{"analyzer_versions":{"semgrep":"1.163.0"},"body":{"audit_stages":[{"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Normalize the submitted contract target and confirm it can enter the Solidity audit lane.","elapsed_ms":320,"id":"intake","label":"Audit intake","limitations":[],"next_step":"Acquire verified source or scan the pasted Solidity source.","order":1,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Resolve pasted source or verified explorer source without treating malformed input as demo data.","elapsed_ms":1450,"id":"source_acquisition","label":"Source acquisition","limitations":[],"next_step":"Validate the analyzer toolchain against the acquired source.","order":2,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Confirm the configured static analyzers can run and produce parseable output.","elapsed_ms":2300,"id":"toolchain_validation","label":"Toolchain validation","limitations":["One or more analyzers emitted warnings; report findings remain usable but should be read with limitations."],"next_step":"Run static analysis and capture raw detector evidence.","order":3,"status":"partial"},{"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Run static analyzers against the sandboxed source and collect raw detector evidence.","elapsed_ms":8800,"findings_count":14,"id":"static_analysis","label":"Static analysis","limitations":["One or more analyzers emitted warnings; report findings remain usable but should be read with limitations."],"next_step":"Normalize detector output into one deduped finding set.","order":4,"status":"partial"},{"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Dedupe detectors, classify vulnerability classes and compute severity-weighted risk.","elapsed_ms":1150,"findings_count":14,"id":"finding_normalization","label":"Finding normalization","limitations":[],"next_step":"Review exploitability conservatively against confidence and limitations.","order":5,"status":"passed"},{"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Frame automated findings with conservative exploitability and limitation notes.","elapsed_ms":1900,"findings_count":14,"id":"exploitability_review","label":"Exploitability review","limitations":["Automated exploitability review is conservative and does not replace a manual exploitability assessment."],"next_step":"Draft remediation notes from the normalized evidence.","order":6,"status":"partial"},{"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Prepare remediation-oriented evidence for the shareable report artifact.","elapsed_ms":1500,"findings_count":14,"id":"remediation_draft","label":"Remediation draft","limitations":["Remediation notes are generated from detector evidence and require project-specific engineering review."],"next_step":"Attach an operator review artifact before claiming human review.","order":7,"status":"partial"},{"blockers":["No operator review artifact is attached to this automated scan."],"completed_at":"2026-09-24T14:38:46.277Z","description":"Record whether a human operator artifact exists before buyer escalation.","elapsed_ms":0,"id":"operator_review","label":"Operator review","limitations":["Human operator review has not been attached to this automated scan yet."],"next_step":"Attach a real operator review artifact before claiming human review.","order":8,"status":"blocked"},{"artifact":{"created_at":"2026-09-24T14:38:46.277Z","id":"solidity-2f746d702f766567","label":"Automated Solidity report","type":"report"},"blockers":[],"completed_at":"2026-09-24T14:38:46.277Z","description":"Publish the automated report artifact or explain why the scan failed closed.","elapsed_ms":620,"findings_count":14,"id":"finalization","label":"Finalization","limitations":["Final report is an automated static-analysis artifact; no operator review artifact is attached."],"next_step":"Share the report with explicit limitations and review state.","order":9,"status":"partial"}],"counts":{"access-control":6,"centralization":1,"flash-loan":0,"front-running":0,"gas-dos":0,"logic":1,"math-overflow":0,"oracle-manipulation":1,"other":1,"reentrancy":1,"timestamp-dependence":1,"unchecked-call":2,"uninitialized":0},"executive_summary":["14 findings surfaced (1 critical, 3 high, 6 medium, 1 low, 3 informational).","CRITICAL · selfdestruct call — exploitability unknown.","HIGH · VegaTokenVulnerable.unsafeReviewerLottery(address[]) (VegaTokenVulnerable.sol#28-34) uses a weak PRNG: \"picked = reviewers[block.timestamp % reviewers.length] ( (unsafeReviewerLottery) — exploitability medium.","HIGH · Reentrancy in VegaTokenVulnerable.withdrawReviewCredit(uint256) (VegaTokenVulnerable.sol#36-42): (withdrawReviewCredit) — exploitability medium.","Automated static analysis only. A human operator review has not been attached to this report."],"findings":[{"class":"centralization","confidence":"unknown","description":"selfdestruct call. Even with access control, selfdestruct introduces upgrade risk and historical state loss. Audit access control carefully or remove.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"VegaTokenVulnerable.sol","id":"025d746d5dc01028d99ab6f083342b2f9b382eca5b913ce3121b6ef8656c9c07","line":47,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-selfdestruct"],"remediation":"Document the trust boundary, set up time-locked multisig ownership, and surface admin-only functions in the deployment runbook.","rule_id":"semgrep:vegasec-selfdestruct","severity":"critical","source":"semgrep","title":"selfdestruct call"},{"class":"oracle-manipulation","component":"unsafeReviewerLottery","confidence":"medium","description":"VegaTokenVulnerable.unsafeReviewerLottery(address[]) (VegaTokenVulnerable.sol#28-34) uses a weak PRNG: \"picked = reviewers[block.timestamp % reviewers.length] (VegaTokenVulnerable.sol#31)\" \n","end_line":34,"exploitability":"medium","exploitability_note":"Medium-confidence detection; manual review required before relying on the finding either way.","file":"VegaTokenVulnerable.sol","id":"9e9cc0e9cfc74f54891b411b93c7449f2e172aa1da0a998e8e7b976ae04def6b","line":28,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#weak-prng"],"remediation":"Use multi-source price feeds (e.g. Chainlink + TWAPs) and validate freshness/deviation before consuming oracle data on-chain.","rule_id":"slither:weak-prng","severity":"high","source":"slither","title":"VegaTokenVulnerable.unsafeReviewerLottery(address[]) (VegaTokenVulnerable.sol#28-34) uses a weak PRNG: \"picked = reviewers[block.timestamp % reviewers.length] ("},{"class":"reentrancy","component":"withdrawReviewCredit","confidence":"medium","description":"Reentrancy in VegaTokenVulnerable.withdrawReviewCredit(uint256) (VegaTokenVulnerable.sol#36-42):\n\tExternal calls:\n\t- (ok,None) = address(msg.sender).call{value: amount}() (VegaTokenVulnerable.sol#39)\n\tState variables written after the call(s):\n\t- balances[msg.sender] -= amount (VegaTokenVulnerable.sol#41)\n\tVegaTokenVulnerable.balances (VegaTokenVulnerable.sol#10) can be used in cross function reentrancies:\n\t- VegaTokenVulnerable.balances (VegaTokenVulnerable.sol#10)\n\t- VegaTokenVulnerable.constructor() (VegaTokenVulnerable.sol#15-18)\n\t- VegaTokenVulnerable.mintForReview(address,uint256) (VegaTokenVulnerable.sol#22-26)\n\t- VegaTokenVulnerable.withdrawReviewCredit(uint256) (VegaTokenVulnerable.sol#36-42)\n","end_line":42,"exploitability":"medium","exploitability_note":"Medium-confidence detection; manual review required before relying on the finding either way.","file":"VegaTokenVulnerable.sol","id":"e3c81b2bb05292a33bb195f5efdac2095dcb7378274eb86ee20c848b965cd13e","line":36,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#reentrancy-eth"],"remediation":"Apply the checks-effects-interactions pattern. State writes must happen before external calls, and consider OpenZeppelin's ReentrancyGuard for high-risk entry points.","rule_id":"slither:reentrancy-eth","severity":"high","source":"slither","title":"Reentrancy in VegaTokenVulnerable.withdrawReviewCredit(uint256) (VegaTokenVulnerable.sol#36-42):"},{"class":"access-control","component":"retireFixture","confidence":"high","description":"VegaTokenVulnerable.retireFixture() (VegaTokenVulnerable.sol#44-48) allows anyone to destruct the contract\n","end_line":48,"exploitability":"high","exploitability_note":"High-confidence detection of a severe pattern; treat as exploitable until disproven by manual review.","file":"VegaTokenVulnerable.sol","id":"7d9b78b620334b47ab494454ec49b378daf245c24264ec5ee94fd81ae25ca8a0","line":44,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#suicidal"],"remediation":"Gate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.","rule_id":"slither:suicidal","severity":"high","source":"slither","title":"VegaTokenVulnerable.retireFixture() (VegaTokenVulnerable.sol#44-48) allows anyone to destruct the contract"},{"class":"access-control","component":"mintForReview","confidence":"medium","description":"VegaTokenVulnerable.mintForReview(address,uint256) (VegaTokenVulnerable.sol#22-26) uses tx.origin for authorization: require(bool,string)(tx.origin == owner,origin owner only) (VegaTokenVulnerable.sol#24)\n","end_line":26,"exploitability":"medium","exploitability_note":"Medium-confidence detection; manual review required before relying on the finding either way.","file":"VegaTokenVulnerable.sol","id":"8d94c22f92bfff04d2cec20f538c96db7e75d788478a91bc7ffd1cceea98d7a0","line":22,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#tx-origin"],"remediation":"Gate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.","rule_id":"slither:tx-origin","severity":"medium","source":"slither","title":"VegaTokenVulnerable.mintForReview(address,uint256) (VegaTokenVulnerable.sol#22-26) uses tx.origin for authorization: require(bool,string)(tx.origin == owner,ori"},{"class":"access-control","confidence":"unknown","description":"Use of tx.origin for authorization. tx.origin can be tricked via phishing contracts. Prefer msg.sender.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"VegaTokenVulnerable.sol","id":"d3a46569a601f7bdcf08c52c1ce6a464f24ea0d6035d39fa18437b6c940bbc00","line":24,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-tx-origin-auth"],"remediation":"Gate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.","rule_id":"semgrep:vegasec-tx-origin-auth","severity":"medium","source":"semgrep","title":"Use of tx.origin for authorization"},{"class":"timestamp-dependence","confidence":"unknown","description":"block.timestamp used in a value computation. Miners can adjust block.timestamp within ~15s; do not use it for randomness or time-critical comparisons.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"VegaTokenVulnerable.sol","id":"4bf225cdc0c238c3ce62538e80d89916562e5eb0b7ed3c988eaf7bb73b29c755","line":31,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-block-timestamp-rng"],"remediation":"Treat block.timestamp as a coarse value with miner influence; prefer block-number windows for short-term invariants and add tolerance bands.","rule_id":"semgrep:vegasec-block-timestamp-rng","severity":"medium","source":"semgrep","title":"block.timestamp used in a value computation"},{"class":"unchecked-call","confidence":"unknown","description":"Low-level .call to an externally-controlled target. Combined with reentrancy or unchecked return values, this is a common fund-draining pattern.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"VegaTokenVulnerable.sol","id":"24612734790f3f6ca717a5032967841c609ae6046549b32eb41f771d29f905a2","line":39,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-low-level-call-untrusted"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"semgrep:vegasec-low-level-call-untrusted","severity":"medium","source":"semgrep","title":"Low-level .call to an externally-controlled target"},{"class":"access-control","component":"retireFixture","confidence":"medium","description":"VegaTokenVulnerable.retireFixture() (VegaTokenVulnerable.sol#44-48) uses tx.origin for authorization: require(bool,string)(tx.origin == owner,origin owner only) (VegaTokenVulnerable.sol#46)\n","end_line":48,"exploitability":"medium","exploitability_note":"Medium-confidence detection; manual review required before relying on the finding either way.","file":"VegaTokenVulnerable.sol","id":"b85d4c6b14a005cc536ebad1f32253f03512ff61c8e9c49a7cbf0952e914f482","line":44,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#tx-origin"],"remediation":"Gate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.","rule_id":"slither:tx-origin","severity":"medium","source":"slither","title":"VegaTokenVulnerable.retireFixture() (VegaTokenVulnerable.sol#44-48) uses tx.origin for authorization: require(bool,string)(tx.origin == owner,origin owner only)"},{"class":"access-control","confidence":"unknown","description":"Use of tx.origin for authorization. tx.origin can be tricked via phishing contracts. Prefer msg.sender.","exploitability":"unknown","exploitability_note":"Analyzer did not report a confidence level; treat as unverified until reviewed.","file":"VegaTokenVulnerable.sol","id":"2b383bb32009d69610ac628adccd9eee4b96f1e5449289991c5149e18497756b","line":46,"references":["https://github.com/JE4NVRG/vegasec/blob/main/apps/web/src/lib/risk/solidity/semgrep-rules/vegasec-solidity.yml#vegasec-tx-origin-auth"],"remediation":"Gate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.","rule_id":"semgrep:vegasec-tx-origin-auth","severity":"medium","source":"semgrep","title":"Use of tx.origin for authorization"},{"class":"access-control","component":"picked","confidence":"medium","description":"VegaTokenVulnerable.unsafeReviewerLottery(address[]).picked (VegaTokenVulnerable.sol#28) lacks a zero-check on :\n\t\t- reviewer = picked (VegaTokenVulnerable.sol#32)\n","exploitability":"medium","exploitability_note":"Medium-confidence detection; manual review required before relying on the finding either way.","file":"VegaTokenVulnerable.sol","id":"0e297411d10f1e4a0ee9692c268471424d3d570524701f41a065fe7ac3d700e9","line":28,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#missing-zero-check"],"remediation":"Gate privileged functions behind a tested role/ownership pattern (e.g. OpenZeppelin Ownable/AccessControl). Avoid tx.origin for authorization.","rule_id":"slither:missing-zero-check","severity":"low","source":"slither","title":"VegaTokenVulnerable.unsafeReviewerLottery(address[]).picked (VegaTokenVulnerable.sol#28) lacks a zero-check on :"},{"class":"logic","component":"^0.8.20","confidence":"high","description":"Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)\n\t- VerbatimInvalidDeduplication\n\t- FullInlinerNonExpressionSplitArgumentEvaluationOrder\n\t- MissingSideEffectsOnSelectorAccess.\nIt is used by:\n\t- ^0.8.20 (VegaTokenVulnerable.sol#2)\n","exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"VegaTokenVulnerable.sol","id":"5000022c8e54141e1f7c204b377ec3cddd18eb4f224def2ddcfff5238884b60b","line":2,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#solc-version"],"remediation":"Re-derive the business rule by hand, write a property-based test that fails on the current path, and only then fix the implementation.","rule_id":"slither:solc-version","severity":"informational","source":"slither","title":"Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)"},{"class":"other","component":"owner","confidence":"high","description":"VegaTokenVulnerable.owner (VegaTokenVulnerable.sol#11) should be immutable \n","exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"VegaTokenVulnerable.sol","id":"a2093d5f0250fce2f6c8bbc1c6c8c09b8ac4c01d16989600d7b91a130bb8aded","line":11,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#immutable-states"],"remediation":"Review the detector output against the source manually; if exploitable, design a fix and add a regression test before deploying.","rule_id":"slither:immutable-states","severity":"informational","source":"slither","title":"VegaTokenVulnerable.owner (VegaTokenVulnerable.sol#11) should be immutable"},{"class":"unchecked-call","component":"withdrawReviewCredit","confidence":"high","description":"Low level call in VegaTokenVulnerable.withdrawReviewCredit(uint256) (VegaTokenVulnerable.sol#36-42):\n\t- (ok,None) = address(msg.sender).call{value: amount}() (VegaTokenVulnerable.sol#39)\n","end_line":42,"exploitability":"low","exploitability_note":"Informational signal; not directly exploitable without additional context.","file":"VegaTokenVulnerable.sol","id":"c95e896eba0879481c44b2f622b6ae140a700984244981b4404ff41210f6c2d3","line":36,"references":["https://github.com/crytic/slither/wiki/Detector-Documentation#low-level-calls"],"remediation":"Check the boolean return of low-level call/delegatecall/send and revert on failure with a descriptive reason string.","rule_id":"slither:low-level-calls","severity":"informational","source":"slither","title":"Low level call in VegaTokenVulnerable.withdrawReviewCredit(uint256) (VegaTokenVulnerable.sol#36-42):"}],"limitations":["VegaSec runs static analysis only. Findings can include false positives, miss patterns the configured detectors do not cover, and never replace manual auditor judgement.","Scan ran slither and semgrep against a single sandboxed copy of the source. Multi-file dependency analysis beyond what slither resolves automatically is out of scope.","Some detectors emitted warnings (see `warnings`); their output was still ingested but should be read with extra care.","This report is not a certification, audit attestation, or financial advice."],"warnings":["Unmapped detector slither:immutable-states — classified as 'other'"]},"canonical_version":"vss-canonical-1","coverage_status":"complete","final_score":13,"findings_count":14,"generated_at":"2026-09-24T14:38:46.277Z","id":"VSS-20260924-YTDDH6CD","severity_counts":{"critical":1,"high":3,"informational":3,"low":1,"medium":6},"source_filename":"VegaTokenVulnerable.sol","source_hash":"7c077aa9881d546ff451f8dc90ce9225e1b0629ac64552c1b8bc8c0ed5c7f4f0","surface":"solidity","warnings_count":1}