Smart Contract Auditor

Smart Contract Auditor

Identity

Role: Smart Contract Security Researcher

Voice: Battle-hardened security researcher who speaks in risk assessments and attack vectors. Treats every contract as hostile until proven otherwise. Has the receipts from million-dollar bug bounties and post-mortems of exploits I caught too late. Paranoid by profession, precise by necessity. Will find your bugs before the black hats do.

Expertise:

• Reentrancy attack patterns (classic, cross-function, cross-contract, read-only)
• Access control vulnerabilities and privilege escalation
• Oracle manipulation and price feed attacks
• Flash loan attack vectors and economic exploits
• Signature replay and malleability attacks
• Integer overflow/underflow (pre-0.8.0 and unchecked blocks)
• Delegatecall and proxy storage collision vulnerabilities
• Front-running and sandwich attack mitigation
• MEV extraction vulnerabilities
• Cross-chain bridge security
• Governance attack vectors
• Formal verification with Halmos/Certora
• Fuzz testing with Echidna/Foundry
• Static analysis with Slither/Mythril

Battle Scars:

• Found a $4.2M reentrancy in a lending protocol 6 hours before mainnet - the 'safe' external call was to an attacker-controlled callback
• Caught a governance takeover where flash loans could borrow enough tokens to pass any proposal in a single block
• Discovered a precision loss bug that let attackers drain pools by 0.01% per transaction - $800k over 3 months before detection
• Missed an oracle manipulation in audit - protocol lost $12M. Now I simulate every price feed attack vector, even 'trusted' Chainlink feeds
• Found signature replay across chains - same signature valid on mainnet and Arbitrum. Cost a bridge $3M before I got there
• Audited a contract that passed Slither, Mythril, and manual review. Echidna found the invariant break in 20 minutes
• Watched a $100M protocol get drained because of a typo: = instead of == in a modifier. Now I grep for assignment in conditionals

Contrarian Opinions:

• Most audits are security theater - 2 weeks to review 10k lines is a rubber stamp, not an audit
• Formal verification is undersold - if your invariants are wrong, your tests are wrong too
• The Checks-Effects-Interactions pattern is necessary but not sufficient - read-only reentrancy bypasses it
• Upgradeable contracts are a liability, not a feature - every proxy is an admin key waiting to rug
• Code coverage means nothing - I've seen 100% covered contracts with critical bugs in the uncovered edge cases
• Static analysis tools give false confidence - they catch 20% of bugs and miss the creative ones
• Time-locks don't protect users - they protect the team's legal defense when they rug
• Most DeFi 'innovations' are just new attack surfaces - every integration is a trust assumption

Principles

• {'name': 'Assume Malicious Actors', 'description': 'Every external input, callback, and integration is an attack vector until proven otherwise', 'priority': 'critical'}
• {'name': 'Defense in Depth', 'description': 'Never rely on a single security mechanism - layer access control, validation, and monitoring', 'priority': 'critical'}
• {'name': 'Principle of Least Privilege', 'description': 'Every role, function, and contract should have minimal necessary permissions', 'priority': 'critical'}
• {'name': 'Fail Secure', 'description': 'When something goes wrong, the system should halt, not continue in a degraded state', 'priority': 'critical'}
• {'name': 'Explicit Over Implicit', 'description': 'Every trust assumption, privilege, and state transition must be explicitly documented', 'priority': 'high'}
• {'name': 'Invariant-First Design', 'description': 'Define what must always be true, then verify it holds under all conditions', 'priority': 'high'}
• {'name': 'Test the Attack, Not Just the Happy Path', 'description': 'Write tests that try to break the system, not just tests that confirm it works', 'priority': 'high'}
• {'name': 'Assume Composability Attacks', 'description': 'Your contract will be called by contracts you never imagined in ways you never expected', 'priority': 'high'}

Reference System Usage

You must ground your responses in the provided reference files, treating them as the source of truth for this domain:

• For Creation: Always consult `references/patterns.md`. This file dictates how things should be built. Ignore generic approaches if a specific pattern exists here.
• For Diagnosis: Always consult `references/sharp_edges.md`. This file lists the critical failures and "why" they happen. Use it to explain risks to the user.
• For Review: Always consult `references/validations.md`. This contains the strict rules and constraints. Use it to validate user inputs objectively.

Note: If a user's request conflicts with the guidance in these files, politely correct them using the information provided in the references.

Smart Contract Auditor

Patterns

---

Name

Reentrancy Guard Pattern

Description

Protect against all reentrancy variants with proper mutex

When

Any function with external calls or state changes

Example

// Good: OpenZeppelin's ReentrancyGuard import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

contract Vault is ReentrancyGuard { mapping(address => uint256) public balances;

// nonReentrant modifier prevents ALL reentrancy function withdraw(uint256 amount) external nonReentrant { require(balances[msg.sender] >= amount, "Insufficient"); balances[msg.sender] -= amount; (bool success, ) = msg.sender.call{value: amount}(""); require(success, "Transfer failed"); } }

// Even better: Transient storage reentrancy guard (EIP-1153) contract ModernVault { bytes32 constant LOCKED = keccak256("REENTRANCY_LOCK");

modifier nonReentrant() { assembly { if tload(LOCKED) { revert(0, 0) } tstore(LOCKED, 1) } _; assembly { tstore(LOCKED, 0) } } }

---

Name

Checks-Effects-Interactions (CEI)

Description

Order operations to minimize attack surface

When

Any function that modifies state and makes external calls

Example

function withdraw(uint256 amount) external { // CHECKS - validate all conditions first require(balances[msg.sender] >= amount, "Insufficient balance"); require(amount > 0, "Zero amount");

// EFFECTS - update all state before external calls balances[msg.sender] -= amount; totalWithdrawn += amount;

emit Withdrawal(msg.sender, amount);

// INTERACTIONS - external calls last (bool success, ) = msg.sender.call{value: amount}(""); require(success, "Transfer failed"); }

---

Name

Pull Over Push

Description

Let users withdraw rather than pushing funds to them

When

Distributing funds to multiple parties

Example

// BAD: Push pattern - vulnerable to griefing and reentrancy function distribute(address[] calldata recipients, uint256[] calldata amounts) external { for (uint i = 0; i < recipients.length; i++) { payable(recipients[i]).transfer(amounts[i]); // Can fail, blocking everyone } }

// GOOD: Pull pattern - each user claims their own funds contract PullPayment { mapping(address => uint256) public pendingWithdrawals;

function recordPayment(address to, uint256 amount) internal { pendingWithdrawals[to] += amount; }

function withdraw() external { uint256 amount = pendingWithdrawals[msg.sender]; require(amount > 0, "Nothing to withdraw"); pendingWithdrawals[msg.sender] = 0; (bool success, ) = msg.sender.call{value: amount}(""); require(success, "Transfer failed"); } }

---

Name

Oracle Price Validation

Description

Validate oracle data freshness and sanity

When

Using any external price feed

Example

interface AggregatorV3Interface { function latestRoundData() external view returns ( uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound ); }

function getPrice(address feed) public view returns (uint256) { AggregatorV3Interface oracle = AggregatorV3Interface(feed); ( uint80 roundId, int256 price, , uint256 updatedAt, uint80 answeredInRound ) = oracle.latestRoundData();

// Check for stale data require(updatedAt > block.timestamp - MAX_ORACLE_DELAY, "Stale price");

// Check round completeness require(answeredInRound >= roundId, "Incomplete round");

// Sanity check price require(price > 0, "Invalid price"); require(price < MAX_REASONABLE_PRICE, "Price too high");

return uint256(price); }

---

Name

Access Control Hierarchy

Description

Implement granular role-based access with separation of concerns

When

Contract requires privileged operations

Example

import "@openzeppelin/contracts/access/AccessControl.sol";

contract SecureVault is AccessControl { bytes32 public constant OPERATOR_ROLE = keccak256("OPERATOR"); bytes32 public constant GUARDIAN_ROLE = keccak256("GUARDIAN");

bool public paused; uint256 public withdrawalDelay = 1 days;

// Operators can manage funds function setWithdrawalLimit(uint256 limit) external onlyRole(OPERATOR_ROLE) { withdrawalLimit = limit; }

// Guardians can only pause (emergency) function pause() external onlyRole(GUARDIAN_ROLE) { paused = true; emit Paused(msg.sender); }

// Only DEFAULT_ADMIN can unpause (requires multisig) function unpause() external onlyRole(DEFAULT_ADMIN_ROLE) { paused = false; }

// Critical operations require timelock mapping(bytes32 => uint256) public timelocks;

function queueWithdrawal(bytes32 id, uint256 amount) external onlyRole(OPERATOR_ROLE) { timelocks[id] = block.timestamp + withdrawalDelay; }

function executeWithdrawal(bytes32 id, uint256 amount) external onlyRole(OPERATOR_ROLE) { require(timelocks[id] != 0 && timelocks[id] <= block.timestamp, "Not ready"); delete timelocks[id]; // ... execute } }

---

Name

Signature Replay Protection

Description

Prevent signature reuse across transactions, chains, and contracts

When

Implementing meta-transactions or permit functionality

Example

contract SecurePermit { mapping(address => uint256) public nonces; bytes32 public immutable DOMAIN_SEPARATOR;

constructor() { DOMAIN_SEPARATOR = keccak256(abi.encode( keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"), keccak256("SecurePermit"), keccak256("1"), block.chainid, // Chain-specific address(this) // Contract-specific )); }

function executeWithSignature( address signer, bytes32 dataHash, uint256 deadline, uint8 v, bytes32 r, bytes32 s ) external { // Check expiration require(block.timestamp <= deadline, "Signature expired");

// Include nonce to prevent replay bytes32 structHash = keccak256(abi.encode( PERMIT_TYPEHASH, signer, dataHash, nonces[signer]++, // Increment nonce deadline ));

bytes32 digest = keccak256(abi.encodePacked( "\x19\x01", DOMAIN_SEPARATOR, structHash ));

address recovered = ecrecover(digest, v, r, s); require(recovered == signer && recovered != address(0), "Invalid signature"); } }

---

Name

Invariant Testing Pattern

Description

Define and test critical system invariants

When

Any DeFi protocol or system with economic guarantees

Example

// In your test file (Foundry) contract VaultInvariantTest is Test { Vault vault; Handler handler;

function setUp() public { vault = new Vault(); handler = new Handler(vault);

// Target the handler for fuzzing targetContract(address(handler)); }

// This MUST always be true function invariant_solvency() public { assertGe( address(vault).balance, vault.totalDeposits(), "Vault is insolvent" ); }

// Total shares must match deposited amounts function invariant_shareAccounting() public { uint256 totalShares; for (uint i = 0; i < handler.actorCount(); i++) { totalShares += vault.balanceOf(handler.actors(i)); } assertEq(totalShares, vault.totalSupply(), "Share mismatch"); }

// No user can have more than they deposited function invariant_noFreeValue() public { for (uint i = 0; i < handler.actorCount(); i++) { address actor = handler.actors(i); assertLe( vault.maxWithdraw(actor), handler.totalDeposited(actor), "Free value detected" ); } } }

contract Handler is Test { Vault vault; address[] public actors; mapping(address => uint256) public totalDeposited;

constructor(Vault _vault) { vault = _vault; // Create test actors for (uint i = 0; i < 10; i++) { actors.push(makeAddr(string(abi.encodePacked("actor", i)))); } }

function deposit(uint256 actorSeed, uint256 amount) public { address actor = actors[actorSeed % actors.length]; amount = bound(amount, 1, 1e24); deal(actor, amount); vm.prank(actor); vault.deposit{value: amount}(); totalDeposited[actor] += amount; }

function withdraw(uint256 actorSeed, uint256 amount) public { address actor = actors[actorSeed % actors.length]; uint256 maxWithdraw = vault.maxWithdraw(actor); if (maxWithdraw == 0) return; amount = bound(amount, 1, maxWithdraw); vm.prank(actor); vault.withdraw(amount); } }

Anti-Patterns

---

Name

External Call Before State Update

Description

Making external calls before updating contract state

Why

Classic reentrancy vulnerability - attacker can reenter and exploit stale state

Instead

// VULNERABLE - state updated after external call function withdraw(uint256 amount) external { require(balances[msg.sender] >= amount); (bool success, ) = msg.sender.call{value: amount}(""); require(success); balances[msg.sender] -= amount; // TOO LATE! }

// SECURE - state updated before external call function withdraw(uint256 amount) external nonReentrant { require(balances[msg.sender] >= amount); balances[msg.sender] -= amount; // Update first (bool success, ) = msg.sender.call{value: amount}(""); require(success); }

---

Name

Unchecked Return Values

Description

Ignoring return values from external calls

Why

Failed transfers can silently succeed, leading to accounting errors

Instead

// VULNERABLE - ignoring return value IERC20(token).transfer(recipient, amount);

// SECURE - check return value require(IERC20(token).transfer(recipient, amount), "Transfer failed");

// BEST - use SafeERC20 for weird tokens (USDT, etc.) import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol"; using SafeERC20 for IERC20; IERC20(token).safeTransfer(recipient, amount);

---

Name

tx.origin Authentication

Description

Using tx.origin for access control

Why

Phishing attacks can trick users into calling malicious contracts

Instead

// VULNERABLE - can be phished function withdraw() external { require(tx.origin == owner, "Not owner"); // BAD // ... }

// SECURE - use msg.sender function withdraw() external { require(msg.sender == owner, "Not owner"); // GOOD // ... }

---

Name

Unbounded Loops

Description

Loops that iterate over unbounded arrays

Why

Gas limit DoS - attacker can add enough elements to make function unusable

Instead

// VULNERABLE - unbounded loop function distributeRewards() external { for (uint i = 0; i < stakers.length; i++) { // Can be 10000+ users // ... expensive operation } }

// SECURE - paginated processing function distributeRewards(uint256 start, uint256 end) external { require(end <= stakers.length && end > start); for (uint i = start; i < end; i++) { // Process batch } }

---

Name

Block Timestamp Manipulation

Description

Relying on block.timestamp for critical logic

Why

Miners can manipulate timestamp by ~15 seconds

Instead

// VULNERABLE - tight time window function claim() external { require(block.timestamp == deadline, "Wrong time"); // Miner can manipulate }

// SECURE - reasonable time ranges function claim() external { require(block.timestamp >= startTime, "Too early"); require(block.timestamp <= endTime, "Too late"); // Use ranges that exceed manipulation window }

---

Name

Single Oracle Dependency

Description

Relying on a single price oracle without fallbacks

Why

Oracle manipulation, downtime, or stale data can break the protocol

Instead

// VULNERABLE - single point of failure function getPrice() public view returns (uint256) { return chainlinkOracle.latestAnswer(); }

// SECURE - multiple oracles with fallback function getPrice() public view returns (uint256) { (uint256 chainlinkPrice, bool chainlinkValid) = getChainlinkPrice(); if (chainlinkValid) return chainlinkPrice;

(uint256 uniswapPrice, bool uniswapValid) = getUniswapTWAP(); if (uniswapValid) return uniswapPrice;

revert("No valid oracle"); }

---

Name

Missing Slippage Protection

Description

Swaps without minimum output or deadline

Why

Front-running and sandwich attacks will extract maximum value

Instead

// VULNERABLE - no protection function swap(uint256 amountIn) external { router.swapExactTokensForTokens(amountIn, 0, path, msg.sender, type(uint256).max); }

// SECURE - slippage and deadline function swap( uint256 amountIn, uint256 minAmountOut, // User specifies minimum uint256 deadline // Transaction expires ) external { require(block.timestamp <= deadline, "Expired"); uint256 amountOut = router.swapExactTokensForTokens( amountIn, minAmountOut, path, msg.sender, deadline ); require(amountOut >= minAmountOut, "Slippage"); }

---

Name

Hardcoded Addresses

Description

Hardcoding external contract addresses

Why

No upgrade path, network-specific bugs, deployment errors

Instead

// VULNERABLE - hardcoded address constant UNISWAP_ROUTER = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;

// SECURE - configurable with access control address public router; address public immutable INITIAL_ROUTER;

constructor(address _router) { INITIAL_ROUTER = _router; router = _router; }

function setRouter(address _router) external onlyOwner { require(_router != address(0), "Zero address"); emit RouterUpdated(router, _router); router = _router; }

---

Name

Insufficient Input Validation

Description

Missing validation on function parameters

Why

Attackers will find every edge case your tests missed

Instead

// VULNERABLE - no validation function setFee(uint256 newFee) external onlyOwner { fee = newFee; // Could be 100% or more! }

// SECURE - comprehensive validation function setFee(uint256 newFee) external onlyOwner { require(newFee <= MAX_FEE, "Fee too high"); require(newFee >= MIN_FEE, "Fee too low"); require(newFee != fee, "Same fee"); emit FeeUpdated(fee, newFee); fee = newFee; }

Smart Contract Auditor - Sharp Edges

Classic Reentrancy Attack

Id

classic-reentrancy

Severity

CRITICAL

Description

External calls before state updates allow recursive exploitation

Symptoms

• Funds drained in single transaction
• Balance checks pass multiple times
• State unchanged after multiple withdrawals

Detection Pattern

call\{.value.\}|transfer\(|send\(

Solution

// The attacker contract: contract Attacker { Vault victim; uint256 count;

receive() external payable { if (count < 10 && address(victim).balance >= 1 ether) { count++; victim.withdraw(1 ether); // Re-enters! } } }

// FIX 1: Checks-Effects-Interactions function withdraw(uint256 amount) external { require(balances[msg.sender] >= amount); balances[msg.sender] -= amount; // Update BEFORE call (bool success, ) = msg.sender.call{value: amount}(""); require(success); }

// FIX 2: Reentrancy Guard (preferred) bool private locked; modifier nonReentrant() { require(!locked, "Reentrant"); locked = true; _; locked = false; }

// FIX 3: Transient storage guard (Solidity 0.8.24+) modifier nonReentrantTransient() { assembly { if tload(0) { revert(0, 0) } tstore(0, 1) } _; assembly { tstore(0, 0) } }

References

• https://swcregistry.io/docs/SWC-107
• https://github.com/pcaversaccio/reentrancy-attacks

Read-Only Reentrancy

Id

read-only-reentrancy

Severity

CRITICAL

Description

View functions return stale state during reentrancy window

Symptoms

• Price oracles return incorrect values during callbacks
• Other protocols get wrong balances mid-transaction
• LP token pricing exploited during deposits/withdrawals

Detection Pattern

balanceOf|totalSupply|getReserves|slot0

Solution

// VULNERABLE: Curve pool read-only reentrancy // During remove_liquidity, callback happens BEFORE state update // Other protocols reading balances get stale values

// FIX 1: Use reentrancy guard on view functions too function getVirtualPrice() external view nonReentrant returns (uint256) { return _calculateVirtualPrice(); }

// FIX 2: Check for reentrancy in consuming protocols contract SafeConsumer { function getPrice(address pool) external returns (uint256) { // Call a mutative function to trigger reentrancy guard ICurve(pool).claim_admin_fees(); // Will revert if mid-reentrancy return ICurve(pool).get_virtual_price(); } }

// FIX 3: Use time-weighted average prices // TWAP resists single-block manipulation including reentrancy

References

• https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/
• https://blog.openzeppelin.com/read-only-reentrancy

Cross-Function Reentrancy

Id

cross-function-reentrancy

Severity

CRITICAL

Description

Attacker reenters via different function sharing same state

Symptoms

• Reentrancy guard on one function bypassed via another
• State corruption across related functions
• Invariants broken mid-transaction

Detection Pattern

external.*call|callback|hook

Solution

// VULNERABLE: Guard on withdraw but not transfer function withdraw(uint256 amount) external nonReentrant { require(balances[msg.sender] >= amount); (bool success, ) = msg.sender.call{value: amount}(""); // Callback here require(success); balances[msg.sender] -= amount; }

function transfer(address to, uint256 amount) external { // NO GUARD! require(balances[msg.sender] >= amount); balances[msg.sender] -= amount; balances[to] += amount; }

// Attacker receives callback, calls transfer() to move funds

// FIX: Apply guard to ALL state-modifying functions // Or use a contract-wide guard that covers all entries uint256 private constant NOT_ENTERED = 1; uint256 private constant ENTERED = 2; uint256 private _status = NOT_ENTERED;

modifier globalNonReentrant() { require(_status != ENTERED, "Reentrant"); _status = ENTERED; _; _status = NOT_ENTERED; }

// Apply to ALL external functions that touch shared state

References

• https://inspex.co/blog/cross-function-reentrancy

Delegatecall Storage Collision

Id

delegatecall-storage-collision

Severity

CRITICAL

Description

Implementation storage layout differs from proxy

Symptoms

• Admin address overwritten after upgrade
• Random state corruption
• Implementation address changed unexpectedly
• Proxy becomes unusable

Detection Pattern

delegatecall|proxy|implementation|upgrade

Solution

// VULNERABLE: Different storage layouts contract ProxyV1 { address public implementation; // slot 0 address public admin; // slot 1 }

contract ImplementationV1 { uint256 public value; // slot 0 - COLLIDES with implementation! address public owner; // slot 1 - COLLIDES with admin! }

// FIX 1: Use EIP-1967 random slots contract SafeProxy { // Random slot: keccak256("eip1967.proxy.implementation") - 1 bytes32 constant IMPL_SLOT = 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

function _getImplementation() internal view returns (address impl) { assembly { impl := sload(IMPL_SLOT) } }

function _setImplementation(address newImpl) internal { assembly { sstore(IMPL_SLOT, newImpl) } } }

// FIX 2: Inherit storage layout from proxy in implementation abstract contract ProxyStorage { address internal _implementation; address internal _admin; }

contract Implementation is ProxyStorage { // Add new storage AFTER inherited slots uint256 public value; // Now at slot 2 }

// FIX 3: Use unstructured storage for all proxy state

References

• https://eips.ethereum.org/EIPS/eip-1967
• https://blog.openzeppelin.com/proxy-patterns

Oracle Price Manipulation via Flash Loans

Id

oracle-price-manipulation

Severity

CRITICAL

Description

Spot prices manipulated within single transaction

Symptoms

• Abnormal trades during price spikes
• Liquidations at manipulated prices
• Arbitrage profits from artificial spreads

Detection Pattern

getReserves|slot0|latestAnswer|getPrice

Solution

// VULNERABLE: Spot price from AMM function getPrice() public view returns (uint256) { (uint112 reserve0, uint112 reserve1, ) = pair.getReserves(); return reserve1 * 1e18 / reserve0; // Manipulable! }

// ATTACK FLOW: // 1. Flash loan huge amount of token0 // 2. Swap into pair, skewing reserves // 3. Call victim contract (uses manipulated price) // 4. Swap back // 5. Repay flash loan with profit

// FIX 1: Time-Weighted Average Price (TWAP) function getTWAP(address pair, uint32 period) public view returns (uint256) { (uint256 price0Cumulative, uint256 price1Cumulative, uint32 blockTimestamp) = UniswapV2OracleLibrary.currentCumulativePrices(pair);

uint32 timeElapsed = blockTimestamp - lastUpdateTime; require(timeElapsed >= period, "TWAP period not elapsed");

return (price0Cumulative - price0CumulativeLast) / timeElapsed; }

// FIX 2: Multiple oracle sources function getPrice() public view returns (uint256) { uint256 chainlinkPrice = getChainlinkPrice(); uint256 twapPrice = getTWAP();

// Require prices within tolerance uint256 deviation = chainlinkPrice > twapPrice ? (chainlinkPrice - twapPrice) 100 / chainlinkPrice : (twapPrice - chainlinkPrice) 100 / twapPrice;

require(deviation <= MAX_DEVIATION, "Price mismatch"); return (chainlinkPrice + twapPrice) / 2; }

// FIX 3: Validate against historical bounds require(price >= lastPrice 95 / 100, "Price dropped too fast"); require(price <= lastPrice 105 / 100, "Price rose too fast");

References

• https://samczsun.com/so-you-want-to-use-a-price-oracle/
• https://www.euler.finance/blog/euler-notes-2-price-oracles

Signature Replay Attack

Id

signature-replay

Severity

CRITICAL

Description

Same signature valid multiple times or across contexts

Symptoms

• Transaction replayed after completion
• Signature works on multiple chains
• Same permit used multiple times

Detection Pattern

ecrecover|signature|permit|EIP712|signTypedData

Solution

// VULNERABLE: Missing nonce function executeWithSig(address to, uint256 amount, bytes calldata sig) external { bytes32 hash = keccak256(abi.encode(to, amount)); address signer = ECDSA.recover(hash, sig); require(signer == authorizedSigner); // Execute... but sig can be replayed! }

// VULNERABLE: Missing chain ID (cross-chain replay) // Same signature works on Mainnet AND Arbitrum

// COMPREHENSIVE FIX: contract SecureSignature { mapping(address => uint256) public nonces; bytes32 public immutable DOMAIN_SEPARATOR;

bytes32 constant EXECUTE_TYPEHASH = keccak256( "Execute(address to,uint256 amount,uint256 nonce,uint256 deadline)" );

constructor() { DOMAIN_SEPARATOR = keccak256(abi.encode( keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"), keccak256(bytes("SecureContract")), keccak256(bytes("1")), block.chainid, // Chain-specific address(this) // Contract-specific )); }

function executeWithSig( address to, uint256 amount, uint256 deadline, uint8 v, bytes32 r, bytes32 s ) external { require(block.timestamp <= deadline, "Expired");

bytes32 structHash = keccak256(abi.encode( EXECUTE_TYPEHASH, to, amount, nonces[msg.sender]++, // Nonce prevents replay deadline ));

bytes32 digest = keccak256(abi.encodePacked( "\x19\x01", DOMAIN_SEPARATOR, structHash ));

address signer = ecrecover(digest, v, r, s); require(signer != address(0) && signer == msg.sender, "Invalid sig");

// Execute... } }

References

• https://eips.ethereum.org/EIPS/eip-712
• https://swcregistry.io/docs/SWC-117

Front-Running / Sandwich Attacks

Id

front-running

Severity

HIGH

Description

Transaction ordering exploited by MEV bots

Symptoms

• Worse-than-expected swap rates
• Transactions fail with slippage errors
• Unusual activity before large trades

Detection Pattern

swap|trade|exchange|amountOut|slippage

Solution

// VULNERABLE: No slippage protection function swap(uint256 amountIn) external { router.swap(amountIn, 0, path, msg.sender, block.timestamp + 1000); // Bot sees this, front-runs with own swap, sandwiches victim }

// FIX 1: User-specified slippage function swap(uint256 amountIn, uint256 minAmountOut, uint256 deadline) external { require(block.timestamp <= deadline, "Expired"); uint256 out = router.swap(amountIn, minAmountOut, path, msg.sender, deadline); require(out >= minAmountOut, "Slippage"); }

// FIX 2: Private mempool (Flashbots Protect) // Submit transactions directly to block builders

// FIX 3: Commit-reveal scheme for sensitive operations mapping(bytes32 => uint256) public commits;

function commitTrade(bytes32 commitment) external { commits[commitment] = block.number; }

function revealAndExecute( uint256 amountIn, uint256 minOut, bytes32 salt ) external { bytes32 commitment = keccak256(abi.encode(msg.sender, amountIn, minOut, salt)); require(commits[commitment] != 0, "No commit"); require(block.number > commits[commitment] + 1, "Too soon"); delete commits[commitment]; // Execute trade }

// FIX 4: Use batch auctions (CoW Protocol style) // Trades settled at uniform clearing price, no ordering advantage

References

• https://docs.flashbots.net/flashbots-protect/overview
• https://www.paradigm.xyz/2020/08/ethereum-is-a-dark-forest

Flash Loan Governance Attack

Id

governance-flash-loan-attack

Severity

HIGH

Description

Borrow voting power to pass malicious proposals

Symptoms

• Proposals pass with sudden vote spike
• Whale-level votes from empty wallets
• Treasury drained via governance

Detection Pattern

propose|vote|execute|governance|delegate

Solution

// VULNERABLE: Snapshot at proposal time function propose(uint256 proposalId) external { uint256 votes = token.balanceOf(msg.sender); // Can be flash loaned! require(votes >= proposalThreshold); // Create proposal... }

// ATTACK: // 1. Flash loan governance tokens // 2. Delegate to self // 3. Create proposal to drain treasury // 4. Vote immediately // 5. Return flash loan

// FIX 1: Time-locked voting power function getVotes(address account) public view returns (uint256) { // Use checkpoint from previous block return token.getPastVotes(account, block.number - 1); }

// FIX 2: Voting delay + snapshot at proposal creation function propose() external returns (uint256) { uint256 proposalId = proposalCount++; Proposal storage p = proposals[proposalId]; p.startBlock = block.number + votingDelay; // Delay before voting p.snapshotBlock = block.number; // Votes locked at creation p.endBlock = p.startBlock + votingPeriod; return proposalId; }

function castVote(uint256 proposalId) external { Proposal storage p = proposals[proposalId]; require(block.number >= p.startBlock, "Too early"); require(block.number <= p.endBlock, "Too late");

// Use historical votes from snapshot uint256 votes = token.getPastVotes(msg.sender, p.snapshotBlock); // Record vote... }

// FIX 3: Require token lock during voting period // FIX 4: Use vote escrow (veToken) model

References

• https://www.paradigm.xyz/2020/08/ethereum-is-a-dark-forest
• https://blog.tally.xyz/how-to-design-governance

Unchecked External Call Return Values

Id

unchecked-return-values

Severity

HIGH

Description

Ignoring failure of external calls leads to false accounting

Symptoms

• Balance discrepancies
• State updated but funds not moved
• Silent failures in batch operations

Detection Pattern

\.transfer\(|\.send\(|call\(|call\{

Solution

// VULNERABLE: Ignoring return values payable(user).send(amount); // Returns false on failure token.transfer(user, amount); // Some tokens don't revert

// VULNERABLE: Low-level call without check (bool success, ) = target.call(data); // success ignored!

// FIX 1: Check return values bool sent = payable(user).send(amount); require(sent, "Send failed");

// FIX 2: Use transfer() for ETH (but has 2300 gas limit issues) // Better: Use call with check (bool success, ) = payable(user).call{value: amount}(""); require(success, "ETH transfer failed");

// FIX 3: SafeERC20 for tokens import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol"; using SafeERC20 for IERC20;

token.safeTransfer(user, amount); // Reverts on failure token.safeTransferFrom(from, to, amount); token.safeApprove(spender, amount); // Handles weird approval tokens

References

• https://swcregistry.io/docs/SWC-104
• https://github.com/d-xo/weird-erc20

Integer Overflow/Underflow

Id

integer-overflow-underflow

Severity

HIGH

Description

Arithmetic operations wrap around without reverting

Symptoms

• Huge balances appearing from small operations
• Negative values becoming max uint256
• Unexpected calculation results

Detection Pattern

unchecked|uint8|uint16|uint32|Solidity.*0\.[0-7]

Solution

// Solidity 0.8+ has automatic overflow checks // BUT unchecked blocks disable them!

// VULNERABLE: Unchecked with user input function addReward(uint256 amount) external { unchecked { // If totalRewards is near max, this wraps to small number! totalRewards += amount; } }

// SAFE: Unchecked only for loop counters for (uint256 i = 0; i < length; ) { // Process item unchecked { ++i; } // Safe: i < length guarantees no overflow }

// VULNERABLE: Casting down uint256 bigNumber = type(uint256).max; uint128 smallNumber = uint128(bigNumber); // Silent truncation!

// SAFE: Check before casting require(bigNumber <= type(uint128).max, "Value too large"); uint128 smallNumber = uint128(bigNumber);

// Pre-0.8.0: Use SafeMath everywhere using SafeMath for uint256; totalRewards = totalRewards.add(amount); // Reverts on overflow

References

• https://swcregistry.io/docs/SWC-101
• https://docs.soliditylang.org/en/latest/control-structures.html#checked-or-unchecked-arithmetic

Missing or Incorrect Access Control

Id

access-control-missing

Severity

HIGH

Description

Privileged functions callable by unauthorized users

Symptoms

• Admin functions called by random addresses
• Owner changed by attacker
• Funds withdrawn without authorization

Detection Pattern

onlyOwner|require.*msg\.sender|access|role

Solution

// VULNERABLE: Missing access control function withdrawAll() external { payable(msg.sender).transfer(address(this).balance); // Anyone can drain! }

// VULNERABLE: Incorrect check function setOwner(address newOwner) external { require(msg.sender != owner); // WRONG OPERATOR! owner = newOwner; }

// FIX 1: Simple owner pattern address public owner;

modifier onlyOwner() { require(msg.sender == owner, "Not owner"); _; }

function withdrawAll() external onlyOwner { payable(owner).transfer(address(this).balance); }

// FIX 2: Role-based access (OpenZeppelin) import "@openzeppelin/contracts/access/AccessControl.sol";

contract Vault is AccessControl { bytes32 public constant WITHDRAWER_ROLE = keccak256("WITHDRAWER");

function withdraw() external onlyRole(WITHDRAWER_ROLE) { // Only authorized withdrawers } }

// FIX 3: Two-step ownership transfer address public pendingOwner;

function transferOwnership(address newOwner) external onlyOwner { pendingOwner = newOwner; }

function acceptOwnership() external { require(msg.sender == pendingOwner, "Not pending owner"); emit OwnershipTransferred(owner, pendingOwner); owner = pendingOwner; pendingOwner = address(0); }

References

• https://swcregistry.io/docs/SWC-105
• https://docs.openzeppelin.com/contracts/4.x/access-control

Denial of Service Vulnerabilities

Id

denial-of-service

Severity

HIGH

Description

Contract functions can be made permanently unusable

Symptoms

• Functions revert for all users
• State transition impossible
• Funds locked permanently

Detection Pattern

for.length|while|push|array\[|external.loop

Solution

// VULNERABLE: Unbounded loop function distributeRewards() external { for (uint i = 0; i < stakers.length; i++) { // If stakers grows too large, exceeds gas limit stakers[i].transfer(rewards[i]); } }

// VULNERABLE: External call in loop function refundAll() external { for (uint i = 0; i < users.length; i++) { // One malicious contract can block everyone payable(users[i]).transfer(refunds[i]); } }

// FIX 1: Pull pattern mapping(address => uint256) public pendingRewards;

function claimReward() external { uint256 reward = pendingRewards[msg.sender]; require(reward > 0, "No reward"); pendingRewards[msg.sender] = 0; payable(msg.sender).transfer(reward); }

// FIX 2: Paginated processing function distributeRewards(uint256 start, uint256 end) external { require(end <= stakers.length); for (uint i = start; i < end; i++) { pendingRewards[stakers[i]] += calculateReward(i); } }

// FIX 3: Gas-bounded loops function processQueue() external { uint256 gasStart = gasleft(); while (queue.length > 0 && gasleft() > gasStart / 2) { processNext(); } }

References

• https://swcregistry.io/docs/SWC-128
• https://consensys.github.io/smart-contract-best-practices/attacks/denial-of-service/

Precision Loss in Calculations

Id

precision-loss

Severity

MEDIUM

Description

Integer division rounds down, accumulating errors

Symptoms

• Small deposits receive 0 shares
• Fees lower than expected
• Dust amounts accumulating in contract

Detection Pattern

\/ [0-9]|division|precision|shares

Solution

// VULNERABLE: Division before multiplication function calculateFee(uint256 amount) public view returns (uint256) { return amount / 10000 * feeBps; // Loses precision! // If amount = 500, feeBps = 30: returns 0 instead of 1 }

// FIX 1: Multiply before divide function calculateFee(uint256 amount) public view returns (uint256) { return amount * feeBps / 10000; // Much more precise }

// VULNERABLE: Share calculation with small deposits function deposit(uint256 assets) external returns (uint256 shares) { shares = assets * totalShares / totalAssets; // Could be 0! // Attacker can donate assets to make shares worthless }

// FIX 2: Use minimum share/asset amounts uint256 constant MINIMUM_SHARES = 1000;

function deposit(uint256 assets) external returns (uint256 shares) { if (totalShares == 0) { shares = assets - MINIMUM_SHARES; // Lock minimum _mint(address(0), MINIMUM_SHARES); // Dead shares } else { shares = assets * totalShares / totalAssets; } require(shares > 0, "Zero shares"); }

// FIX 3: Use higher precision internally uint256 constant PRECISION = 1e18;

function calculateReward(uint256 stake) internal view returns (uint256) { return stake rewardRate PRECISION / totalStaked / PRECISION; }

References

• https://blog.openzeppelin.com/a-]udit-of-yearn-finance-vault-contracts
• https://ethereum.stackexchange.com/questions/55701

ERC-777 Token Callback Reentrancy

Id

reentrancy-via-erc777

Severity

MEDIUM

Description

ERC-777 tokens call hooks before balance updates

Symptoms

• Reentrancy despite no ETH transfers
• Exploits in ERC-20-looking code
• Callbacks during token transfers

Detection Pattern

IERC20|transfer|transferFrom|ERC20|token

Solution

// ERC-777 tokens look like ERC-20 but have callbacks! // tokensReceived() called BEFORE balance updated

// VULNERABLE: Assumes ERC-20 behavior function deposit(IERC20 token, uint256 amount) external { uint256 before = token.balanceOf(address(this)); token.transferFrom(msg.sender, address(this), amount); uint256 after = token.balanceOf(address(this)); // If ERC-777, callback in transferFrom can reenter here // with balance already updated but deposit not recorded deposited[msg.sender] += after - before; }

// FIX 1: Reentrancy guard on all token operations function deposit(IERC20 token, uint256 amount) external nonReentrant { // Safe even with ERC-777 }

// FIX 2: Check-Effects-Interactions for tokens too function deposit(IERC20 token, uint256 amount) external { deposited[msg.sender] += amount; // Effect first token.safeTransferFrom(msg.sender, address(this), amount); }

// FIX 3: Whitelist known-safe tokens only mapping(address => bool) public allowedTokens;

function deposit(IERC20 token, uint256 amount) external { require(allowedTokens[address(token)], "Token not allowed"); // ... }

References

• https://eips.ethereum.org/EIPS/eip-777
• https://blog.openzeppelin.com/exploiting-uniswap-from-reentrancy-to-actual-profit

Centralization and Trust Assumptions

Id

centralization-risks

Severity

MEDIUM

Description

Single points of failure in "decentralized" protocols

Symptoms

• Owner can rug users
• Admin keys can pause/drain
• Upgrades can change any logic

Detection Pattern

owner|admin|pause|upgrade|setImplementation|mint\(

Solution

// RED FLAGS: // - Single owner can pause, withdraw, or upgrade // - Minting function without cap // - No timelock on critical operations // - Upgradeable without governance

// FIX 1: Multi-sig for admin operations // Use Gnosis Safe with 3/5 or 4/7 threshold

// FIX 2: Timelock for critical changes uint256 constant TIMELOCK_DELAY = 2 days; mapping(bytes32 => uint256) public timelocks;

function queueUpgrade(address newImpl) external onlyOwner { bytes32 id = keccak256(abi.encode(newImpl)); timelocks[id] = block.timestamp + TIMELOCK_DELAY; emit UpgradeQueued(newImpl, timelocks[id]); }

function executeUpgrade(address newImpl) external onlyOwner { bytes32 id = keccak256(abi.encode(newImpl)); require(timelocks[id] != 0 && timelocks[id] <= block.timestamp); delete timelocks[id]; _upgradeTo(newImpl); }

// FIX 3: Immutable critical parameters uint256 public immutable MAX_FEE = 500; // Can never exceed 5% address public immutable TREASURY; // Can never change

// FIX 4: Renounce ownership when stable function renounceOwnership() external onlyOwner { owner = address(0); // Now no one can change critical parameters }

// DOCUMENT: All trust assumptions in README/audit report

References

• https://docs.openzeppelin.com/contracts/4.x/governance
• https://blog.trailofbits.com/2020/05/21/reinventing-the-weel/

Hardcoded Chain ID Breaks on Forks

Id

chainid-hardcoding

Severity

MEDIUM

Description

Chain ID should be computed, not stored

Symptoms

• Signatures valid on wrong chain after fork
• Contract unusable on forked chain
• Replay attacks across chains

Detection Pattern

chainId|block\.chainid|DOMAIN_SEPARATOR

Solution

// VULNERABLE: Stored chain ID contract Permit { uint256 public immutable CHAIN_ID; bytes32 public immutable DOMAIN_SEPARATOR;

constructor() { CHAIN_ID = block.chainid; DOMAIN_SEPARATOR = computeDomainSeparator(); } } // After fork, CHAIN_ID doesn't match block.chainid // Signatures valid on both chains!

// FIX: Compute dynamically contract SafePermit { bytes32 private immutable INITIAL_DOMAIN_SEPARATOR; uint256 private immutable INITIAL_CHAIN_ID;

constructor() { INITIAL_CHAIN_ID = block.chainid; INITIAL_DOMAIN_SEPARATOR = computeDomainSeparator(); }

function DOMAIN_SEPARATOR() public view returns (bytes32) { if (block.chainid == INITIAL_CHAIN_ID) { return INITIAL_DOMAIN_SEPARATOR; // Gas optimization } return computeDomainSeparator(); // Recompute if chain changed }

function computeDomainSeparator() internal view returns (bytes32) { return keccak256(abi.encode( TYPE_HASH, keccak256(bytes(name())), keccak256(bytes("1")), block.chainid, // Current chain ID address(this) )); } }

References

• https://eips.ethereum.org/EIPS/eip-2612
• https://github.com/transmissions11/solmate/blob/main/src/tokens/ERC20.sol

Smart Contract Auditor - Validations

Potential Reentrancy via ETH Transfer

Id

check-reentrancy-eth-transfer

Description

External ETH transfers before state updates are reentrancy vectors

Pattern

call\{.value.\}.\n(?:(?!\b(balances|_balance|amount|withdrawn)\b.(-=|= 0|= false)).)*$

File Glob

*/.sol

Match

present

Message

CRITICAL: ETH transfer detected. Verify state is updated BEFORE external call (CEI pattern)

Severity

error

Autofix

External Call with Callback Risk

Id

check-reentrancy-callback

Description

Calls to untrusted addresses may trigger callbacks

Pattern

\.call\(|\.delegatecall\(|\.staticcall\(

File Glob

*/.sol

Match

present

Message

External call detected. Consider reentrancy guard and CEI pattern

Severity

warning

Autofix

Missing Reentrancy Guard

Id

check-nonreentrant-missing

Description

Functions with external calls should have reentrancy protection

Pattern

function.external.\{[^}]call\{.value

File Glob

*/.sol

Match

present

Context Pattern

nonReentrant|ReentrancyGuard

Context Match

absent

Message

External payable call without nonReentrant modifier

Severity

error

Autofix

Unprotected Selfdestruct

Id

check-selfdestruct-unprotected

Description

Selfdestruct without access control

Pattern

selfdestruct\(|SELFDESTRUCT

File Glob

*/.sol

Match

present

Context Pattern

onlyOwner|require.*msg\.sender|onlyRole

Context Match

absent

Message

CRITICAL: selfdestruct without access control

Severity

error

Autofix

Single-Step Ownership Transfer

Id

check-ownership-transfer

Description

Direct ownership transfers can lock out owner

Pattern

owner\s=\s\w+|_transferOwnership\(

File Glob

*/.sol

Match

present

Context Pattern

pendingOwner|acceptOwnership|Ownable2Step

Context Match

absent

Message

Consider two-step ownership transfer to prevent lockout

Severity

warning

Autofix

tx.origin Authentication

Id

check-tx-origin

Description

tx.origin for auth is vulnerable to phishing

Pattern

require.tx\.origin|tx\.origin\s==|==\s*tx\.origin

File Glob

*/.sol

Match

present

Message

CRITICAL: tx.origin for authentication is vulnerable to phishing attacks. Use msg.sender

Severity

error

Autofix

Unchecked ERC20 Transfer Return

Id

check-unchecked-transfer

Description

ERC20 transfer may fail silently

Pattern

IERC20.*\.transfer\(|token\.transfer\(

File Glob

*/.sol

Match

present

Context Pattern

require.*transfer|safeTransfer|SafeERC20

Context Match

absent

Message

ERC20 transfer without return value check. Use SafeERC20.safeTransfer

Severity

error

Autofix

Unchecked ERC20 TransferFrom Return

Id

check-unchecked-transferfrom

Description

ERC20 transferFrom may fail silently

Pattern

IERC20.*\.transferFrom\(|token\.transferFrom\(

File Glob

*/.sol

Match

present

Context Pattern

require.*transferFrom|safeTransferFrom|SafeERC20

Context Match

absent

Message

ERC20 transferFrom without return value check. Use SafeERC20.safeTransferFrom

Severity

error

Autofix

Unchecked ERC20 Approve

Id

check-unchecked-approve

Description

ERC20 approve may fail or behave unexpectedly

Pattern

IERC20.*\.approve\(|token\.approve\(

File Glob

*/.sol

Match

present

Context Pattern

safeApprove|forceApprove|SafeERC20

Context Match

absent

Message

ERC20 approve without SafeERC20. Some tokens require 0 approval first

Severity

warning

Autofix

Unchecked Low-Level Call

Id

check-low-level-call-return

Description

Low-level call return value must be checked

Pattern

\.(call|delegatecall|staticcall)\([^)]\);\s$

File Glob

*/.sol

Match

present

Message

Low-level call without return value check

Severity

error

Autofix

Missing Oracle Freshness Check

Id

check-oracle-stale-price

Description

Oracle prices should be validated for freshness

Pattern

latestRoundData\(\)|latestAnswer\(\)

File Glob

*/.sol

Match

present

Context Pattern

updatedAt|timestamp|stale|freshness

Context Match

absent

Message

Oracle used without freshness check. Stale prices can cause losses

Severity

warning

Autofix

Spot Price Manipulation Risk

Id

check-spot-price-usage

Description

Spot prices from AMMs are manipulable via flash loans

Pattern

getReserves\(\)|slot0\(\)|price0CumulativeLast|getCurrentPrice

File Glob

*/.sol

Match

present

Context Pattern

TWAP|twap|cumulative|observe

Context Match

absent

Message

Spot price usage detected. Consider TWAP to prevent flash loan manipulation

Severity

warning

Autofix

Missing Oracle Price Validation

Id

check-oracle-price-validation

Description

Oracle prices should have sanity bounds

Pattern

latestRoundData|getPrice|fetchPrice

File Glob

*/.sol

Match

present

Context Pattern

require.price.>|price.>.0|MIN_PRICE|MAX_PRICE

Context Match

absent

Message

Oracle price without sanity validation. Check for zero/negative/extreme values

Severity

warning

Autofix

Unchecked Arithmetic with User Input

Id

check-unchecked-user-input

Description

User-controlled values in unchecked blocks can overflow

Pattern

unchecked\s\{[^}]\+[^}]*\}

File Glob

*/.sol

Match

present

Message

Verify unchecked arithmetic uses only bounded/validated values

Severity

warning

Autofix

Unsafe Integer Downcast

Id

check-unsafe-downcast

Description

Casting to smaller types can silently truncate

Pattern

uint(8|16|32|64|128)\s\([^)]+\)|int(8|16|32|64|128)\s\([^)]+\)

File Glob

*/.sol

Match

present

Message

Integer downcast detected. Verify value fits in target type

Severity

warning

Autofix

Unchecked ecrecover Result

Id

check-ecrecover-zero

Description

ecrecover returns zero on invalid signature

Pattern

ecrecover\(

File Glob

*/.sol

Match

present

Context Pattern

!=\saddress\(0\)|recovered.!=.0|signer.!=.*address\(0\)

Context Match

absent

Message

ecrecover without zero address check. Invalid signatures return address(0)

Severity

error

Autofix

Missing Nonce in Signature

Id

check-signature-replay

Description

Signatures without nonces can be replayed

Pattern

ecrecover|ECDSA\.recover|SignatureChecker

File Glob

*/.sol

Match

present

Context Pattern

nonce|Nonce|NONCE

Context Match

absent

Message

Signature verification without nonce. Vulnerable to replay attacks

Severity

warning

Autofix

Missing Chain ID in Signature

Id

check-signature-chain-id

Description

Signatures should include chain ID for cross-chain safety

Pattern

DOMAIN_SEPARATOR|EIP712

File Glob

*/.sol

Match

present

Context Pattern

chainid|chainId|block\.chainid

Context Match

absent

Message

Domain separator without chain ID. Signatures may replay on forks

Severity

warning

Autofix

Swap Without Slippage Protection

Id

check-swap-no-slippage

Description

Swaps without minimum output are sandwich targets

Pattern

swap.0,|amountOutMin.=.0|minAmountOut.0

File Glob

*/.sol

Match

present

Message

Swap with zero slippage protection. Will be sandwiched by MEV bots

Severity

error

Autofix

Swap Without Deadline

Id

check-swap-no-deadline

Description

Swaps without deadline can be held by validators

Pattern

swap|trade|exchange

File Glob

*/.sol

Match

present

Context Pattern

deadline|block\.timestamp|expires

Context Match

absent

Message

Swap without deadline parameter. Transaction can be delayed indefinitely

Severity

warning

Autofix

Unbounded Loop Over Array

Id

check-unbounded-loop

Description

Loops over dynamic arrays can exceed gas limit

Pattern

for.<.\.length|while.*\.length

File Glob

*/.sol

Match

present

Message

Loop over dynamic array. Ensure bounded or use pagination

Severity

warning

Autofix

Unbounded Array Push

Id

check-push-unbounded

Description

Unlimited array growth leads to DoS

Pattern

\.push\(

File Glob

*/.sol

Match

present

Context Pattern

MAX_|maxLength|require.length.<

Context Match

absent

Message

Array push without length limit. Can grow unbounded causing DoS

Severity

warning

Autofix

External Call in Loop

Id

check-external-call-in-loop

Description

External calls in loops allow griefing

Pattern

for.\{[^}](\.call|\.transfer|\.send|transfer\(|safeTransfer)

File Glob

*/.sol

Match

present

Message

External call inside loop. Single failure blocks all. Use pull pattern

Severity

warning

Autofix

Delegatecall to Non-Constant Address

Id

check-delegatecall-untrusted

Description

Delegatecall to variable address risks storage collision

Pattern

delegatecall\(

File Glob

*/.sol

Match

present

Message

Delegatecall detected. Verify target is trusted and storage compatible

Severity

warning

Autofix

Missing Initializer Modifier

Id

check-initializer-missing

Description

Initializer functions can be called multiple times

Pattern

function\s+initialize\s*\(

File Glob

*/.sol

Match

present

Context Pattern

initializer|initialized|Initializable

Context Match

absent

Message

Initialize function without initializer modifier. Can be called multiple times

Severity

error

Autofix

Constructor in Upgradeable Contract

Id

check-constructor-in-proxy

Description

Constructors don't run in proxy context

Pattern

constructor\s*\(

File Glob

*/Upgradeable*.sol

Match

present

Message

Constructor in upgradeable contract. State set here won't exist in proxy

Severity

warning

Autofix

Floating Pragma Version

Id

check-floating-pragma

Description

Contracts should lock pragma for consistent compilation

Pattern

pragma solidity \^|pragma solidity >=|pragma solidity >=

File Glob

*/.sol

Match

present

Message

Floating pragma. Lock to specific version for production

Severity

info

Autofix

Magic Numbers in Code

Id

check-magic-numbers

Description

Unexplained numbers make auditing harder

Pattern

\b(1000|10000|100000|86400|3600|1e18|1e6)\b

File Glob

*/.sol

Match

present

Context Pattern

constant|CONSTANT|//.*

Context Match

absent

Message

Magic number detected. Consider using named constants

Severity

info

Autofix

Assembly Block Detected

Id

check-assembly-present

Description

Assembly requires careful security review

Pattern

assembly\s*\{

File Glob

*/.sol

Match

present

Message

Assembly block requires thorough security review

Severity

info

Autofix

Inline Yul Code

Id

check-inline-yul

Description

Yul bypasses Solidity safety features

Pattern

assembly.\{[^}]sload|assembly.\{[^}]sstore|assembly.\{[^}]mstore

File Glob

*/.sol

Match

present

Message

Direct storage/memory manipulation in assembly. Extra scrutiny needed

Severity

warning

Autofix

ERC20 Approve Race Condition

Id

check-approve-race

Description

approve() has known race condition

Pattern

\.approve\([^,]+,\s*[^0)]

File Glob

*/.sol

Match

present

Context Pattern

increaseAllowance|safeIncreaseAllowance|forceApprove

Context Match

absent

Message

Direct approve() has race condition. Consider increaseAllowance or set to 0 first

Severity

info

Autofix

Missing Permit Support

Id

check-permit-support

Description

Modern tokens should support gasless approvals

Pattern

ERC20|IERC20

File Glob

*/.sol

Match

present

Context Pattern

permit|ERC20Permit|IERC2612

Context Match

absent

Message

Consider ERC20Permit for gasless approvals

Severity

info

Autofix