SAMPLE
Web version
About this sample. Illustrative sample. The repository, commit, findings and numbers below are invented to show the report format. They are not the output of a real run. Tools are listed with their real upstream pins; findings, repository and numbers are invented.
Summary
Critical0
High2
Medium3
Low3
All findings. Agreement counts tools; all three run on one model family.| ID | Title | Severity | Evidence | Agreement | Status |
|---|
| F-1 | Share price manipulation via a direct donation to the vault src/Vault.sol:214 | High | poc-pass-fork | 2 of 3 tools | confirmed |
|---|
| F-2 | Stale oracle price is not checked src/oracle/PriceOracle.sol:77 | High | static-confirmed | 3 of 3 tools | confirmed |
|---|
| F-3 | No slippage limit when exiting the strategy src/strategies/AaveStrategy.sol:131 | Medium | not-verified | 1 of 3 tools | lead |
|---|
| F-4 | Admin can replace the strategy without a timelock src/Vault.sol:402 | Medium | not-verified | 2 of 3 tools | reported |
|---|
| F-5 | Rounding down on withdrawal leaves dust src/Vault.sol:288 | Medium | not-verified | 1 of 3 tools | lead |
|---|
| F-6 | No event when the fee changes src/VaultFactory.sol:66 | Low | static-confirmed | 3 of 3 tools | confirmed |
|---|
| F-7 | Unused variable src/libraries/Math.sol:12 | Low | static-confirmed | 1 of 3 tools | confirmed |
|---|
| F-8 | Pin the pragma to a fixed version src/Vault.sol:2 | Low | static-confirmed | 3 of 3 tools | confirmed |
|---|
Method and tools
| Tool | Pinned commit | License | Model family | Status |
|---|
| solidity-auditor v3 | c9ce8cf7300385eb0f02e15b3749059e4e8f6ec5 | MIT Copyright (c) 2024 AI Skills Contributors | Anthropic Claude | completed (sample) |
|---|
| krait v8.2 | 76e5ac7b74ce5517409870c2974e6baaddc8f99e | MIT Copyright (c) 2025-2026 Zealynx Security | Anthropic Claude | completed (sample) |
|---|
| plamen 2.2.4 | 795962b96e254f2e423a2635fe7f8cb8ea1e6d69 | MIT (root) Copyright (c) 2025-2026 Plamen Contributors | Anthropic Claude | partial: timed out on 1 file (sample) |
|---|
Scope and coverage
| File | nSLOC | Coverage |
|---|
| src/Vault.sol | 612 | read by 3 of 3 tools |
|---|
| src/VaultFactory.sol | 148 | read by 3 of 3 tools |
|---|
| src/strategies/AaveStrategy.sol | 301 | read by 3 of 3 tools |
|---|
| src/oracle/PriceOracle.sol | 205 | read by 2 of 3 tools; plamen timed out |
|---|
Excluded from scope
- src/libraries/Math.sol (96 nSLOC): possible vendored copy, excluded by the customer
- src/interfaces/IVault.sol (44), test/Vault.t.sol (480), script/Deploy.s.sol (72): interfaces, tests and scripts
- lib/openzeppelin-contracts (5,400): external dependency
Findings in detail
F-1 Share price manipulation via a direct donation to the vault
High · Likelihood: Medium. Impact: High.
Found by: solidity-auditor v3, krait v8.2 (2 of 3 tools, 1 model family)
Evidence: poc-pass-fork: a proof of concept ran on a fork and passed (sample).
convertToShares divides by a total that includes assets sent straight to the vault. Sending assets directly raises the share price before the next user deposits.
Attack path: 1) Attacker deposits 1 wei. 2) Attacker donates X assets directly. 3) A victim who deposits less than X receives 0 shares.
function convertToShares(uint256 assets) public view returns (uint256) {
uint256 supply = totalSupply();
return supply == 0 ? assets : assets * supply / totalAssets();
}
Hypothesis, verify it: use virtual shares and assets (an offset) or track total assets internally instead of reading the token balance.
F-2 Stale oracle price is not checked
High · Likelihood: Medium. Impact: High.
Found by: solidity-auditor v3, krait v8.2, plamen 2.2.4 (3 of 3 tools, 1 model family)
Evidence: static-confirmed: a static check backs the finding (sample).
latestRoundData() is read without checking updatedAt. If the feed stops, the vault keeps using the old price.
Attack path: Feed halts, the price goes stale, withdrawals use a wrong price.
(, int256 price,,,) = feed.latestRoundData();
return uint256(price);
Hypothesis, verify it: check updatedAt and answeredInRound, and cap the allowed age.
F-3 No slippage limit when exiting the strategy
Medium · Likelihood: Low. Impact: Medium.
Found by: solidity-auditor v3 (1 of 3 tools)
Evidence: not-verified: no independent check. Listed as a lead because one tool reported it.
withdraw() accepts any amount returned by the pool.
Attack path: Sandwich attack on a withdrawal.
pool.withdraw(asset, amount, address(this));
Hypothesis, verify it: add a minimum-out parameter and verify the received amount.
Discarded findings
| ID | Title | Reason | Raised by |
|---|
| D-1 | Reentrancy in deposit() | likely_false: a nonReentrant guard is present. Reviewer: different model. | solidity-auditor v3 |
|---|
| D-2 | Overflow in Math.mulDiv | likely_false: Solidity 0.8 has checked arithmetic. | krait v8.2 |
|---|
| D-3 | tx.origin in the factory | needs_human: it is not used for authorization. | solidity-auditor v3 |
|---|
What was not checked
- Off-chain components, keys and key management
- Front end and infrastructure
- Economic model and parameter choices
- Dependency updates after the audited commit
- Integrations beyond the files in scope, and token behavior not listed in the scope
Disclaimer
- This report is not a guarantee of security. It is limited in time and in resources and does not replace a human audit.
- Zero findings does not prove the absence of vulnerabilities.
- AI tools are not deterministic: a repeat run can return a different set of findings.
- Agreement between tools is not confirmation. Tools built on one model can make the same mistake. We call a finding confirmed only with a passing proof of concept or a static check.
- The report applies to the stated commit. Later changes are not covered.
- Recommendations were not tested unless stated.
- Third-party tools are listed for transparency. Names belong to their owners and do not imply endorsement or affiliation.
- This is not legal or investment advice.