docs: add unaudited-code security warning to README

[AztecBot]

Why

The contracts in this repo have not had an external security review, and nothing in the README says so. Anyone landing on the repo (or the npm package) can reasonably read "comprehensive collection of reusable, standardized contracts" as production-ready. Until an audit happens, the unaudited status should be stated prominently and unambiguously.

What

• Adds an ⚠️ Security Status: Unaudited section immediately below the intro, using the conventional wording for unaudited smart-contract releases: no external review / audit / formal verification, may contain bugs or vulnerabilities leading to irrecoverable loss of funds, provided "AS IS" without warranties, use at your own risk, obtain your own independent review. Rendered as a GitHub [!WARNING] callout so it stands out.
• Adds the section to the Table of Contents.
• Adds a short License section pointing at the existing LICENSE (MIT, © 2024 Wonderland) — the README did not mention the licence at all, and the disclaimer's "AS IS, without warranties" language leans on it. Happy to drop this hunk if you'd rather keep the PR to the warning alone.

No code or test changes.

Notes

• The warning says it will be updated if and when an audit is completed, so there is a clear trigger to revisit it.
• The per-contract READMEs under src/*/README.md are untouched — say the word if you want the notice mirrored there too.
• Context: #engineering-fnd thread. A ClaudeBox audit group for this repo is on the security backlog separately.

---

Created by claudebox · group: slackbot · requested by Michael Connor · Slack thread

[github-actions]

Benchmark Comparison

CPU	Cores	RAM	Arch
AMD EPYC 7763 64-Core Processor	4	16 GiB	x64

Contract: escrow

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	(partial) withdraw	486,936	486,936		3,744	3,744		587,800	587,800		14,061	13,766	-295 (-2.1%)
⚪	withdraw	331,210	331,210		832	832		499,700	499,700		11,310	11,173	-137 (-1.2%)
⚪	withdraw_nft	378,517	378,517		1,440	1,440		527,400	527,400		12,466	12,224	-242 (-1.9%)

Contract: logic

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	get_escrow	390,359	390,359		192	192		456,000	456,000		12,637	12,431	-206 (-1.6%)
⚪	secret_key_to_public_keys	387,718	387,718		192	192		456,000	456,000		12,614	12,354	-260 (-2.1%)
⚪	share_escrow	303,989	303,989		1,952	1,952		520,700	520,700		11,142	10,917	-225 (-2.0%)

Contract: multitoken

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	260,810	260,810		832	832		499,700	499,700		10,137	10,022	-115 (-1.1%)
⚪	burn_public	223,823	223,823		416	416		638,292	638,292		9,734	9,663	-71 (-0.7%)
⚪	initialize_transfer_commitment	225,077	225,077		768	768		474,500	474,500		9,645	9,571	-74 (-0.8%)
⚪	mint_to_private	297,577	297,577		1,408	1,408		511,400	511,400		10,984	10,841	-143 (-1.3%)
⚪	mint_to_public	223,823	223,823		416	416		637,800	637,800		9,933	9,641	-292 (-2.9%)
⚪	transfer_private_to_commitment	264,328	264,328		1,024	1,024		511,400	511,400		10,214	10,137	-77 (-0.8%)
⚪	transfer_private_to_private	337,261	337,261		2,048	2,048		555,100	555,100		11,390	11,333	-57 (-0.5%)
⚪	transfer_private_to_public	307,363	307,363		1,056	1,056		714,677	714,677		11,060	10,842	-218 (-2.0%)
⚪	transfer_public_to_commitment	223,823	223,823		640	640		663,516	663,516		9,829	9,644	-185 (-1.9%)
⚪	transfer_public_to_private	298,128	298,128		1,024	1,024		683,958	683,958		10,941	10,777	-164 (-1.5%)
⚪	transfer_public_to_public	223,823	223,823		480	480		673,505	673,505		9,778	9,633	-145 (-1.5%)

Contract: nft

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	275,257	275,257		416	416		661,052	661,052		10,527	10,485	-42 (-0.4%)
⚪	burn_public	223,823	223,823		448	448		670,034	670,034		9,811	9,562	-249 (-2.5%)
⚪	mint_to_private	341,050	341,050		1,600	1,600		735,342	735,342		11,663	11,415	-248 (-2.1%)
⚪	mint_to_public	223,823	223,823		448	448		670,718	670,718		9,762	9,606	-156 (-1.6%)
⚪	transfer_private_to_private	249,719	249,719		832	832		499,700	499,700		10,077	9,917	-160 (-1.6%)
⚪	transfer_private_to_public	275,286	275,286		416	416		659,258	659,258		10,835	10,448	-387 (-3.6%)
⚪	transfer_public_to_private	292,460	292,460		992	992		683,268	683,268		10,808	10,604	-204 (-1.9%)
⚪	transfer_public_to_public	223,823	223,823		384	384		633,285	633,285		9,803	9,680	-123 (-1.3%)

Contract: token

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	303,652	303,652		1,024	1,024		713,843	713,843		10,922	10,871	-51 (-0.5%)
⚪	burn_public	223,823	223,823		448	448		672,518	672,518		9,777	9,613	-164 (-1.7%)
⚪	initialize_transfer_commitment	225,077	225,077		768	768		474,500	474,500		9,744	9,576	-168 (-1.7%)
⚪	mint_to_private	355,289	355,289		2,144	2,144		737,956	737,956		11,896	11,626	-270 (-2.3%)
⚪	mint_to_public	223,823	223,823		448	448		672,113	672,113		9,857	9,699	-158 (-1.6%)
⚪	transfer_private_to_commitment	260,673	260,673		992	992		511,400	511,400		10,158	10,059	-99 (-1.0%)
⚪	transfer_private_to_private	344,855	344,855		2,592	2,592		557,600	557,600		11,572	11,440	-132 (-1.1%)
⚪	transfer_private_to_public	303,708	303,708		1,024	1,024		713,990	713,990		11,037	10,868	-169 (-1.5%)
⚪	transfer_private_to_public_with_commitment	308,509	308,509		1,600	1,600		747,290	747,290		11,062	10,952	-110 (-1.0%)
⚪	transfer_public_to_commitment	223,823	223,823		576	576		662,496	662,496		9,847	9,623	-224 (-2.3%)
⚪	transfer_public_to_private	296,092	296,092		992	992		683,271	683,271		10,906	10,731	-175 (-1.6%)
⚪	transfer_public_to_public	223,823	223,823		448	448		672,515	672,515		9,869	9,626	-243 (-2.5%)

Contract: vault

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	deposit_private_to_private	508,340	508,340		1,312	1,312		878,035	878,035		14,444	14,095	-349 (-2.4%)
⚪	deposit_private_to_private_exact	612,065	612,065		1,888	1,888		915,103	915,103		16,290	15,933	-357 (-2.2%)
⚪	deposit_private_to_public	436,085	436,085		768	768		862,060	862,060		13,301	13,019	-282 (-2.1%)
⚪	deposit_public_to_private	424,713	424,713		1,984	1,984		964,832	964,832		13,296	12,880	-416 (-3.1%)
⚪	deposit_public_to_private_exact	424,724	424,724		1,952	1,952		949,256	949,256		13,243	12,880	-363 (-2.7%)
⚪	deposit_public_to_public	223,823	223,823		832	832		897,350	897,350		9,823	9,666	-157 (-1.6%)
⚪	issue_private_to_private_exact	612,065	612,065		1,888	1,888		915,763	915,763		16,297	16,039	-258 (-1.6%)
⚪	issue_private_to_public_exact	484,820	484,820		1,344	1,344		899,785	899,785		14,076	13,759	-317 (-2.3%)
⚪	issue_public_to_private	346,165	346,165		1,376	1,376		921,448	921,448		11,742	11,492	-250 (-2.1%)
⚪	issue_public_to_public	223,823	223,823		832	832		898,040	898,040		9,858	9,594	-264 (-2.7%)
⚪	redeem_private_to_private_exact	614,859	614,859		1,888	1,888		915,610	915,610		16,172	15,972	-200 (-1.2%)
⚪	redeem_private_to_public	436,028	436,028		768	768		862,504	862,504		13,088	13,063	-25 (-0.2%)
⚪	redeem_public_to_private_exact	427,575	427,575		1,952	1,952		949,577	949,577		12,969	12,901	-68 (-0.5%)
⚪	redeem_public_to_public	223,823	223,823		832	832		897,872	897,872		9,653	9,602	-51 (-0.5%)
⚪	withdraw_private_to_private	511,134	511,134		1,312	1,312		878,245	878,245		14,186	14,099	-87 (-0.6%)
⚪	withdraw_private_to_private_exact	614,859	614,859		1,888	1,888		915,556	915,556		16,155	16,032	-123 (-0.8%)
⚪	withdraw_private_to_public_exact	484,763	484,763		1,344	1,344		900,019	900,019		13,822	13,744	-78 (-0.6%)
⚪	withdraw_public_to_private	440,832	440,832		2,528	2,528		967,143	967,143		13,309	13,120	-189 (-1.4%)
⚪	withdraw_public_to_public	223,823	223,823		832	832		898,175	898,175		9,709	9,595	-114 (-1.2%)