A detector that fires is a hypothesis. Proof is the attack contract that drains your vault on a forked chain — line, transaction, balance. The report is forensic: location, evidence, severity, and the steps to reproduce.
The lattice
An eighty-cell field stands in for the contract surface — every external entry, every state-changing path, every storage slot. Most cells stay dark. The few that light up are the exploitable shape.
The deliverable
A finding is short on purpose. The headline is what the attacker would call it; the location is where to look; the body is why it matters; the meta is the trail back to the detector and the SWC that taught us its shape.
Vault.sol:184 — withdraw()
External low-level call{value:} returns control to the attacker before balances[msg.sender] is decremented, allowing recursive drain via the attacker's fallback(). The cross-correlate step lifted this from High to Critical when the read-only balanceOf() path on the same storage slot was confirmed.
Access.sol:92 — transferOwnership()
The function sets owner = msg.sender's argument with no onlyOwner modifier and no internal check. Any external account can rotate the ownership pointer and unlock all admin-gated functions in one transaction.
Vault.sol:67 — balanceOf()
A view function called mid-transaction returns pre-update state when invoked from within a downstream contract's callback. Integrators reading this value to price collateral will accept inflated balances mid-withdraw.
Rewards.sol:214 — claim()
The (bool ok, ) = recipient.call{value:}(...) result is discarded. A reverting recipient — including a contract with insufficient gas in its fallback — silently fails, but state is updated as though payout succeeded. The user can be locked out of their reward indefinitely.
Token.sol:148 — mint()
A uint256 parameter is downcast to uint128 without bounds check. For mint amounts above 2¹²⁸, the value silently wraps. The accounting reads correct on the path but the supply ledger is wrong.
Registry.sol:19 — register()
Recovery requires a redeploy if address(0) is registered as a permitted caller. Not exploitable on its own; flagged because the recovery cost is asymmetric — operator-day vs. attacker-second.
Repository-wide
Mixed MIT and Apache-2.0 markers across files. Pick one or document the deliberate split. No security impact; included so the disclosure record is complete.
The proof
Scrub through the attack the way the EVM ran it. Five state transitions on a forked chain. The vault holds 100 ether at step 0 and 0 ether at step 5. The attacker contract gets there through a single re-entrant call.
Anatomy
A finding card is a contract: every field has one job, and nothing speculative is allowed in. The cards below the rail show what each part of the deliverable is for, and what kind of evidence backs it.
Vault.sol:184 — withdraw()
External low-level call{value:} returns control to the attacker before balances[msg.sender] is decremented, allowing recursive drain via fallback().
Severity, encoded as a four-pixel vertical band on the leading edge. The colors are the lattice colors. There is no other use of the severity hue elsewhere in the card — the bar is the whole signal.
What an attacker would call this in their writeup. Active voice. The exploit shape is named, the consequence is named. We do not say "potential" or "may" — a finding is a fired detector with sealed evidence.
File, line, function. Click-through goes to a deep link in the source viewer with the offending node highlighted, the AST path on the right, and the detector's predicate inline.
Two to three sentences explaining the shape and the consequence. No remediation, no "consider using a guard"; that lives in the detector's docs page. The finding's job is to describe, accurately.
Detector, SWC entry, confidence, loss model, reproduction. Five mono labels, no prose. The reproduction column points at a forked-chain replay; for criticals it is always runnable, single-tx.
Disclosure
The deliverable doesn't sit on a dashboard. Findings are sealed at the moment evidence is gathered, signed by the engine's run key, and routed to the channel the protocol team chose at access time.
The offending node, the AST path that reached it, the detector predicate, and the fork-block height are bundled into a single finding payload before correlation runs. Nothing is rewritten downstream.
Each report is signed by the engine's per-run key. The signature commits to the AST hash, the detector versions, the SWC corpus revision, and the fork-block. A finding can be verified independently after the fact.
Webhook, signed email, PGP, on-chain attestation, or a private mirror — disclosure is configured at access time. Critical findings trigger the channel within the same second they are sealed.