Reproduce DeFi hacked incidents using Foundry.
This report presents the forensic synthetic code analysis of SunWeb3Sec/DeFiHackLabs, a Solidity project with 6,633 GitHub stars. SynthScan v2.0 examined 33,967 lines of code across 81 source files, recording 104 pattern matches distributed across 7 syntactic categories. The overall adjusted score of 4.1 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 104 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | add_new_entry.py | 603 | def _update_table_of_contents(self, content: str, formatted_date: str, name: str, additional_details: str) -> str: | CODE |
| LOW | add_new_entry.py | 412 | def is_cast_command_available(self) -> bool: | CODE |
| LOW | add_new_entry.py | 454 | def get_timestamp_from_tx_hash(self, tx_hash: str, rpc_url: str, auto_confirm: bool = False) -> str: | CODE |
| LOW | add_new_entry.py | 504 | def get_addresses_from_tx_hash(self, tx_hash: str, rpc_url: str) -> Optional[Tuple[str, str, str]]: | CODE |
| LOW | add_new_entry.py | 729 | def get_uncommitted_sol_files(self): | CODE |
| LOW | add_new_entry.py | 746 | def get_recently_committed_sol_files(self) -> list: | CODE |
| LOW⚡ | test.py | 945 | def test_timestamp_and_tx_hash_are_mutually_exclusive(self): | CODE |
| LOW⚡ | test.py | 950 | def test_main_without_network_runs_interactive(self): | CODE |
| LOW⚡ | test.py | 958 | def test_main_non_interactive_requires_file_and_amount(self): | CODE |
| LOW⚡ | test.py | 964 | def test_main_non_interactive_dispatches_to_add_entry_cli(self): | CODE |
| LOW⚡ | test.py | 973 | def test_add_entry_cli_updates_readme_with_network(self): | CODE |
| LOW | test.py | 38 | def test_constants_initialization(self): | CODE |
| LOW | test.py | 109 | def test_parse_foundry_toml_file_not_found(self, mock_open): | CODE |
| LOW | test.py | 121 | def test_parse_foundry_toml_decode_error(self, mock_open): | CODE |
| LOW | test.py | 136 | def test_update_foundry_toml_success(self, mock_open): | CODE |
| LOW | test.py | 167 | def test_update_foundry_toml_file_not_found(self, mock_open): | CODE |
| LOW | test.py | 176 | def test_select_network_choose_existing(self, mock_input): | CODE |
| LOW | test.py | 195 | def test_select_network_add_new(self, mock_input): | CODE |
| LOW | test.py | 238 | def test_select_network_invalid_choice(self, mock_input): | CODE |
| LOW | test.py | 264 | def test_is_cast_command_available_true(self, mock_check_output): | CODE |
| LOW | test.py | 275 | def test_is_cast_command_available_false(self, mock_check_output): | CODE |
| LOW | test.py | 287 | def test_run_cast_command_success(self, mock_run): | CODE |
| LOW | test.py | 311 | def test_run_cast_command_error(self, mock_run): | CODE |
| LOW | test.py | 336 | def test_get_timestamp_from_str_valid(self): | CODE |
| LOW | test.py | 346 | def test_get_timestamp_from_str_empty(self): | CODE |
| LOW | test.py | 358 | def test_get_timestamp_from_str_invalid(self): | CODE |
| LOW | test.py | 374 | def test_get_timestamp_from_tx_hash_success(self, mock_input): | CODE |
| LOW | test.py | 404 | def test_get_addresses_from_tx_hash_success(self, mock_run_cast): | CODE |
| LOW | test.py | 432 | def test_get_addresses_from_tx_hash_with_contract_creation(self, mock_run_cast): | CODE |
| LOW | test.py | 501 | def test_update_readme_file_not_found(self, mock_open): | CODE |
| LOW | test.py | 587 | def test_update_sum_of_incidents(self): | CODE |
| LOW | test.py | 595 | def test_get_run_command_without_shanghai(self): | CODE |
| LOW | test.py | 607 | def test_get_run_command_with_shanghai(self): | CODE |
| LOW | test.py | 620 | def test_check_readme_entry_exists(self, mock_open): | CODE |
| LOW | test.py | 630 | def test_check_readme_entry_not_exists(self, mock_open): | CODE |
| LOW | test.py | 707 | def test_create_poc_solidity_file_template_not_found(self, mock_open): | CODE |
| LOW | test.py | 722 | def test_replace_placeholders(self): | CODE |
| LOW | test.py | 742 | def test_is_git_command_available_true(self, mock_check_output): | CODE |
| LOW | test.py | 753 | def test_is_git_command_available_false(self, mock_check_output): | CODE |
| LOW | test.py | 763 | def test_get_uncommitted_sol_files_success(self, mock_check_output): | CODE |
| LOW | test.py | 777 | def test_get_uncommitted_sol_files_git_not_available(self): | CODE |
| LOW | test.py | 788 | def test_get_recently_committed_sol_files_success(self, mock_check_output): | CODE |
| LOW | test.py | 802 | def test_get_recently_committed_sol_files_git_not_available(self): | CODE |
| LOW | test.py | 844 | def test_get_file_extra_info_basic(self, mock_input): | CODE |
| LOW | test.py | 870 | def test_add_new_entry_with_poc_file(self, mock_input): | CODE |
| LOW | test.py | 916 | def test_process_existing_files(self, mock_input): | CODE |
| LOW | test.py | 986 | def test_add_entry_cli_unknown_network_without_rpc_fails(self): | CODE |
| LOW | test.py | 996 | def test_add_entry_cli_registers_network_with_rpc(self): | CODE |
| LOW | test.py | 1008 | def test_add_entry_cli_create_poc(self): | CODE |
| LOW | test.py | 1020 | def test_get_timestamp_auto_confirm_skips_prompt(self): | CODE |
| LOW | test.py | 88 | def test_parse_foundry_toml_success(self, mock_open): | STRING |
| LOW | test.py | 486 | def test_update_readme_success(self, mock_open): | STRING |
| LOW | test.py | 566 | def test_update_table_of_contents(self): | STRING |
| LOW | test.py | 675 | def test_create_poc_solidity_file_success(self, mock_open, mock_makedirs): | STRING |
| LOW | academy/solidity/02_first_deposit/readme.md | 26 | function exchangeRateStoredInternal() virtual internal view returns (uint) { | CODE |
| LOW | academy/solidity/02_first_deposit/en/readme.md | 24 | function exchangeRateStoredInternal() virtual internal view returns (uint) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | add_new_entry.py | 334 | print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Please ensure the file exists in the current di | CODE |
| MEDIUM⚡ | add_new_entry.py | 337 | print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Please check its format.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 346 | print(f"Error: {self.constants.FOUNDRY_TOML_PATH} not found. Cannot update RPC endpoints.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 349 | print(f"Error: Could not decode {self.constants.FOUNDRY_TOML_PATH}. Cannot update RPC endpoints.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 359 | print(f"Error: Could not write to {self.constants.FOUNDRY_TOML_PATH}.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 428 | print(f"Error calling 'cast' for {command_description}: {e}") | CODE |
| MEDIUM⚡ | add_new_entry.py | 433 | print(f"Error parsing JSON output from 'cast' for {command_description}.") | CODE |
| MEDIUM⚡ | add_new_entry.py | 597 | print(f"Error: Could not find insertion point in {self.constants.README_PATH} using regex: {self.constants.L | CODE |
| MEDIUM⚡ | add_new_entry.py | 611 | print(f"Error: Could not find Table of Contents section in {self.constants.README_PATH} using regex: {self.c | CODE |
| MEDIUM | add_new_entry.py | 290 | print(f"Error: network '{args.network}' not found in {self.constants.FOUNDRY_TOML_PATH}. " | CODE |
| MEDIUM | add_new_entry.py | 547 | print(f"Error: {self.constants.README_PATH} not found. Please ensure the file exists in the current director | CODE |
| MEDIUM | add_new_entry.py | 641 | print(f"Error: {self.constants.README_PATH} not found. Cannot check for existing entries.") | CODE |
| MEDIUM | add_new_entry.py | 673 | print(f"Error: {self.constants.POC_TEMPLATE_PATH} not found. Cannot create POC file.") | CODE |
| LOW⚡ | add_new_entry.py | 438 | except Exception as e: | CODE |
| MEDIUM | test.py | 30 | print("Error: Could not import the DefiHackLibrary module.") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CONTRIBUTING.md | 19 | ### Step 1: Fork and Clone the Repository | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 116 | ### Step 2: Automatic Updates | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 124 | ### Step 3: Implement the Exploit Code | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 134 | ### Step 4: Test and Commit Your Changes | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ko/readme.md | 314 | ### Step 4: 취약점 분석 | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ko/readme.md | 382 | ### Step 5: 공격 재현 | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 95 | ### Step 1: Information gathering | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 114 | ### Step 2: Transaction Debugging | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 166 | ### Step 3: Reproduce code | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 310 | ### Step 4: Analyzing the exploit | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 379 | ### Step 5: Reproduce | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 103 | ### Step 1: transfer any remaining assets | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 111 | ### Step 2: seek help from a security team and track funds | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 119 | ### Step 3: Count the amount of your stolen funds and keep related evidence | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 123 | ### Step 4: report the case to the law enforcement agency | COMMENT |
| LOW⚡ | academy/user_awareness/06_Report_stolen/en/readme.md | 127 | ### Step 5: continue to follow up and maintain communication | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | test.py | 498 | mock_open.return_value.__enter__.return_value.write.assert_called_with("Updated README") | CODE |
| CRITICAL | test.py | 704 | mock_open.return_value.__enter__.return_value.write.assert_called_with("Modified template content") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ja/readme.md | 181 | COMMENT | |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/ko/readme.md | 181 | import "forge-std/Test.sol"; | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/es/readme.md | 181 | // Attack Contract : 0xc30808d9373093fbfcec9e026457c6a9dab706a7 | COMMENT |
| LOW | …ademy/onchain_debug/03_write_your_own_poc/en/readme.md | 181 | // Attacker : 0xee0221d76504aec40f63ad7e36855eebf5ea5edd | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | add_new_entry.py | 16 | CODE | |
| LOW | test.py | 11 | CODE | |
| LOW | test.py | 12 | CODE | |
| LOW | test.py | 13 | CODE | |
| LOW | test.py | 17 | CODE | |
| LOW | test.py | 18 | CODE | |
| LOW | test.py | 23 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | add_new_entry.py | 361 | CODE | |
| LOW | add_new_entry.py | 454 | CODE | |
| LOW | test.py | 870 | CODE | |
| LOW | test.py | 916 | CODE |