Reproduce DeFi hacked incidents using Foundry.
This report summarizes scanner evidence for SunWeb3Sec/DeFiHackLabs, a Solidity project with 6,830 GitHub stars. SynthScan examined 34,914 lines of code across 81 source files, recording 122 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 4.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 89 finding(s).
Are imports declared and package/API names verified? 8 finding(s).
Are wrappers, guards, and repeated structures necessary? 90 finding(s).
Which changes need focused human review? 122 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 122 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | add_new_entry.py | 355 | print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Please ensure the file exists in the current di | CODE |
| MEDIUM⚡ | add_new_entry.py | 358 | print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Please check its format.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 361 | print(f"Error: Could not read {self.constants.FOUNDRY_TOML_PATH}: {e}") | CODE |
| MEDIUM⚡ | add_new_entry.py | 375 | print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Cannot update RPC endpoints.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 378 | print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Cannot update RPC endpoints.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 381 | print(f"Error: Could not read {self.constants.FOUNDRY_TOML_PATH}: {e}") | CODE |
| MEDIUM⚡ | add_new_entry.py | 390 | print(f"Error: Could not write to {self.constants.FOUNDRY_TOML_PATH}: {e}") | CODE |
| MEDIUM⚡ | add_new_entry.py | 463 | print(f"Error calling 'cast' for {command_description}: {e}") | CODE |
| MEDIUM⚡ | add_new_entry.py | 468 | print(f"Error parsing JSON output from 'cast' for {command_description}.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 650 | print(f"Error: Could not find insertion point in {self.constants.README_PATH} using regex: {self.constants.L | CODE |
| MEDIUM⚡ | add_new_entry.py | 664 | print(f"Error: Could not find Table of Contents section in {self.constants.README_PATH} using regex: {self.c | CODE |
| MEDIUM⚡ | add_new_entry.py | 728 | print(f"Error: Could not create directory {os.path.dirname(new_file_path)}: {e}") | CODE |
| MEDIUM⚡ | add_new_entry.py | 736 | print(f"Error: {self.constants.POC_TEMPLATE_PATH} not found. Cannot create POC file.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 739 | print(f"Error: Could not read POC template {self.constants.POC_TEMPLATE_PATH}: {e}") | CODE |
| MEDIUM | add_new_entry.py | 303 | print(f"Error: network '{args.network}' not found in {self.constants.FOUNDRY_TOML_PATH}. " | CODE |
| MEDIUM | add_new_entry.py | 308 | print("Error: could not register the network in " | CODE |
| MEDIUM | add_new_entry.py | 329 | print("Error: POC file was not created. Aborting.") | CODE |
| MEDIUM | add_new_entry.py | 334 | print("Error: README.md was not updated. Aborting.") | CODE |
| MEDIUM | add_new_entry.py | 590 | print(f"Error: {self.constants.README_PATH} not found. Please ensure the file exists in the current director | CODE |
| MEDIUM | add_new_entry.py | 594 | print(f"Error: Could not read {self.constants.README_PATH}: {e}") | CODE |
| MEDIUM | add_new_entry.py | 606 | print(f"Error: Could not write to {self.constants.README_PATH}: {e}") | CODE |
| MEDIUM | add_new_entry.py | 694 | print(f"Error: {self.constants.README_PATH} not found. Cannot check for existing entries.") | CODE |
| MEDIUM | add_new_entry.py | 773 | print(f"Error: Could not write POC file {new_file_path}: {e}") | CODE |
| LOW⚡ | add_new_entry.py | 473 | except Exception as e: | CODE |
| MEDIUM | test.py | 31 | print("Error: Could not import the DefiHackLibrary module.") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | add_new_entry.py | 656 | def _update_table_of_contents(self, content: str, formatted_date: str, name: str, additional_details: str) -> str: | CODE |
| LOW | add_new_entry.py | 447 | def is_cast_command_available(self) -> bool: | CODE |
| LOW | add_new_entry.py | 489 | def get_timestamp_from_tx_hash(self, tx_hash: str, rpc_url: str, auto_confirm: bool = False) -> str: | CODE |
| LOW | add_new_entry.py | 541 | def get_addresses_from_tx_hash(self, tx_hash: str, rpc_url: str) -> Optional[Tuple[str, str, str]]: | CODE |
| LOW | add_new_entry.py | 800 | def get_uncommitted_sol_files(self): | CODE |
| LOW | add_new_entry.py | 817 | def get_recently_committed_sol_files(self) -> list: | CODE |
| LOW⚡ | test.py | 168 | def test_update_foundry_toml_file_not_found(self, mock_open): | CODE |
| LOW⚡ | test.py | 178 | def test_update_foundry_toml_read_failure_returns_false(self, mock_open): | CODE |
| LOW⚡ | test.py | 184 | def test_update_foundry_toml_write_failure_returns_false(self, mock_open): | CODE |
| LOW⚡ | test.py | 194 | def test_select_network_choose_existing(self, mock_input): | CODE |
| LOW⚡ | test.py | 1014 | def test_timestamp_and_tx_hash_are_mutually_exclusive(self): | CODE |
| LOW⚡ | test.py | 1019 | def test_main_without_network_runs_interactive(self): | CODE |
| LOW⚡ | test.py | 1027 | def test_main_non_interactive_requires_file_and_amount(self): | CODE |
| LOW⚡ | test.py | 1033 | def test_main_non_interactive_dispatches_to_add_entry_cli(self): | CODE |
| LOW⚡ | test.py | 1042 | def test_add_entry_cli_updates_readme_with_network(self): | CODE |
| LOW | test.py | 39 | def test_constants_initialization(self): | CODE |
| LOW | test.py | 110 | def test_parse_foundry_toml_file_not_found(self, mock_open): | CODE |
| LOW | test.py | 122 | def test_parse_foundry_toml_decode_error(self, mock_open): | CODE |
| LOW | test.py | 137 | def test_update_foundry_toml_success(self, mock_open): | CODE |
| LOW | test.py | 213 | def test_select_network_add_new(self, mock_input): | CODE |
| LOW | test.py | 256 | def test_select_network_invalid_choice(self, mock_input): | CODE |
| LOW | test.py | 282 | def test_is_cast_command_available_true(self, mock_check_output): | CODE |
| LOW | test.py | 293 | def test_is_cast_command_available_false(self, mock_check_output): | CODE |
| LOW | test.py | 305 | def test_run_cast_command_success(self, mock_run): | CODE |
| LOW | test.py | 329 | def test_run_cast_command_error(self, mock_run): | CODE |
| LOW | test.py | 354 | def test_get_timestamp_from_str_valid(self): | CODE |
| LOW | test.py | 364 | def test_get_timestamp_from_str_empty(self): | CODE |
| LOW | test.py | 376 | def test_get_timestamp_from_str_invalid(self): | CODE |
| LOW | test.py | 392 | def test_get_timestamp_from_tx_hash_success(self, mock_input): | CODE |
| LOW | test.py | 422 | def test_get_addresses_from_tx_hash_success(self, mock_run_cast): | CODE |
| LOW | test.py | 450 | def test_get_addresses_from_tx_hash_with_contract_creation(self, mock_run_cast): | CODE |
| LOW | test.py | 519 | def test_update_readme_file_not_found(self, mock_open): | CODE |
| LOW | test.py | 533 | def test_update_readme_read_failure_returns_false(self, mock_open): | CODE |
| LOW | test.py | 542 | def test_update_readme_write_failure_returns_false(self, mock_open): | CODE |
| LOW | test.py | 627 | def test_update_sum_of_incidents(self): | CODE |
| LOW | test.py | 635 | def test_get_run_command_without_shanghai(self): | CODE |
| LOW | test.py | 647 | def test_get_run_command_with_shanghai(self): | CODE |
| LOW | test.py | 660 | def test_check_readme_entry_exists(self, mock_open): | CODE |
| LOW | test.py | 670 | def test_check_readme_entry_not_exists(self, mock_open): | CODE |
| LOW | test.py | 747 | def test_create_poc_solidity_file_template_not_found(self, mock_open): | CODE |
| LOW | test.py | 765 | def test_create_poc_solidity_file_template_read_failure_returns_false(self, mock_open, mock_makedirs): | CODE |
| LOW | test.py | 778 | def test_create_poc_solidity_file_write_failure_returns_false(self, mock_open, mock_makedirs): | CODE |
| LOW | test.py | 791 | def test_replace_placeholders(self): | CODE |
| LOW | test.py | 811 | def test_is_git_command_available_true(self, mock_check_output): | CODE |
| LOW | test.py | 822 | def test_is_git_command_available_false(self, mock_check_output): | CODE |
| LOW | test.py | 832 | def test_get_uncommitted_sol_files_success(self, mock_check_output): | CODE |
| LOW | test.py | 846 | def test_get_uncommitted_sol_files_git_not_available(self): | CODE |
| LOW | test.py | 857 | def test_get_recently_committed_sol_files_success(self, mock_check_output): | CODE |
| LOW | test.py | 871 | def test_get_recently_committed_sol_files_git_not_available(self): | CODE |
| LOW | test.py | 913 | def test_get_file_extra_info_basic(self, mock_input): | CODE |
| LOW | test.py | 939 | def test_add_new_entry_with_poc_file(self, mock_input): | CODE |
| LOW | test.py | 985 | def test_process_existing_files(self, mock_input): | CODE |
| LOW | test.py | 1055 | def test_add_entry_cli_unknown_network_without_rpc_fails(self): | CODE |
| LOW | test.py | 1065 | def test_add_entry_cli_registers_network_with_rpc(self): | CODE |
| LOW | test.py | 1077 | def test_add_entry_cli_create_poc(self): | CODE |
| LOW | test.py | 1119 | def test_add_entry_cli_fails_when_readme_missing(self): | CODE |
| LOW | test.py | 1129 | def test_add_entry_cli_fails_when_poc_template_missing(self): | CODE |
| LOW | test.py | 1143 | def test_add_entry_cli_fails_when_foundry_toml_update_fails(self): | CODE |
| LOW | test.py | 1156 | def test_get_timestamp_auto_confirm_skips_prompt(self): | CODE |
| LOW | test.py | 89 | def test_parse_foundry_toml_success(self, mock_open): | STRING |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CONTRIBUTING.md | 19 | ### Step 1: Fork and Clone the Repository | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 118 | ### Step 2: Automatic Updates | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 126 | ### Step 3: Implement the Exploit Code | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 136 | ### Step 4: Test and Commit Your Changes | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ko/readme.md | 314 | ### Step 4: 취약점 분석 | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ko/readme.md | 382 | ### Step 5: 공격 재현 | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 95 | ### Step 1: Information gathering | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 114 | ### Step 2: Transaction Debugging | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 166 | ### Step 3: Reproduce code | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 310 | ### Step 4: Analyzing the exploit | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 379 | ### Step 5: Reproduce | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 103 | ### Step 1: transfer any remaining assets | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 111 | ### Step 2: seek help from a security team and track funds | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 119 | ### Step 3: Count the amount of your stolen funds and keep related evidence | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 123 | ### Step 4: report the case to the law enforcement agency | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 127 | ### Step 5: continue to follow up and maintain communication | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | test.py | 516 | mock_open.return_value.__enter__.return_value.write.assert_called_with("Updated README") | CODE |
| CRITICAL | test.py | 744 | mock_open.return_value.__enter__.return_value.write.assert_called_with("Modified template content") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ja/readme.md | 181 | COMMENT | |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ko/readme.md | 181 | import "forge-std/Test.sol"; | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/es/readme.md | 181 | // Attack Contract : 0xc30808d9373093fbfcec9e026457c6a9dab706a7 | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 181 | // Attacker : 0xee0221d76504aec40f63ad7e36855eebf5ea5edd | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | add_new_entry.py | 16 | CODE | |
| LOW | test.py | 11 | CODE | |
| LOW | test.py | 12 | CODE | |
| LOW | test.py | 13 | CODE | |
| LOW | test.py | 19 | CODE | |
| LOW | test.py | 24 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | add_new_entry.py | 396 | CODE | |
| LOW | add_new_entry.py | 489 | CODE | |
| LOW | test.py | 939 | CODE | |
| LOW | test.py | 985 | CODE |