C.sol

VSS-20260527-9P9JDOX8 · generated May 27, 2026, 3:10 AM

Trust score

Run another scan Request Private Review (report id only)

Partial coverage · watch0 findingsPartial analyzer coverageUnknown provenance2 warnings

Verdict is derived from severity counts via the same deterministic formula every VegaSec report uses. C.sol was scanned from unknown provenance. This is static-analysis triage, not a certification or formal audit attestation.

Partial coverage, not a clean-surface verdict. At least one required analyzer (slither, semgrep) did not complete this scan, so the score is capped at 50/100 and the verdict above can never be Strong/Clear surface. Cause: slither: spawn slither ENOENT (+1 more coverage note).

Signature

unsigned

This report has no signature. It was persisted before report signing shipped, so nobody can prove authorship for it, including us. The bytes can still be hashed to check that they did not change.

Verify this report Get the signed bytes Published keys

PDF artifact

Queued artifact pipeline · not blocking on the scan

Not requested

No PDF artifact has been requested for this report yet. The HTML report and the Markdown export already carry the full disclaimer and limitations inline. PDF synthesis is a queued artifact, not part of the scan path.

Status endpoint

GET /report/solidity/VSS-20260527-9P9JDOX8/export.pdf

Solidity evidence report

0 audit findings

Warnings (2)

· slither: spawn slither ENOENT
· semgrep: spawn semgrep ENOENT

No findings were flagged by slither or semgrep. This does not prove low risk, only that the configured detectors did not match.

Exploit reasoning

No high-confidence exploit narratives

The analyzers did not produce findings at critical, high, or medium severity that map to a deterministic exploit narrative. This does not mean the contract is free of bugs; it means this scan path did not produce evidence strong enough to publish a narrative without operator review.

How to read this report

Score, confidence, ranking: four moving parts, no hand-tuning.

Generated May 27, 2026, 3:10 AM · Solidity · C.sol

Score bands

0-19
AVOID-style triage
Multiple high or critical findings, low source confidence, or unverified context. Public action should pause until a Private Review or a re-scan with better evidence.
20-49
High caution
Notable findings or thin evidence. Worth a Private Review before relying on the artifact.
50-69
Watch · this report
Mixed signals: some evidence, some gaps. Re-scan after material changes to the target.
70-89
Clear surface (automated)
No critical or high findings via static analysis. Not a safety claim: human review is still recommended for diligence work.
90-100
Strong surface (automated)
No critical or high findings, verified source, and high source confidence. Not a safety claim: human review is still recommended for diligence work.

Score: Deterministic 0-100 derived from severity counts. Same formula across every report. Lower means more risk.
Confidence: Separate axis. Measures how much VegaSec trusts the input data. Low confidence pushes the verdict toward UNKNOWN; the two are never collapsed into one number.
Ranking / percentile: Only meaningful within the eligible Trust Index set. Shown on /trust-index when the eligible pool is large enough. Today the public index is a controlled preview.

Private Review is separate

A paid Private Review does not raise the public score on this report. Public score reflects public-source evidence only. Private Review adds operator attestation and a confidential memo, never a score bump.

Export and share

· Shareable public URL: copy from the report actions panel.
· Markdown export: every export carries the report id, target, verdict, generated timestamp, and the public-data disclaimer.
· PDF export: not in this MVP. Tracked as a follow-up. The Markdown export contains the same content and prints cleanly to PDF from a browser today.

Source provenance

This report scanned a Solidity source provided directly by the submitter (paste). No on-chain address is associated.

Scanned source (42 chars)

contract C { function f() public pure {} }

Public-data disclaimer

Solidity scans are triage based on slither + semgrep static analysis. Output is not a certification, audit attestation or financial advice. Findings can include false positives and may miss patterns the configured detectors do not cover.