{"analyzer_versions":{"semgrep":"1.163.0"},"body":{"audit_stages":[{"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Normalize the submitted contract target and confirm it can enter the Solidity audit lane.","elapsed_ms":320,"id":"intake","label":"Audit intake","limitations":[],"next_step":"Acquire verified source or scan the pasted Solidity source.","order":1,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Resolve pasted source or verified explorer source without treating malformed input as demo data.","elapsed_ms":1450,"id":"source_acquisition","label":"Source acquisition","limitations":[],"next_step":"Validate the analyzer toolchain against the acquired source.","order":2,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Confirm the configured static analyzers can run and produce parseable output.","elapsed_ms":2300,"id":"toolchain_validation","label":"Toolchain validation","limitations":["One or more analyzers emitted warnings; report findings remain usable but should be read with limitations."],"next_step":"Run static analysis and capture raw detector evidence.","order":3,"status":"partial"},{"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Run static analyzers against the sandboxed source and collect raw detector evidence.","elapsed_ms":8800,"findings_count":4,"id":"static_analysis","label":"Static analysis","limitations":["One or more analyzers emitted warnings; report findings remain usable but should be read with limitations."],"next_step":"Normalize detector output into one deduped finding set.","order":4,"status":"partial"},{"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Dedupe detectors, classify vulnerability classes and compute severity-weighted risk.","elapsed_ms":1150,"findings_count":4,"id":"finding_normalization","label":"Finding normalization","limitations":[],"next_step":"Review exploitability conservatively against confidence and limitations.","order":5,"status":"passed"},{"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Frame automated findings with conservative exploitability and limitation notes.","elapsed_ms":1900,"findings_count":4,"id":"exploitability_review","label":"Exploitability review","limitations":["Automated exploitability review is conservative and does not replace a manual exploitability assessment."],"next_step":"Draft remediation notes from the normalized evidence.","order":6,"status":"partial"},{"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Prepare remediation-oriented evidence for the shareable report artifact.","elapsed_ms":1500,"findings_count":4,"id":"remediation_draft","label":"Remediation draft","limitations":["Remediation notes are generated from detector evidence and require project-specific engineering review."],"next_step":"Attach an operator review artifact before claiming human review.","order":7,"status":"partial"},{"blockers":["No operator review artifact is attached to this automated scan."],"completed_at":"2026-09-23T14:22:58.531Z","description":"Record whether a human operator artifact exists before buyer escalation.","elapsed_ms":0,"id":"operator_review","label":"Operator review","limitations":["Human operator review has not been attached to this automated scan yet."],"next_step":"Attach a real operator review artifact before claiming human review.","order":8,"status":"blocked"},{"artifact":{"created_at":"2026-09-23T14:22:58.531Z","id":"solidity-2f746d702f766567","label":"Automated Solidity report","type":"report"},"blockers":[],"completed_at":"2026-09-23T14:22:58.531Z","description":"Publish the automated report artifact or explain why the scan failed closed.","elapsed_ms":620,"findings_count":4,"id":"finalization","label":"Finalization","limitations":["Final report is an automated static-analysis artifact; no operator review artifact is attached."],"next_step":"Share the report with explicit limitations and review state.","order":9,"status":"partial"}],"counts":{"access-control":0,"centralization":0,"flash-loan":0,"front-running":0,"gas-dos":0,"logic":1,"math-overflow":0,"oracle-manipulation":0,"other":1,"reentrancy":0,"timestamp-dependence":0,"unchecked-call":2,"uninitialized":0},"executive_summary":["4 findings surfaced (0 critical, 0 high, 1 medium, 0 low, 3 informational).","No critical or high severity findings; medium and low signals still require operator review before public promotion.","Automated static analysis only. A human operator review has not been attached to this report."],"findings":[{"class":"unchecked-call","confidence":"unknown","description":"Low-level .call to an externally-controlled target. Combined with reentrancy or unchecked return values, this is a common fund-draining pattern.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"clean.sol","id":"ef8f5683d7cd6b67fe504e7782795517878c6b18d6fbf549ba2b228c070b329e","line":21,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-low-level-call-untrusted"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"semgrep:vegasec-low-level-call-untrusted","severity":"medium","source":"semgrep","title":"Low-level .call to an externally-controlled target"},{"class":"logic","component":"0.8.19","confidence":"high","description":"Version constraint 0.8.19 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)\n\t- VerbatimInvalidDeduplication\n\t- FullInlinerNonExpressionSplitArgumentEvaluationOrder\n\t- MissingSideEffectsOnSelectorAccess.\nIt is used by:\n\t- 0.8.19 (clean.sol#1)\n","exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"clean.sol","id":"4fa2c34abd10207de8f0b562c35e7a63121ffaadb0d1f08af6c3588ac380e282","line":1,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#solc-version"],"remediation":"Re-derive the business rule by hand, write a property-based test that fails on the current path, and only then fix the implementation.","rule_id":"slither:solc-version","severity":"informational","source":"slither","title":"Version constraint 0.8.19 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)"},{"class":"other","component":"owner","confidence":"high","description":"CleanVault.owner (clean.sol#8) should be immutable \n","exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"clean.sol","id":"307a27078d1b2fe96d922ca8c8c2387906c47b2c1a271d7020a6b272f556c527","line":8,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#immutable-states"],"remediation":"Review the detector output against the source manually; if exploitable, design a fix and add a regression test before deploying.","rule_id":"slither:immutable-states","severity":"informational","source":"slither","title":"CleanVault.owner (clean.sol#8) should be immutable"},{"class":"unchecked-call","component":"withdraw","confidence":"high","description":"Low level call in CleanVault.withdraw(uint256) (clean.sol#18-23):\n\t- (ok,None) = msg.sender.call{value: amount}() (clean.sol#21)\n","end_line":23,"exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"clean.sol","id":"139b2e2beeba5d5b472227784105c3b4de493a81f7649f6d8f1eda322c57d417","line":18,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#low-level-calls"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"slither:low-level-calls","severity":"informational","source":"slither","title":"Low level call in CleanVault.withdraw(uint256) (clean.sol#18-23):"}],"limitations":["VegaSec runs static analysis only. Findings can include false positives, miss patterns the configured detectors do not cover, and never replace manual auditor judgement.","Scan ran slither and semgrep against a single sandboxed copy of the source. Multi-file dependency analysis beyond what slither resolves automatically is out of scope.","Some detectors emitted warnings (see `warnings`); their output was still ingested but should be read with extra care.","This report is not a certification, audit attestation, or financial advice."],"warnings":["Unmapped detector slither:immutable-states — classified as 'other'"]},"canonical_version":"vss-canonical-1","coverage_status":"complete","final_score":95,"findings_count":4,"generated_at":"2026-09-23T14:22:58.531Z","id":"VSS-20260923-G2S1GFNZ","severity_counts":{"critical":0,"high":0,"informational":3,"low":0,"medium":1},"source_filename":"clean.sol","source_hash":"119cfb64e701b84361f4ed6cbf45a23b4d8d511ac7cc7e42bd66facd1b0d1ace","surface":"solidity","warnings_count":1}