A Decentralized Operating System for ZK Applications
This report summarizes scanner evidence for ProvableHQ/snarkOS, a Rust project with 4,530 GitHub stars. SynthScan examined 90,102 lines of code across 321 source files, recording 409 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 5.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 402 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 7 finding(s).
Which changes need focused human review? 409 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 409 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | build.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | snarkos/main.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | .ci/utils.sh | 1 | #!/bin/bash | COMMENT |
| LOW | .ci/test_partial_upgrade.sh | 1 | #!/bin/bash | COMMENT |
| LOW | .ci/test_full_upgrade.sh | 1 | #!/bin/bash | COMMENT |
| LOW | cli/build.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/tests/e2e.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/lib.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/start.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/start.rs | 141 | COMMENT | |
| LOW | cli/src/commands/start.rs | 161 | COMMENT | |
| LOW | cli/src/commands/start.rs | 181 | /// These peers will be set as "trusted", which means the node will not disconnect from them when performing peer ro | COMMENT |
| LOW | cli/src/commands/start.rs | 241 | COMMENT | |
| LOW | cli/src/commands/start.rs | 261 | #[clap(long, group = "jwt_flags")] | COMMENT |
| LOW | cli/src/commands/start.rs | 281 | COMMENT | |
| LOW | cli/src/commands/start.rs | 301 | #[clap(long)] | COMMENT |
| LOW | cli/src/commands/start.rs | 321 | #[clap(long, verbatim_doc_comment)] | COMMENT |
| LOW | cli/src/commands/start.rs | 341 | /// If you do not explicitly set the `--peers` flag, this will also populate the set of trusted peers, so that the n | COMMENT |
| LOW | cli/src/commands/start.rs | 1081 | Ok(()) | COMMENT |
| LOW | cli/src/commands/clean.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/update.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/mod.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/account.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/account.rs | 41 | COMMENT | |
| LOW | cli/src/commands/account.rs | 61 | /// Try until an address with the vanity string is found | COMMENT |
| LOW | cli/src/commands/account.rs | 81 | discreet: bool, | COMMENT |
| LOW | cli/src/commands/developer/decrypt.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/developer/execute.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/developer/execute.rs | 61 | private_key: Option<String>, | COMMENT |
| LOW | cli/src/commands/developer/execute.rs | 81 | /// The record to spend the fee from. | COMMENT |
| LOW | cli/src/commands/developer/deploy.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/developer/deploy.rs | 61 | /// Use a developer validator key tok generate the deployment. | COMMENT |
| LOW | cli/src/commands/developer/deploy.rs | 81 | #[clap(short, long)] | COMMENT |
| LOW | cli/src/commands/developer/mod.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/developer/mod.rs | 101 | /// [options: 0 = mainnet, 1 = testnet, 2 = canary] | COMMENT |
| LOW | cli/src/commands/developer/scan.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/developer/scan.rs | 61 | COMMENT | |
| LOW | cli/src/commands/developer/transfer_private.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/commands/developer/transfer_private.rs | 41 | pub struct TransferPrivate { | COMMENT |
| LOW | cli/src/commands/developer/transfer_private.rs | 61 | /// | COMMENT |
| LOW | cli/src/commands/account/sign.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/updater.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/logger.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/logger.rs | 121 | /// | COMMENT |
| LOW | cli/src/helpers/log_fields.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/mod.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/dynamic_format.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/bech32m.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/bech32m.rs | 21 | /// ```ignore | COMMENT |
| LOW | cli/src/helpers/dev.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/log_writer.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/args.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | cli/src/helpers/fd_check.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | utilities/src/callback_handle.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | utilities/src/node_data.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | utilities/src/lib.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | utilities/src/signals.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | display/src/lib.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | display/src/tabs.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| LOW | display/src/pages/mod.rs | 1 | // Copyright (c) 2019-2026 Provable Inc. | COMMENT |
| 293 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .ci/bench_cdn_sync.sh | 27 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/bench_cdn_sync.sh | 34 | # Define a trap handler that prints a message when an error occurs. | COMMENT |
| MEDIUM | .ci/test_restart_majority.sh | 49 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/test_restart_majority.sh | 52 | # Define a trap handler that prints a message when an error occurs | COMMENT |
| MEDIUM | .ci/test_partial_upgrade.sh | 42 | # Create the log directory | COMMENT |
| MEDIUM | .ci/bench_bft_sync.sh | 40 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/bench_bft_sync.sh | 47 | # Define a trap handler that prints a message when an error occurs | COMMENT |
| MEDIUM | .ci/bench_rest_api.sh | 32 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/bench_rest_api.sh | 35 | # Define a trap handler that prints a message when an error occurs. | COMMENT |
| MEDIUM | .ci/generate_ledger.sh | 41 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/generate_ledger.sh | 48 | # Define a trap handler that prints a message when an error occurs | COMMENT |
| MEDIUM | .ci/test_restart_all.sh | 39 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/test_restart_all.sh | 42 | # Define a trap handler that prints a message when an error occurs | COMMENT |
| MEDIUM | .ci/test_db_backup.sh | 32 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/test_db_backup.sh | 35 | # Define a trap handler that prints a message when an error occurs | COMMENT |
| MEDIUM | .ci/test_devnet.sh | 40 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/test_devnet.sh | 53 | # Define a trap handler that prints a message when an error occurs | COMMENT |
| MEDIUM | .ci/test_reset_minority.sh | 39 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/test_reset_minority.sh | 42 | # Define a trap handler that prints a message when an error occurs | COMMENT |
| MEDIUM | .ci/bench_p2p_sync.sh | 90 | # Define a trap handler that cleans up all processes on exit. | COMMENT |
| MEDIUM | .ci/bench_p2p_sync.sh | 93 | # Define a trap handler that prints a message when an error occurs. | COMMENT |
| MEDIUM | scripts/delay-network.sh | 83 | # Create the Priority Queue | COMMENT |
| MEDIUM | scripts/devnet.sh | 124 | # Create an array to store background processes | COMMENT |
| MEDIUM | scripts/devnet.sh | 141 | # Create a timestamp-based directory for log files | COMMENT |
| MEDIUM | scripts/devnet.sh | 145 | # Create a new tmux session named "devnet" | COMMENT |
| MEDIUM | scripts/devnet.sh | 193 | # Create a new window with a unique name | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | node/bft/src/gateway.rs | 1585 | // Make the socket more robust; every other handshake in the node does this too. | COMMENT |
| MEDIUM | node/bft/src/helpers/storage.rs | 585 | // As for the `test_network` clause, a more robust approach would be to set the | COMMENT |
| MEDIUM | node/sync/src/ping.rs | 34 | /// Essentially, ping keeps an ordered map `next_ping` of time(rs) to peer IPs. | COMMENT |
| MEDIUM | node/src/validator/router.rs | 54 | // Make the socket more robust. | COMMENT |
| MEDIUM | node/src/bootstrap_client/handshake.rs | 117 | // Make the socket more robust. | COMMENT |
| MEDIUM | node/src/prover/router.rs | 54 | // Make the socket more robust. | COMMENT |
| MEDIUM | node/src/client/router.rs | 57 | // Make the socket more robust. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/chaotic-network-runner.sh | 3 | # ========================================== | COMMENT |
| MEDIUM | scripts/chaotic-network-runner.sh | 5 | # ========================================== | COMMENT |
| MEDIUM | scripts/chaotic-network-runner.sh | 36 | # ========================================== | COMMENT |
| MEDIUM | scripts/chaotic-network-runner.sh | 38 | # ========================================== | COMMENT |
| MEDIUM | scripts/chaotic-network-runner.sh | 72 | # ========================================== | COMMENT |
| MEDIUM | scripts/chaotic-network-runner.sh | 74 | # ========================================== | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .ci/utils.sh | 33 | # Check if any tracked node process has exited. | COMMENT |
| LOW | .ci/utils.sh | 150 | # Check if count is greater than max_index + 1 (impossible request) | COMMENT |
| LOW | .ci/utils.sh | 171 | # Check if PID exists (is not empty) and is currently running | COMMENT |
| LOW | scripts/delay-network.sh | 18 | # Check if the a command this script depends on exist | COMMENT |
| LOW | scripts/devnet.sh | 163 | # Loop through the list of validator indices and create a new window for each | COMMENT |
| LOW | scripts/devnet.sh | 185 | # Loop through the list of client indices and create a new window for each | COMMENT |
| LOW | scripts/chaotic-network-runner.sh | 20 | # Check if there is a command to run left | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | node/network/src/peering.rs | 678 | // Step 1: insert as a candidate. | COMMENT |
| LOW⚡ | node/network/src/peering.rs | 687 | // Step 2: promote to connecting. | COMMENT |
| LOW⚡ | node/network/src/peering.rs | 696 | // Step 3: complete the handshake — upgrade to connected. | COMMENT |
| LOW | node/bft/src/helpers/storage.rs | 964 | // Note that the ledger does *not* store aborted transmissions, so we need to check if the solution | COMMENT |
| LOW | node/bft/src/helpers/storage.rs | 988 | // Note that the ledger does *not* store aborted transmissions, so we need to check if the transacti | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | node/rest/src/routes.rs | 168 | /// maximum applies to the range as requested. A height missing at or below the tip is left in the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | node/network/src/peering.rs | 678 | // Step 1: insert as a candidate. | COMMENT |
| LOW⚡ | node/network/src/peering.rs | 687 | // Step 2: promote to connecting. | COMMENT |
| LOW⚡ | node/network/src/peering.rs | 696 | // Step 3: complete the handshake — upgrade to connected. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .ci/rest_api_helper.py | 74 | except Exception as err: | CODE |