This commit introduces a comprehensive security audit report detailing findings from the audit conducted on August 4, 2026. The report highlights one Critical and one High severity finding related to DEX aggregator swaps and ARC-60 domain binding vulnerabilities, along with additional Medium and Low severity findings. Recommendations for addressing these issues are included, along with a summary of the audit scope, methodology, and dependency review.

pushbytess and pushints only discovered a stack overflow after pushing
all of their constants, when the generic post-op depth check ran.
Report the same "stack overflow" error up front, before pre-sizing the
stack or pushing anything, so these ops fail at the same point as the
rest of their immediate validation instead of doing needless work
first.

parseByteImmArgs had an off-by-one that rejected an empty final byte
constant ending exactly at the end of the program, so a program ending
in `pushbytess ""` failed with "const bytes list ran past end of
program" even though the assembler happily emits that encoding.

Fix the bounds check, and reproduce the old behavior for programs run
under protocols before v13 with rejectTrailingEmptyByteImm, which can
simply be deleted once v13 is in effect. Since the bug only caused
errors, and programs are checked when placed on chain, no stored
program depends on it.

Starting at v13, bytecblock and pushbytess check their byte constant
immediates against maxStringSize (4096 bytes) at Check and Eval time,
so byte constants get the same limit and error reporting as AVM byte
values everywhere else.

The assembler reports oversized constants for all versions, since such
programs cannot run once v13 is in effect.

Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.13.5 to 3.14.3.
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/aiohttp/compare/v3.13.5...v3.14.3)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.13.2 to 3.14.3.
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/aiohttp/compare/v3.13.2...v3.14.3)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>