{"analyzer_versions":{"semgrep":"1.163.0"},"body":{"audit_stages":[{"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Normalize the submitted contract target and confirm it can enter the Solidity audit lane.","elapsed_ms":320,"id":"intake","label":"Audit intake","limitations":[],"next_step":"Acquire verified source or scan the pasted Solidity source.","order":1,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Resolve pasted source or verified explorer source without treating malformed input as demo data.","elapsed_ms":1450,"id":"source_acquisition","label":"Source acquisition","limitations":[],"next_step":"Validate the analyzer toolchain against the acquired source.","order":2,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Confirm the configured static analyzers can run and produce parseable output.","elapsed_ms":2300,"id":"toolchain_validation","label":"Toolchain validation","limitations":[],"next_step":"Run static analysis and capture raw detector evidence.","order":3,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Run static analyzers against the sandboxed source and collect raw detector evidence.","elapsed_ms":8800,"findings_count":3,"id":"static_analysis","label":"Static analysis","limitations":[],"next_step":"Normalize detector output into one deduped finding set.","order":4,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Dedupe detectors, classify vulnerability classes and compute severity-weighted risk.","elapsed_ms":1150,"findings_count":3,"id":"finding_normalization","label":"Finding normalization","limitations":[],"next_step":"Review exploitability conservatively against confidence and limitations.","order":5,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Frame automated findings with conservative exploitability and limitation notes.","elapsed_ms":1900,"findings_count":3,"id":"exploitability_review","label":"Exploitability review","limitations":["Automated exploitability review is conservative and does not replace a manual exploitability assessment."],"next_step":"Draft remediation notes from the normalized evidence.","order":6,"status":"partial"},{"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Prepare remediation-oriented evidence for the shareable report artifact.","elapsed_ms":1500,"findings_count":3,"id":"remediation_draft","label":"Remediation draft","limitations":["Remediation notes are generated from detector evidence and require project-specific engineering review."],"next_step":"Attach an operator review artifact before claiming human review.","order":7,"status":"partial"},{"blockers":["No operator review artifact is attached to this automated scan."],"completed_at":"2026-09-23T23:25:55.482Z","description":"Record whether a human operator artifact exists before buyer escalation.","elapsed_ms":0,"id":"operator_review","label":"Operator review","limitations":["Human operator review has not been attached to this automated scan yet."],"next_step":"Attach a real operator review artifact before claiming human review.","order":8,"status":"blocked"},{"artifact":{"created_at":"2026-09-23T23:25:55.482Z","id":"solidity-2f746d702f766567","label":"Automated Solidity report","type":"report"},"blockers":[],"completed_at":"2026-09-23T23:25:55.482Z","description":"Publish the automated report artifact or explain why the scan failed closed.","elapsed_ms":620,"findings_count":3,"id":"finalization","label":"Finalization","limitations":["Final report is an automated static-analysis artifact; no operator review artifact is attached."],"next_step":"Share the report with explicit limitations and review state.","order":9,"status":"partial"}],"counts":{"access-control":0,"centralization":0,"flash-loan":0,"front-running":0,"gas-dos":0,"logic":1,"math-overflow":0,"oracle-manipulation":0,"other":0,"reentrancy":0,"timestamp-dependence":0,"unchecked-call":2,"uninitialized":0},"executive_summary":["3 findings surfaced (0 critical, 0 high, 1 medium, 0 low, 2 informational).","No critical or high severity findings; medium and low signals still require operator review before public promotion.","Automated static analysis only. A human operator review has not been attached to this report."],"findings":[{"class":"unchecked-call","confidence":"unknown","description":"Low-level .call to an externally-controlled target. Combined with reentrancy or unchecked return values, this is a common fund-draining pattern.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"Contract.sol","id":"5ac1955699e65118145beeb78cde5fbc713eb89ca2d44f1d8960b1e8aa0ea21c","line":3,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-low-level-call-untrusted"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"semgrep:vegasec-low-level-call-untrusted","severity":"medium","source":"semgrep","title":"Low-level .call to an externally-controlled target"},{"class":"logic","component":"^0.8.20","confidence":"high","description":"Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)\n\t- VerbatimInvalidDeduplication\n\t- FullInlinerNonExpressionSplitArgumentEvaluationOrder\n\t- MissingSideEffectsOnSelectorAccess.\nIt is used by:\n\t- ^0.8.20 (Contract.sol#2)\n","exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"Contract.sol","id":"a0b8b57f491b4bb446883d75324043b2a57132c2f2712fa94d0f001ad513bfb8","line":2,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#solc-version"],"remediation":"Re-derive the business rule by hand, write a property-based test that fails on the current path, and only then fix the implementation.","rule_id":"slither:solc-version","severity":"informational","source":"slither","title":"Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)"},{"class":"unchecked-call","component":"w","confidence":"high","description":"Low level call in V.w(uint256) (Contract.sol#3):\n\t- (ok,None) = msg.sender.call{value: a}() (Contract.sol#3)\n","exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"Contract.sol","id":"5b65a00fb544a46240245bf0612fc1870fcd750fde3e0a0cc33425a427aedda6","line":3,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#low-level-calls"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"slither:low-level-calls","severity":"informational","source":"slither","title":"Low level call in V.w(uint256) (Contract.sol#3):"}],"limitations":["VegaSec runs static analysis only. Findings can include false positives, miss patterns the configured detectors do not cover, and never replace manual auditor judgement.","Scan ran slither and semgrep against a single sandboxed copy of the source. Multi-file dependency analysis beyond what slither resolves automatically is out of scope.","This report is not a certification, audit attestation, or financial advice."],"warnings":[]},"canonical_version":"vss-canonical-1","coverage_status":"complete","final_score":95,"findings_count":3,"generated_at":"2026-09-23T23:25:55.482Z","id":"VSS-20260923-05VM4SPL","severity_counts":{"critical":0,"high":0,"informational":2,"low":0,"medium":1},"source_filename":"Contract.sol","source_hash":"81e07aadb40064d09e048798798c025e404874a391e0c9d8a16c7c90da7a9a4e","surface":"solidity","warnings_count":0}