Hunt

514
detectors, at once.

Eight workers. Two seconds. Every shape of vulnerability the corpus has seen — running in parallel on your AST.

Detectors

514

Runtime

2.1s

Flagged

SCAN 0 / 514

Operation log

0 events

Engine warm

+000ms engine.start · 8 workers +012ms ast.map · 3,841 nodes +128ms family.load · reentrancy ×4 +148ms family.load · arithmetic ×4 +201ms family.load · access ×5 +340ms fan_out · 514 detectors · 8 cores +412ms worker[0] → RE-01…RE-04 +418ms worker[1] → ACC-01…ACC-05 +425ms worker[2] → AR-01…AR-04 +812ms RE-01 · withdraw():184 · HIT +884ms ACC-02 · transferOwnership():92 · HIT +910ms poc.generate · RE-01 · confidence 0.97 +1,212ms AR-01 · mint():148 · HIT +1,440ms correlate · same storage slot → severity ↑ +1,610ms poc.generate · AR-01 · confidence 0.91 +1,902ms severity · 1 critical · 3 high · 1 med +2,098ms report.seal · findings locked +2,098ms scan.complete · 514 / 514

Live findings

Critical RE-01 · withdraw():184 · Reentrancy

High ACC-02 · transferOwnership():92

High AR-01 · mint():148 · Truncation

Medium EXT-03 · claim():214 · Unchecked

Six of 514. Each one fits in a card.

One shape. One node-kind. One job. That's why 514 can run at once.

DET-0x01 Complete

Reentrancy · classic

├─ external call
├─ state write after
└─ no guard

SWC-107 · withdraw():184

DET-0x02 Complete

Reentrancy · readonly

├─ view fn mid-call
├─ stale storage read
└─ price/balance leak

SWC-130 · balanceOf():67

DET-0x07 Complete

Privileged write

├─ state-changing fn
├─ no modifier
└─ no msg.sender check

SWC-105 · transferOwnership():92

DET-0x0E Complete

Unchecked low-call

├─ .call(...)
├─ no require on success
└─ silent failure path

SWC-104 · claim():214

DET-0x12 Complete

Integer truncation

├─ uint256 → uint128
├─ no bounds check
└─ value-loss path

SWC-101 · mint():148

DET-0x21 No hit

Oracle · stale price

├─ updatedAt read
├─ no freshness check
└─ unchecked answer

No hit · representative

Next · Findings

Proof. Each finding with a runnable exploit.

See the findings