{"analyzer_versions":{"semgrep":"1.163.0"},"body":{"audit_stages":[{"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Normalize the submitted contract target and confirm it can enter the Solidity audit lane.","elapsed_ms":320,"id":"intake","label":"Audit intake","limitations":[],"next_step":"Acquire verified source or scan the pasted Solidity source.","order":1,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Resolve pasted source or verified explorer source without treating malformed input as demo data.","elapsed_ms":1450,"id":"source_acquisition","label":"Source acquisition","limitations":[],"next_step":"Validate the analyzer toolchain against the acquired source.","order":2,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Confirm the configured static analyzers can run and produce parseable output.","elapsed_ms":2300,"id":"toolchain_validation","label":"Toolchain validation","limitations":[],"next_step":"Run static analysis and capture raw detector evidence.","order":3,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Run static analyzers against the sandboxed source and collect raw detector evidence.","elapsed_ms":8800,"findings_count":4,"id":"static_analysis","label":"Static analysis","limitations":[],"next_step":"Normalize detector output into one deduped finding set.","order":4,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Dedupe detectors, classify vulnerability classes and compute severity-weighted risk.","elapsed_ms":1150,"findings_count":4,"id":"finding_normalization","label":"Finding normalization","limitations":[],"next_step":"Review exploitability conservatively against confidence and limitations.","order":5,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Frame automated findings with conservative exploitability and limitation notes.","elapsed_ms":1900,"findings_count":4,"id":"exploitability_review","label":"Exploitability review","limitations":["Automated exploitability review is conservative and does not replace a manual exploitability assessment."],"next_step":"Draft remediation notes from the normalized evidence.","order":6,"status":"partial"},{"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Prepare remediation-oriented evidence for the shareable report artifact.","elapsed_ms":1500,"findings_count":4,"id":"remediation_draft","label":"Remediation draft","limitations":["Remediation notes are generated from detector evidence and require project-specific engineering review."],"next_step":"Attach an operator review artifact before claiming human review.","order":7,"status":"partial"},{"blockers":["No operator review artifact is attached to this automated scan."],"completed_at":"2026-09-24T05:21:58.757Z","description":"Record whether a human operator artifact exists before buyer escalation.","elapsed_ms":0,"id":"operator_review","label":"Operator review","limitations":["Human operator review has not been attached to this automated scan yet."],"next_step":"Attach a real operator review artifact before claiming human review.","order":8,"status":"blocked"},{"artifact":{"created_at":"2026-09-24T05:21:58.757Z","id":"solidity-2f746d702f766567","label":"Automated Solidity report","type":"report"},"blockers":[],"completed_at":"2026-09-24T05:21:58.757Z","description":"Publish the automated report artifact or explain why the scan failed closed.","elapsed_ms":620,"findings_count":4,"id":"finalization","label":"Finalization","limitations":["Final report is an automated static-analysis artifact; no operator review artifact is attached."],"next_step":"Share the report with explicit limitations and review state.","order":9,"status":"partial"}],"counts":{"access-control":0,"centralization":0,"flash-loan":0,"front-running":0,"gas-dos":0,"logic":1,"math-overflow":0,"oracle-manipulation":0,"other":0,"reentrancy":1,"timestamp-dependence":0,"unchecked-call":2,"uninitialized":0},"executive_summary":["4 findings surfaced (0 critical, 1 high, 1 medium, 0 low, 2 informational).","HIGH · Reentrancy in DelistProbe.withdraw(uint256) (DelistProbe.sol#7-12): (withdraw) — exploitability medium.","Automated static analysis only. A human operator review has not been attached to this report."],"findings":[{"class":"reentrancy","component":"withdraw","confidence":"medium","description":"Reentrancy in DelistProbe.withdraw(uint256) (DelistProbe.sol#7-12):\n\tExternal calls:\n\t- (ok,None) = msg.sender.call{value: amount}() (DelistProbe.sol#9)\n\tState variables written after the call(s):\n\t- balances[msg.sender] -= amount (DelistProbe.sol#11)\n\tDelistProbe.balances (DelistProbe.sol#5) can be used in cross function reentrancies:\n\t- DelistProbe.balances (DelistProbe.sol#5)\n\t- DelistProbe.withdraw(uint256) (DelistProbe.sol#7-12)\n","end_line":12,"exploitability":"medium","exploitability_note":"Medium-confidence detection; manual review required before relying on the finding either way.","file":"DelistProbe.sol","id":"07efb7e77a9acd0ec226e47c4c627b30bb80901625d95ab3fc345b4574e8fcbe","line":7,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#reentrancy-eth"],"remediation":"Apply the checks-effects-interactions pattern. State writes must happen before external calls, and consider OpenZeppelin's ReentrancyGuard for high-risk entry points.","rule_id":"slither:reentrancy-eth","severity":"high","source":"slither","title":"Reentrancy in DelistProbe.withdraw(uint256) (DelistProbe.sol#7-12):"},{"class":"unchecked-call","confidence":"unknown","description":"Low-level .call to an externally-controlled target. Combined with reentrancy or unchecked return values, this is a common fund-draining pattern.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"DelistProbe.sol","id":"e617977e9e9a8d5512e29f76b8130ac0352c0075c3360fc193ac4e616a0a6ff6","line":9,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-low-level-call-untrusted"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"semgrep:vegasec-low-level-call-untrusted","severity":"medium","source":"semgrep","title":"Low-level .call to an externally-controlled target"},{"class":"logic","component":"0.8.19","confidence":"high","description":"Version constraint 0.8.19 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)\n\t- VerbatimInvalidDeduplication\n\t- FullInlinerNonExpressionSplitArgumentEvaluationOrder\n\t- MissingSideEffectsOnSelectorAccess.\nIt is used by:\n\t- 0.8.19 (DelistProbe.sol#2)\n","exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"DelistProbe.sol","id":"76d7f650ff5d3a89d5950976b890f8a5f8e0035b54671c1a5e66ea23df20dd37","line":2,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#solc-version"],"remediation":"Re-derive the business rule by hand, write a property-based test that fails on the current path, and only then fix the implementation.","rule_id":"slither:solc-version","severity":"informational","source":"slither","title":"Version constraint 0.8.19 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)"},{"class":"unchecked-call","component":"withdraw","confidence":"high","description":"Low level call in DelistProbe.withdraw(uint256) (DelistProbe.sol#7-12):\n\t- (ok,None) = msg.sender.call{value: amount}() (DelistProbe.sol#9)\n","end_line":12,"exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"DelistProbe.sol","id":"d69aea3a373dc5e82e5d3dab096f321da2c9b6a70f8469399a679ec4f53e81af","line":7,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#low-level-calls"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"slither:low-level-calls","severity":"informational","source":"slither","title":"Low level call in DelistProbe.withdraw(uint256) (DelistProbe.sol#7-12):"}],"limitations":["VegaSec runs static analysis only. Findings can include false positives, miss patterns the configured detectors do not cover, and never replace manual auditor judgement.","Scan ran slither and semgrep against a single sandboxed copy of the source. Multi-file dependency analysis beyond what slither resolves automatically is out of scope.","This report is not a certification, audit attestation, or financial advice."],"warnings":[]},"canonical_version":"vss-canonical-1","coverage_status":"complete","final_score":85,"findings_count":4,"generated_at":"2026-09-24T05:21:58.757Z","id":"VSS-20260924-4S2F9M2D","severity_counts":{"critical":0,"high":1,"informational":2,"low":0,"medium":1},"source_filename":"DelistProbe.sol","source_hash":"d82db18ca1357817dee0ef484bb9dcc3eb7aff47db27707e5d36774f220037be","surface":"solidity","warnings_count":0}