A rust implementation of the Quip Protocol forked from Substrate
This report summarizes scanner evidence for QuipNetwork/quip-protocol-rs, a Rust project with 5,632 GitHub stars. SynthScan examined 45,002 lines of code across 177 source files, recording 261 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 6.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 237 finding(s).
Are imports declared and package/API names verified? 8 finding(s).
Are wrappers, guards, and repeated structures necessary? 25 finding(s).
Which changes need focused human review? 261 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 261 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 1 | # Local dev only. Three Aura validators (Alice/Bob/Charlie) peer over a | COMMENT |
| LOW | .gitlab-ci.yml | 1 | # SPDX-License-Identifier: AGPL-3.0-or-later | COMMENT |
| LOW | .gitlab-ci.yml | 21 | # - stable git tag vX.Y.Z reachable from main | COMMENT |
| LOW | .gitlab-ci.yml | 41 | # `image:` and run on the SIP-protected host — kaniko cannot run there. Every | COMMENT |
| LOW | .gitlab-ci.yml | 81 | TOOLCHAIN_IMAGE: $CI_REGISTRY_IMAGE/ci-toolchain:$CI_IMAGE_TAG | COMMENT |
| LOW | .gitlab-ci.yml | 101 | # Cargo's registry inside the project dir so the GitLab CI cache can pick it | COMMENT |
| LOW | .gitlab-ci.yml | 141 | CI_IMAGE_TAG: mr-$CI_MERGE_REQUEST_IID | COMMENT |
| LOW | .gitlab-ci.yml | 161 | # host in the pool (watch/lovelace/finney) always missed; and py-signer-test | COMMENT |
| LOW | .gitlab-ci.yml | 201 | timeout: 90m | COMMENT |
| LOW | .gitlab-ci.yml | 321 | # today: the MR merges with stale weights and the drift only surfaces later. | COMMENT |
| LOW | .gitlab-ci.yml | 361 | # effect of that exclusion is that `cargo-test`'s `--workspace` clippy/test runs | COMMENT |
| LOW | .gitlab-ci.yml | 401 | # Weight regeneration on the reference machine (QUI-857). Manual job on | COMMENT |
| LOW | .gitlab-ci.yml | 521 | - quip-network-node benchmark machine --chain quip-testnet --allow-fail | COMMENT |
| LOW | .gitlab-ci.yml | 541 | # KANIKO_CACHE_IMAGE, and optional whitespace-separated KANIKO_BUILD_ARGS. | COMMENT |
| LOW | .gitlab-ci.yml | 561 | before_script: | COMMENT |
| LOW | .gitlab-ci.yml | 601 | done | COMMENT |
| LOW | .gitlab-ci.yml | 761 | COMMENT | |
| LOW | .gitlab-ci.yml | 861 | # scripts/python-dists.sh, so the cross-built aarch64 wheel is import-tested on | COMMENT |
| LOW | .gitlab-ci.yml | 881 | # (native) + abi3 wheel for linux aarch64 (cargo-zigbuild / zig linker) + an | COMMENT |
| LOW | .gitlab-ci.yml | 901 | .on-mr-or-release-tag: | COMMENT |
| LOW | .gitlab-ci.yml | 941 | - export PATH="/opt/pyrelease/bin:$CARGO_HOME/bin:$PATH" | COMMENT |
| LOW | entrypoint.sh | 1 | #!/bin/bash | COMMENT |
| LOW | entrypoint.sh | 21 | # A genuinely *missing* marker is fine — substrate treats it as a fresh db — so | COMMENT |
| LOW | crates/transaction-crypto-wasm/src/lib.rs | 101 | /// optionally followed by `///<password>`. Derivation junctions (`//`, `/`) are | COMMENT |
| LOW | crates/transaction-crypto-py/pyproject.toml | 21 | # type stubs. That dir also serves as the submodule/PYTHONPATH staging location | COMMENT |
| LOW | crates/transaction-crypto-py/src/lib.rs | 61 | /// | COMMENT |
| LOW | crates/quantum-validation/tests/python_parity.rs | 1 | //! Cross-language parity vectors against the Python reference implementation. | COMMENT |
| LOW | crates/quantum-validation/src/packed.rs | 1 | //! Bit-packed solution payloads. | COMMENT |
| LOW | crates/quantum-validation/src/lib.rs | 1 | //! Deterministic, `no_std` quantum/Ising validation primitives for QUIP. | COMMENT |
| LOW | crates/quantum-validation/src/ising.rs | 21 | /// hash of the most recent winning block. Stable across the entire round | COMMENT |
| LOW | crates/quantum-validation/src/puzzle_spec.rs | 21 | /// Sampling distribution for a single puzzle parameter (h, j, or spin). | COMMENT |
| LOW | crates/quantum-validation/src/validation.rs | 81 | } | COMMENT |
| LOW | crates/quantum-validation/src/errors.rs | 1 | //! Error types for structural and arithmetic validation failures. | COMMENT |
| LOW | crates/quantum-validation/src/energy.rs | 1 | //! Exact Ising energy computation in fixed-point milli precision. | COMMENT |
| LOW | crates/quantum-validation/src/energy.rs | 21 | /// | COMMENT |
| LOW | crates/quantum-validation/src/energy.rs | 81 | } | COMMENT |
| LOW | crates/quantum-validation/src/energy.rs | 281 | } | COMMENT |
| LOW | …tes/transaction-crypto/examples/derive_genesis_keys.rs | 1 | //! Derive hybrid genesis public material (BABE, GRANDPA, TX account) from a | COMMENT |
| LOW | crates/transaction-crypto/src/lib.rs | 1 | #![cfg_attr(not(feature = "std"), no_std)] | COMMENT |
| LOW | crates/transaction-crypto/src/lib.rs | 21 | //! catastrophic silent failure the runtime cannot detect. | COMMENT |
| LOW | crates/transaction-crypto/src/lib.rs | 61 | /// | COMMENT |
| LOW | crates/transaction-crypto/src/lib.rs | 121 | fn into_account(self) -> Self::AccountId { | COMMENT |
| LOW | crates/transaction-crypto-core/src/lib.rs | 1 | #![cfg_attr(not(feature = "std"), no_std)] | COMMENT |
| LOW | crates/transaction-crypto-core/src/lib.rs | 41 | /// Serialized H4 public-key length in bytes. | COMMENT |
| LOW | crates/transaction-crypto-core/src/lib.rs | 261 | b'a'..=b'f' => Ok(ch - b'a' + 10), | COMMENT |
| LOW | runtime/src/genesis_config_presets.rs | 1 | // This file is part of Substrate. | COMMENT |
| LOW | runtime/src/genesis_config_presets.rs | 341 | .map(|v| tx_account_from_seed(&v.to_seed())) | COMMENT |
| LOW | runtime/src/lib.rs | 141 | // runtime in substitute for the on-chain Wasm runtime unless all of `spec_name`, | COMMENT |
| LOW | runtime/src/lib.rs | 161 | // Existing call encodings are unchanged, so `transaction_version` stays at | COMMENT |
| LOW | runtime/src/lib.rs | 181 | // optional typed hardware survey, plus a v1 → v2 storage migration that | COMMENT |
| LOW | runtime/src/lib.rs | 201 | // weight now depends on the registered topology's node/edge counts and | COMMENT |
| LOW | runtime/src/lib.rs | 221 | // at 6. 115 has not shipped. Later storage-only changes (pallet-evm-chain-id) | COMMENT |
| LOW | runtime/src/lib.rs | 241 | // Same calls; a 117 node computes a different threshold from identical | COMMENT |
| LOW | runtime/src/benchmarks.rs | 1 | // This is free and unencumbered software released into the public domain. | COMMENT |
| LOW | runtime/src/apis.rs | 1 | // This is free and unencumbered software released into the public domain. | COMMENT |
| LOW | runtime/src/weights/block_weights.rs | 1 | //! THIS FILE WAS AUTO-GENERATED USING THE SUBSTRATE BENCHMARK CLI VERSION 54.0.0 | COMMENT |
| LOW | runtime/src/weights/block_weights.rs | 21 | // --weight-path | COMMENT |
| LOW | runtime/src/weights/extrinsic_weights.rs | 1 | //! THIS FILE WAS AUTO-GENERATED USING THE SUBSTRATE BENCHMARK CLI VERSION 54.0.0 | COMMENT |
| LOW | runtime/src/weights/extrinsic_weights.rs | 21 | // --weight-path | COMMENT |
| LOW | runtime/src/configs/mod.rs | 1 | // This is free and unencumbered software released into the public domain. | COMMENT |
| 160 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .gitlab-ci.yml | 851 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .gitlab-ci.yml | 853 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | entrypoint.sh | 53 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | pallets/xqvm/src/lib.rs | 146 | // ── Storage ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/lib.rs | 174 | // ── Events ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/lib.rs | 212 | // ── Errors ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/lib.rs | 476 | // ── Extrinsics ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 40 | // ── store_program ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 100 | // ── execute ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 323 | // ── static verification at store time ──────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 436 | // ── basic-block bound ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 676 | // ── weight accounting ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 767 | // ── allocation budget (QUI-1012) ───────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 867 | // ── VM fault mapping (QUI-1014) ────────────────────────────────────────── | COMMENT |
| MEDIUM | pallets/xqvm/src/tests.rs | 1080 | // ── storage deposit and removal (QUI-1058) ─────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/transaction-crypto-py/tests/test_parity.py | 42 | def test_public_keys_match_baseline() -> None: | CODE |
| LOW | crates/transaction-crypto-py/tests/test_parity.py | 64 | def test_signature_envelopes_match_baseline() -> None: | CODE |
| LOW | crates/transaction-crypto-py/tests/test_api.py | 11 | def test_sign_verify_roundtrip() -> None: | CODE |
| LOW⚡ | crates/transaction-crypto-py/tests/test_api.py | 52 | def test_from_seed_rejects_wrong_length(length: int) -> None: | CODE |
| LOW⚡ | crates/transaction-crypto-py/tests/test_api.py | 60 | def test_mnemonic_rejects_derivation_junctions() -> None: | CODE |
| LOW⚡ | crates/transaction-crypto-py/tests/test_api.py | 65 | def test_invalid_mnemonic_raises() -> None: | CODE |
| LOW⚡ | crates/transaction-crypto-py/tests/test_api.py | 70 | def test_verify_rejects_malformed_envelope() -> None: | CODE |
| LOW | js/quip-signer/src/index.ts | 375 | export function createInjectedQuipProvider({ | CODE |
| LOW | docs/quantum-compute-mempool.md | 231 | def event_name_from_storage_record(record): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/run-benchmarks.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/test-xqvm-onchain.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/derive-operator-keys.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/prune-ci-cache.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/push-weights.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/check-weights-staleness.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 8 | CODE | |
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 8 | CODE | |
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 8 | CODE | |
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 8 | CODE | |
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 8 | CODE | |
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 8 | CODE | |
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 8 | CODE | |
| LOW | scripts/generate_quantum_validation_fixtures.py | 25 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/pyo3-bindings-plan.md | 124 | ### Phase 1 — crate scaffold + minimal build | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/derive-operator-keys.sh | 75 | # but we recover it via inspect-node-key below for a robust capture. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/transaction-crypto-py/python/quip_signer/__init__.py | 18 | __all__ = [ | CODE |