AI Slop Code Risk Monitor

SunWeb3Sec/DeFiHackLabs

SlopCodeMonitor badge for SunWeb3Sec/DeFiHackLabs Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Reproduce DeFi hacked incidents using Foundry.

4.7 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for SunWeb3Sec/DeFiHackLabs, a Solidity project with 6,830 GitHub stars. SynthScan examined 34,914 lines of code across 81 source files, recording 122 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 4.7 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

4.7
Adjusted Signal
4.7
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
6.8K
Stars
Solidity
Language
34.9K
Lines of Code
81
Files
122
Pattern Hits
2026-10-31
Scan Date
0.02
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 11.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 89 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.2/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 14.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 90 finding(s).

PR Review Velocity Impact 23.6/100 · LOW

Which changes need focused human review? 122 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 0MEDIUM 24LOW 96

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 122 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Excessive Try-Catch Wrapping25 hits · 60 pts
SeverityFileLineSnippetContext
MEDIUM⚡add_new_entry.py355 print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Please ensure the file exists in the current diCODE
MEDIUM⚡add_new_entry.py358 print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Please check its format.")CODE
MEDIUM⚡add_new_entry.py361 print(f"Error: Could not read {self.constants.FOUNDRY_TOML_PATH}: {e}")CODE
MEDIUM⚡add_new_entry.py375 print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Cannot update RPC endpoints.")CODE
MEDIUM⚡add_new_entry.py378 print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Cannot update RPC endpoints.")CODE
MEDIUM⚡add_new_entry.py381 print(f"Error: Could not read {self.constants.FOUNDRY_TOML_PATH}: {e}")CODE
MEDIUM⚡add_new_entry.py390 print(f"Error: Could not write to {self.constants.FOUNDRY_TOML_PATH}: {e}")CODE
MEDIUM⚡add_new_entry.py463 print(f"Error calling 'cast' for {command_description}: {e}")CODE
MEDIUM⚡add_new_entry.py468 print(f"Error parsing JSON output from 'cast' for {command_description}.")CODE
MEDIUM⚡add_new_entry.py650 print(f"Error: Could not find insertion point in {self.constants.README_PATH} using regex: {self.constants.LCODE
MEDIUM⚡add_new_entry.py664 print(f"Error: Could not find Table of Contents section in {self.constants.README_PATH} using regex: {self.cCODE
MEDIUM⚡add_new_entry.py728 print(f"Error: Could not create directory {os.path.dirname(new_file_path)}: {e}")CODE
MEDIUM⚡add_new_entry.py736 print(f"Error: {self.constants.POC_TEMPLATE_PATH} not found. Cannot create POC file.")CODE
MEDIUM⚡add_new_entry.py739 print(f"Error: Could not read POC template {self.constants.POC_TEMPLATE_PATH}: {e}")CODE
MEDIUMadd_new_entry.py303 print(f"Error: network '{args.network}' not found in {self.constants.FOUNDRY_TOML_PATH}. "CODE
MEDIUMadd_new_entry.py308 print("Error: could not register the network in "CODE
MEDIUMadd_new_entry.py329 print("Error: POC file was not created. Aborting.")CODE
MEDIUMadd_new_entry.py334 print("Error: README.md was not updated. Aborting.")CODE
MEDIUMadd_new_entry.py590 print(f"Error: {self.constants.README_PATH} not found. Please ensure the file exists in the current directorCODE
MEDIUMadd_new_entry.py594 print(f"Error: Could not read {self.constants.README_PATH}: {e}")CODE
MEDIUMadd_new_entry.py606 print(f"Error: Could not write to {self.constants.README_PATH}: {e}")CODE
MEDIUMadd_new_entry.py694 print(f"Error: {self.constants.README_PATH} not found. Cannot check for existing entries.")CODE
MEDIUMadd_new_entry.py773 print(f"Error: Could not write POC file {new_file_path}: {e}")CODE
LOW⚡add_new_entry.py473 except Exception as e:CODE
MEDIUMtest.py31 print("Error: Could not import the DefiHackLibrary module.")CODE
Hyper-Verbose Identifiers65 hits · 46 pts
SeverityFileLineSnippetContext
LOW⚡add_new_entry.py656 def _update_table_of_contents(self, content: str, formatted_date: str, name: str, additional_details: str) -> str:CODE
LOWadd_new_entry.py447 def is_cast_command_available(self) -> bool:CODE
LOWadd_new_entry.py489 def get_timestamp_from_tx_hash(self, tx_hash: str, rpc_url: str, auto_confirm: bool = False) -> str:CODE
LOWadd_new_entry.py541 def get_addresses_from_tx_hash(self, tx_hash: str, rpc_url: str) -> Optional[Tuple[str, str, str]]:CODE
LOWadd_new_entry.py800 def get_uncommitted_sol_files(self):CODE
LOWadd_new_entry.py817 def get_recently_committed_sol_files(self) -> list:CODE
LOW⚡test.py168 def test_update_foundry_toml_file_not_found(self, mock_open):CODE
LOW⚡test.py178 def test_update_foundry_toml_read_failure_returns_false(self, mock_open):CODE
LOW⚡test.py184 def test_update_foundry_toml_write_failure_returns_false(self, mock_open):CODE
LOW⚡test.py194 def test_select_network_choose_existing(self, mock_input):CODE
LOW⚡test.py1014 def test_timestamp_and_tx_hash_are_mutually_exclusive(self):CODE
LOW⚡test.py1019 def test_main_without_network_runs_interactive(self):CODE
LOW⚡test.py1027 def test_main_non_interactive_requires_file_and_amount(self):CODE
LOW⚡test.py1033 def test_main_non_interactive_dispatches_to_add_entry_cli(self):CODE
LOW⚡test.py1042 def test_add_entry_cli_updates_readme_with_network(self):CODE
LOWtest.py39 def test_constants_initialization(self):CODE
LOWtest.py110 def test_parse_foundry_toml_file_not_found(self, mock_open):CODE
LOWtest.py122 def test_parse_foundry_toml_decode_error(self, mock_open):CODE
LOWtest.py137 def test_update_foundry_toml_success(self, mock_open):CODE
LOWtest.py213 def test_select_network_add_new(self, mock_input):CODE
LOWtest.py256 def test_select_network_invalid_choice(self, mock_input):CODE
LOWtest.py282 def test_is_cast_command_available_true(self, mock_check_output):CODE
LOWtest.py293 def test_is_cast_command_available_false(self, mock_check_output):CODE
LOWtest.py305 def test_run_cast_command_success(self, mock_run):CODE
LOWtest.py329 def test_run_cast_command_error(self, mock_run):CODE
LOWtest.py354 def test_get_timestamp_from_str_valid(self):CODE
LOWtest.py364 def test_get_timestamp_from_str_empty(self):CODE
LOWtest.py376 def test_get_timestamp_from_str_invalid(self):CODE
LOWtest.py392 def test_get_timestamp_from_tx_hash_success(self, mock_input):CODE
LOWtest.py422 def test_get_addresses_from_tx_hash_success(self, mock_run_cast):CODE
LOWtest.py450 def test_get_addresses_from_tx_hash_with_contract_creation(self, mock_run_cast):CODE
LOWtest.py519 def test_update_readme_file_not_found(self, mock_open):CODE
LOWtest.py533 def test_update_readme_read_failure_returns_false(self, mock_open):CODE
LOWtest.py542 def test_update_readme_write_failure_returns_false(self, mock_open):CODE
LOWtest.py627 def test_update_sum_of_incidents(self):CODE
LOWtest.py635 def test_get_run_command_without_shanghai(self):CODE
LOWtest.py647 def test_get_run_command_with_shanghai(self):CODE
LOWtest.py660 def test_check_readme_entry_exists(self, mock_open):CODE
LOWtest.py670 def test_check_readme_entry_not_exists(self, mock_open):CODE
LOWtest.py747 def test_create_poc_solidity_file_template_not_found(self, mock_open):CODE
LOWtest.py765 def test_create_poc_solidity_file_template_read_failure_returns_false(self, mock_open, mock_makedirs):CODE
LOWtest.py778 def test_create_poc_solidity_file_write_failure_returns_false(self, mock_open, mock_makedirs):CODE
LOWtest.py791 def test_replace_placeholders(self):CODE
LOWtest.py811 def test_is_git_command_available_true(self, mock_check_output):CODE
LOWtest.py822 def test_is_git_command_available_false(self, mock_check_output):CODE
LOWtest.py832 def test_get_uncommitted_sol_files_success(self, mock_check_output):CODE
LOWtest.py846 def test_get_uncommitted_sol_files_git_not_available(self):CODE
LOWtest.py857 def test_get_recently_committed_sol_files_success(self, mock_check_output):CODE
LOWtest.py871 def test_get_recently_committed_sol_files_git_not_available(self):CODE
LOWtest.py913 def test_get_file_extra_info_basic(self, mock_input):CODE
LOWtest.py939 def test_add_new_entry_with_poc_file(self, mock_input):CODE
LOWtest.py985 def test_process_existing_files(self, mock_input):CODE
LOWtest.py1055 def test_add_entry_cli_unknown_network_without_rpc_fails(self):CODE
LOWtest.py1065 def test_add_entry_cli_registers_network_with_rpc(self):CODE
LOWtest.py1077 def test_add_entry_cli_create_poc(self):CODE
LOWtest.py1119 def test_add_entry_cli_fails_when_readme_missing(self):CODE
LOWtest.py1129 def test_add_entry_cli_fails_when_poc_template_missing(self):CODE
LOWtest.py1143 def test_add_entry_cli_fails_when_foundry_toml_update_fails(self):CODE
LOWtest.py1156 def test_get_timestamp_auto_confirm_skips_prompt(self):CODE
LOWtest.py89 def test_parse_foundry_toml_success(self, mock_open):STRING
5 more matches not shown…
Structural Annotation Overuse16 hits · 30 pts
SeverityFileLineSnippetContext
LOWCONTRIBUTING.md19### Step 1: Fork and Clone the RepositoryCOMMENT
LOW⚡CONTRIBUTING.md118### Step 2: Automatic UpdatesCOMMENT
LOW⚡CONTRIBUTING.md126### Step 3: Implement the Exploit CodeCOMMENT
LOW⚡CONTRIBUTING.md136### Step 4: Test and Commit Your ChangesCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/ko/readme.md314### Step 4: 취약점 분석COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/ko/readme.md382### Step 5: 공격 재현COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md95### Step 1: Information gatheringCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md114### Step 2: Transaction DebuggingCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md166### Step 3: Reproduce codeCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md310### Step 4: Analyzing the exploitCOMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md379### Step 5: ReproduceCOMMENT
LOW⚡academy/user_awareness/06_Report_stolen/en/readme.md103 ### Step 1: transfer any remaining assetsCOMMENT
LOW⚡academy/user_awareness/06_Report_stolen/en/readme.md111 ### Step 2: seek help from a security team and track fundsCOMMENT
LOW⚡academy/user_awareness/06_Report_stolen/en/readme.md119 ### Step 3: Count the amount of your stolen funds and keep related evidenceCOMMENT
LOW⚡academy/user_awareness/06_Report_stolen/en/readme.md123 ### Step 4: report the case to the law enforcement agencyCOMMENT
LOW⚡academy/user_awareness/06_Report_stolen/en/readme.md127 ### Step 5: continue to follow up and maintain communicationCOMMENT
Hallucination Indicators2 hits · 20 pts
SeverityFileLineSnippetContext
CRITICALtest.py516 mock_open.return_value.__enter__.return_value.write.assert_called_with("Updated README")CODE
CRITICALtest.py744 mock_open.return_value.__enter__.return_value.write.assert_called_with("Modified template content")CODE
Over-Commented Block4 hits · 4 pts
SeverityFileLineSnippetContext
LOW…ademy/onchain_debug/03_write_your_own_poc/ja/readme.md181COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/ko/readme.md181import "forge-std/Test.sol";COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/es/readme.md181// Attack Contract : 0xc30808d9373093fbfcec9e026457c6a9dab706a7COMMENT
LOW…ademy/onchain_debug/03_write_your_own_poc/en/readme.md181// Attacker : 0xee0221d76504aec40f63ad7e36855eebf5ea5eddCOMMENT
Unused Imports6 hits · 3 pts
SeverityFileLineSnippetContext
LOWadd_new_entry.py16CODE
LOWtest.py11CODE
LOWtest.py12CODE
LOWtest.py13CODE
LOWtest.py19CODE
LOWtest.py24CODE
Deep Nesting4 hits · 2 pts
SeverityFileLineSnippetContext
LOWadd_new_entry.py396CODE
LOWadd_new_entry.py489CODE
LOWtest.py939CODE
LOWtest.py985CODE