Repository Analysis

SunWeb3Sec/DeFiHackLabs

Reproduce DeFi hacked incidents using Foundry.

4.1 Likely human-written View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of SunWeb3Sec/DeFiHackLabs, a Solidity project with 6,633 GitHub stars. SynthScan v2.0 examined 33,967 lines of code across 81 source files, recording 104 pattern matches distributed across 7 syntactic categories. The overall adjusted score of 4.1 places this repository in the Likely human-written band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

4.1
Adjusted Score
4.1
Raw Score
100%
Time Factor
2026-07-07
Last Push
6.6K
Stars
Solidity
Language
34.0K
Lines of Code
81
Files
104
Pattern Hits
2026-07-14
Scan Date
0.02
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 2HIGH 0MEDIUM 14LOW 88

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 104 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hyper-Verbose Identifiers56 hits · 42 pts
SeverityFileLineSnippetContext
LOWadd_new_entry.py603 def _update_table_of_contents(self, content: str, formatted_date: str, name: str, additional_details: str) -> str:CODE
LOWadd_new_entry.py412 def is_cast_command_available(self) -> bool:CODE
LOWadd_new_entry.py454 def get_timestamp_from_tx_hash(self, tx_hash: str, rpc_url: str, auto_confirm: bool = False) -> str:CODE
LOWadd_new_entry.py504 def get_addresses_from_tx_hash(self, tx_hash: str, rpc_url: str) -> Optional[Tuple[str, str, str]]:CODE
LOWadd_new_entry.py729 def get_uncommitted_sol_files(self):CODE
LOWadd_new_entry.py746 def get_recently_committed_sol_files(self) -> list:CODE
LOWtest.py945 def test_timestamp_and_tx_hash_are_mutually_exclusive(self):CODE
LOWtest.py950 def test_main_without_network_runs_interactive(self):CODE
LOWtest.py958 def test_main_non_interactive_requires_file_and_amount(self):CODE
LOWtest.py964 def test_main_non_interactive_dispatches_to_add_entry_cli(self):CODE
LOWtest.py973 def test_add_entry_cli_updates_readme_with_network(self):CODE
LOWtest.py38 def test_constants_initialization(self):CODE
LOWtest.py109 def test_parse_foundry_toml_file_not_found(self, mock_open):CODE
LOWtest.py121 def test_parse_foundry_toml_decode_error(self, mock_open):CODE
LOWtest.py136 def test_update_foundry_toml_success(self, mock_open):CODE
LOWtest.py167 def test_update_foundry_toml_file_not_found(self, mock_open):CODE
LOWtest.py176 def test_select_network_choose_existing(self, mock_input):CODE
LOWtest.py195 def test_select_network_add_new(self, mock_input):CODE
LOWtest.py238 def test_select_network_invalid_choice(self, mock_input):CODE
LOWtest.py264 def test_is_cast_command_available_true(self, mock_check_output):CODE
LOWtest.py275 def test_is_cast_command_available_false(self, mock_check_output):CODE
LOWtest.py287 def test_run_cast_command_success(self, mock_run):CODE
LOWtest.py311 def test_run_cast_command_error(self, mock_run):CODE
LOWtest.py336 def test_get_timestamp_from_str_valid(self):CODE
LOWtest.py346 def test_get_timestamp_from_str_empty(self):CODE
LOWtest.py358 def test_get_timestamp_from_str_invalid(self):CODE
LOWtest.py374 def test_get_timestamp_from_tx_hash_success(self, mock_input):CODE
LOWtest.py404 def test_get_addresses_from_tx_hash_success(self, mock_run_cast):CODE
LOWtest.py432 def test_get_addresses_from_tx_hash_with_contract_creation(self, mock_run_cast):CODE
LOWtest.py501 def test_update_readme_file_not_found(self, mock_open):CODE
LOWtest.py587 def test_update_sum_of_incidents(self):CODE
LOWtest.py595 def test_get_run_command_without_shanghai(self):CODE
LOWtest.py607 def test_get_run_command_with_shanghai(self):CODE
LOWtest.py620 def test_check_readme_entry_exists(self, mock_open):CODE
LOWtest.py630 def test_check_readme_entry_not_exists(self, mock_open):CODE
LOWtest.py707 def test_create_poc_solidity_file_template_not_found(self, mock_open):CODE
LOWtest.py722 def test_replace_placeholders(self):CODE
LOWtest.py742 def test_is_git_command_available_true(self, mock_check_output):CODE
LOWtest.py753 def test_is_git_command_available_false(self, mock_check_output):CODE
LOWtest.py763 def test_get_uncommitted_sol_files_success(self, mock_check_output):CODE
LOWtest.py777 def test_get_uncommitted_sol_files_git_not_available(self):CODE
LOWtest.py788 def test_get_recently_committed_sol_files_success(self, mock_check_output):CODE
LOWtest.py802 def test_get_recently_committed_sol_files_git_not_available(self):CODE
LOWtest.py844 def test_get_file_extra_info_basic(self, mock_input):CODE
LOWtest.py870 def test_add_new_entry_with_poc_file(self, mock_input):CODE
LOWtest.py916 def test_process_existing_files(self, mock_input):CODE
LOWtest.py986 def test_add_entry_cli_unknown_network_without_rpc_fails(self):CODE
LOWtest.py996 def test_add_entry_cli_registers_network_with_rpc(self):CODE
LOWtest.py1008 def test_add_entry_cli_create_poc(self):CODE
LOWtest.py1020 def test_get_timestamp_auto_confirm_skips_prompt(self):CODE
LOWtest.py88 def test_parse_foundry_toml_success(self, mock_open):STRING
LOWtest.py486 def test_update_readme_success(self, mock_open):STRING
LOWtest.py566 def test_update_table_of_contents(self):STRING
LOWtest.py675 def test_create_poc_solidity_file_success(self, mock_open, mock_makedirs):STRING
LOWacademy/solidity/02_first_deposit/readme.md26function exchangeRateStoredInternal() virtual internal view returns (uint) {CODE
LOWacademy/solidity/02_first_deposit/en/readme.md24function exchangeRateStoredInternal() virtual internal view returns (uint) {CODE
Excessive Try-Catch Wrapping15 hits · 38 pts
SeverityFileLineSnippetContext
MEDIUMadd_new_entry.py334 print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Please ensure the file exists in the current diCODE
MEDIUMadd_new_entry.py337 print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Please check its format.")CODE
MEDIUMadd_new_entry.py346 print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Cannot update RPC endpoints.")CODE
MEDIUMadd_new_entry.py349 print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Cannot update RPC endpoints.")CODE
MEDIUMadd_new_entry.py359 print(f"Error: Could not write to {self.constants.FOUNDRY_TOML_PATH}.")CODE
MEDIUMadd_new_entry.py428 print(f"Error calling 'cast' for {command_description}: {e}")CODE
MEDIUMadd_new_entry.py433 print(f"Error parsing JSON output from 'cast' for {command_description}.")CODE
MEDIUMadd_new_entry.py597 print(f"Error: Could not find insertion point in {self.constants.README_PATH} using regex: {self.constants.LCODE
MEDIUMadd_new_entry.py611 print(f"Error: Could not find Table of Contents section in {self.constants.README_PATH} using regex: {self.cCODE
MEDIUMadd_new_entry.py290 print(f"Error: network '{args.network}' not found in {self.constants.FOUNDRY_TOML_PATH}. "CODE
MEDIUMadd_new_entry.py547 print(f"Error: {self.constants.README_PATH} not found. Please ensure the file exists in the current directorCODE
MEDIUMadd_new_entry.py641 print(f"Error: {self.constants.README_PATH} not found. Cannot check for existing entries.")CODE
MEDIUMadd_new_entry.py673 print(f"Error: {self.constants.POC_TEMPLATE_PATH} not found. Cannot create POC file.")CODE
LOWadd_new_entry.py438 except Exception as e:CODE
MEDIUMtest.py30 print("Error: Could not import the DefiHackLibrary module.")CODE
Structural Annotation Overuse16 hits · 30 pts
SeverityFileLineSnippetContext
LOWCONTRIBUTING.md19### Step 1: Fork and Clone the RepositoryCOMMENT
LOWCONTRIBUTING.md116### Step 2: Automatic UpdatesCOMMENT
LOWCONTRIBUTING.md124### Step 3: Implement the Exploit CodeCOMMENT
LOWCONTRIBUTING.md134### Step 4: Test and Commit Your ChangesCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/ko/readme.md314### Step 4: 취약점 분석COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/ko/readme.md382### Step 5: 공격 재현COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md95### Step 1: Information gatheringCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md114### Step 2: Transaction DebuggingCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md166### Step 3: Reproduce codeCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md310### Step 4: Analyzing the exploitCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md379### Step 5: ReproduceCOMMENT
LOWacademy/user_awareness/06_Report_stolen/en/readme.md103 ### Step 1: transfer any remaining assetsCOMMENT
LOWacademy/user_awareness/06_Report_stolen/en/readme.md111 ### Step 2: seek help from a security team and track fundsCOMMENT
LOWacademy/user_awareness/06_Report_stolen/en/readme.md119 ### Step 3: Count the amount of your stolen funds and keep related evidenceCOMMENT
LOWacademy/user_awareness/06_Report_stolen/en/readme.md123 ### Step 4: report the case to the law enforcement agencyCOMMENT
LOWacademy/user_awareness/06_Report_stolen/en/readme.md127 ### Step 5: continue to follow up and maintain communicationCOMMENT
Hallucination Indicators2 hits · 20 pts
SeverityFileLineSnippetContext
CRITICALtest.py498 mock_open.return_value.__enter__.return_value.write.assert_called_with("Updated README")CODE
CRITICALtest.py704 mock_open.return_value.__enter__.return_value.write.assert_called_with("Modified template content")CODE
Over-Commented Block4 hits · 4 pts
SeverityFileLineSnippetContext
LOW…ademy/onchain_debug/03_write_your_own_poc/ja/readme.md181COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/ko/readme.md181import "forge-std/Test.sol";COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/es/readme.md181// Attack Contract : 0xc30808d9373093fbfcec9e026457c6a9dab706a7COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md181// Attacker : 0xee0221d76504aec40f63ad7e36855eebf5ea5eddCOMMENT
Unused Imports7 hits · 4 pts
SeverityFileLineSnippetContext
LOWadd_new_entry.py16CODE
LOWtest.py11CODE
LOWtest.py12CODE
LOWtest.py13CODE
LOWtest.py17CODE
LOWtest.py18CODE
LOWtest.py23CODE
Deep Nesting4 hits · 2 pts
SeverityFileLineSnippetContext
LOWadd_new_entry.py361CODE
LOWadd_new_entry.py454CODE
LOWtest.py870CODE
LOWtest.py916CODE