partial-coverage-probe.sol

VSS-20260923-21NOQY2S · generated Sep 23, 2026, 3:31 PM

Trust score

Run another scan Request Private Review (report id only)

Partial coverage · watch0 findingsPartial analyzer coveragePasted source2 warningssemgrep 1.163.0

Verdict is derived from severity counts via the same deterministic formula every VegaSec report uses. partial-coverage-probe.sol was scanned from pasted source. This is static-analysis triage, not a certification or formal audit attestation.

Partial coverage, not a clean-surface verdict. At least one required analyzer (slither, semgrep) did not complete this scan, so the score is capped at 50/100 and the verdict above can never be Strong/Clear surface. Cause: slither coverage degraded: no installed solc satisfies pragma "^0.3.0" (installed: 0.4.26, 0.5.17, 0.6.12, 0.7.6, 0.8.19). Install a matching solc via solc-select. (+1 more coverage note).

Signature

unsigned

This report has no signature. It was persisted before report signing shipped, so nobody can prove authorship for it, including us. The bytes can still be hashed to check that they did not change.

Verify this report Get the signed bytes Published keys

PDF artifact

Queued artifact pipeline · not blocking on the scan

Not requested

No PDF artifact has been requested for this report yet. The HTML report and the Markdown export already carry the full disclaimer and limitations inline. PDF synthesis is a queued artifact, not part of the scan path.

Status endpoint

GET /report/solidity/VSS-20260923-21NOQY2S/export.pdf

Solidity evidence report

0 audit findings

Executive summary

No detector raised a finding against the submitted source. This is not a guarantee of safety; manual review remains required.
Automated static analysis only. A human operator review has not been attached to this report.

Warnings (2)

· slither coverage degraded: no installed solc satisfies pragma "^0.3.0" (installed: 0.4.26, 0.5.17, 0.6.12, 0.7.6, 0.8.19). Install a matching solc via solc-select.
· slither exit 1:

semgrep 1.163.0

No findings were flagged by slither or semgrep. This does not prove low risk, only that the configured detectors did not match.

Limitations

VegaSec runs static analysis only. Findings can include false positives, miss patterns the configured detectors do not cover, and never replace manual auditor judgement.
Scan ran slither and semgrep against a single sandboxed copy of the source. Multi-file dependency analysis beyond what slither resolves automatically is out of scope.
Analyzer coverage is PARTIAL: at least one required analyzer (slither, semgrep) did not complete. The trust score is capped at 50/100 and the verdict can never be a clean surface. Reasons: slither produced no structured output (exit 1); slither coverage degraded: no installed solc satisfies pragma "^0.3.0" (installed: 0.4.26, 0.5.17, 0.6.12, 0.7.6, 0.8.19). Install a matching solc via solc-select.; slither exit 1:
Some detectors emitted warnings (see `warnings`); their output was still ingested but should be read with extra care.
This report is not a certification, audit attestation, or financial advice.

Exploit reasoning

No high-confidence exploit narratives

The analyzers did not produce findings at critical, high, or medium severity that map to a deterministic exploit narrative. This does not mean the contract is free of bugs; it means this scan path did not produce evidence strong enough to publish a narrative without operator review.

Audit pipeline

Audit cockpit

Honest stage-by-stage view of what VegaSec ran against this contract. Automated stages do not replace a human operator review.

Passed: 3Partial: 5Blocked: 1

Audit intake
Passed320ms replay3:31 PM
Normalize the submitted contract target and confirm it can enter the Solidity audit lane.
Next: Acquire verified source or scan the pasted Solidity source.
Source acquisition
Passed1.4s replay3:31 PM
Resolve pasted source or verified explorer source without treating malformed input as demo data.
Next: Validate the analyzer toolchain against the acquired source.
03
Toolchain validation
Partial2.3s replay3:31 PM
Confirm the configured static analyzers can run and produce parseable output.
Next: Run static analysis and capture raw detector evidence.
- One or more analyzers emitted warnings; report findings remain usable but should be read with limitations.
04
Static analysis
Partial0 findings8.8s replay3:31 PM
Run static analyzers against the sandboxed source and collect raw detector evidence.
Next: Normalize detector output into one deduped finding set.
- One or more analyzers emitted warnings; report findings remain usable but should be read with limitations.
Finding normalization
Passed0 findings1.1s replay3:31 PM
Dedupe detectors, classify vulnerability classes and compute severity-weighted risk.
Next: Review exploitability conservatively against confidence and limitations.
06
Exploitability review
Partial0 findings1.9s replay3:31 PM
Frame automated findings with conservative exploitability and limitation notes.
Next: Draft remediation notes from the normalized evidence.
- Automated exploitability review is conservative and does not replace a manual exploitability assessment.
07
Remediation draft
Partial0 findings1.5s replay3:31 PM
Prepare remediation-oriented evidence for the shareable report artifact.
Next: Attach an operator review artifact before claiming human review.
- Remediation notes are generated from detector evidence and require project-specific engineering review.
08
Operator review
Blocked0ms replay3:31 PM
Record whether a human operator artifact exists before buyer escalation.
Next: Attach a real operator review artifact before claiming human review.
- No operator review artifact is attached to this automated scan.
- Human operator review has not been attached to this automated scan yet.
09
Finalization
Partial0 findings620ms replay3:31 PM
Publish the automated report artifact or explain why the scan failed closed.
Next: Share the report with explicit limitations and review state.
Artifact: Automated Solidity report · solidity-2f746d702f766567
- Final report is an automated static-analysis artifact; no operator review artifact is attached.

Report badges

Verified source

Badges describe the evidence carried by this report artifact, not financial value or future pricing. Operator-reviewed is never granted automatically.

How to read this report

Score, confidence, ranking: four moving parts, no hand-tuning.

Generated Sep 23, 2026, 3:31 PM · Solidity · partial-coverage-probe.sol

Score bands

0-19
AVOID-style triage
Multiple high or critical findings, low source confidence, or unverified context. Public action should pause until a Private Review or a re-scan with better evidence.
20-49
High caution
Notable findings or thin evidence. Worth a Private Review before relying on the artifact.
50-69
Watch · this report
Mixed signals: some evidence, some gaps. Re-scan after material changes to the target.
70-89
Clear surface (automated)
No critical or high findings via static analysis. Not a safety claim: human review is still recommended for diligence work.
90-100
Strong surface (automated)
No critical or high findings, verified source, and high source confidence. Not a safety claim: human review is still recommended for diligence work.

Score: Deterministic 0-100 derived from severity counts. Same formula across every report. Lower means more risk.
Confidence: Separate axis. Measures how much VegaSec trusts the input data. Low confidence pushes the verdict toward UNKNOWN; the two are never collapsed into one number.
Ranking / percentile: Only meaningful within the eligible Trust Index set. Shown on /trust-index when the eligible pool is large enough. Today the public index is a controlled preview.

Private Review is separate

A paid Private Review does not raise the public score on this report. Public score reflects public-source evidence only. Private Review adds operator attestation and a confidential memo, never a score bump.

Export and share

· Shareable public URL: copy from the report actions panel.
· Markdown export: every export carries the report id, target, verdict, generated timestamp, and the public-data disclaimer.
· PDF export: not in this MVP. Tracked as a follow-up. The Markdown export contains the same content and prints cleanly to PDF from a browser today.

Source provenance

This report scanned a Solidity source provided directly by the submitter (paste). No on-chain address is associated.

Scanned source (1,061 chars)

pragma solidity ^0.3.0;

// Sonde B (cobertura forçadamente parcial): pragma fora de qualquer solc instalado no worker
// (0.4.26 / 0.5.17 / 0.6.12 / 0.7.6 / 0.8.19). O slither não consegue compilar e sai != 0.
// Esperado DEPOIS do corte por cobertura: veredito NÃO limpo, score abaixo do teto,
// flag de cobertura parcial visível — exatamente o que faltava quando o relatório
// VSS-20260923-F9QQ5NEQ exibiu "TRUST SCORE 100 / STRONG SURFACE / 0 FINDINGS".
// Contém também um padrão clássico de reentrancy para o semgrep ter o que achar.
contract OldBank {
    mapping(address => uint256) public balances;
    uint256 public minSum = 1 ether;

    function deposit() public payable {
        balances[msg.sender] += msg.value;
    }

    function collect(uint256 amount) public payable {
        if (balances[msg.sender] >= minSum && balances[msg.sender] >= amount) {
            if (msg.sender.call.value(amount)()) {
                balances[msg.sender] -= amount;
            }
        }
    }

    function() public payable {
        deposit();
    }
}

Public-data disclaimer

Solidity scans are triage based on slither + semgrep static analysis. Output is not a certification, audit attestation or financial advice. Findings can include false positives and may miss patterns the configured detectors do not cover.