, BenzoCCTPRouter, the handle/invoice registries). No third-party audit has been performed.

Scope

• Define the audit surface: vendored eERC (converter / registrar / five verifiers / BabyJubJub), Benzo peripherals, the CCTP onramp path, and the Groth16 circuits + verifiers.
• Draw the vendored-vs-Benzo boundary (what upstream Ava Labs coverage already exists vs. Benzo-original code) — see contracts/contracts/eerc/VENDOR.md.
• Scope, budget, and shortlist auditors; prepare the code-freeze commit + docs handoff (README, go/no-go, ceremony transcript).
• Define a findings-triage + public disclosure/remediation policy.

Acceptance criteria

• A written audit scope + auditor shortlist + rough budget/timeline.
• A frozen commit hash + artifact bundle (contracts, circuits, deployment manifest) ready to hand an auditor.
• A findings-triage + remediation process defined.

Dependencies

• Best sequenced after the Ownable admin-custody transfer and the open-ceremony issue, so the audited artifact reflects the hardened setup.
• Relates to VENDOR.md (upstream attribution / Ecosystem License) and the license-compliance checklist issue.