Foundry is a blazing fast, portable and modular toolkit for Ethereum application development written in Rust.
This report summarizes scanner evidence for foundry-rs/foundry, a Rust project with 10,740 GitHub stars. SynthScan examined 612,204 lines of code across 1245 source files, recording 1246 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 2.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 1181 finding(s).
Are imports declared and package/API names verified? 41 finding(s).
Are wrappers, guards, and repeated structures necessary? 475 finding(s).
Which changes need focused human review? 1246 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1246 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 621 | alloy-sol-type-parser = { git = "https://github.com/alloy-rs/core", rev = "1e17055e111d087cd303186f9c4eeaee9af11684" } | COMMENT |
| LOW | Cargo.toml | 641 | # alloy-rpc-types-eth = { git = "https://github.com/alloy-rs/alloy", rev = "395521c" } | COMMENT |
| LOW | deny.toml | 1 | # This section is considered when running `cargo deny check advisories` | COMMENT |
| LOW | deny.toml | 101 | license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }] | COMMENT |
| LOW | crates/test-utils/macros/src/lib.rs | 21 | /// a multi-threaded Tokio runtime. | COMMENT |
| LOW | crates/test-utils/src/util.rs | 41 | /// | COMMENT |
| LOW | crates/test-utils/src/prj.rs | 101 | fn from(id: T) -> Self { | COMMENT |
| LOW | crates/lint/src/sol/high/arbitrary_send_erc20.rs | 561 | _ => {} | COMMENT |
| LOW | crates/lint/src/sol/med/unsafe_oz_erc721_mint.rs | 981 | } | COMMENT |
| LOW | crates/lint/src/sol/med/cheatcode_environment.rs | 1 | //! Finds raw environment reads whose values can cross a Foundry environment mutation. | COMMENT |
| LOW | crates/verify/src/verify.rs | 361 | /// Wait for verification result after submission. | COMMENT |
| LOW | crates/verify/src/verify.rs | 381 | /// Prints the standard json compiler input. | COMMENT |
| LOW | crates/verify/src/bytecode.rs | 121 | /// Etherscan options. | COMMENT |
| LOW | crates/verify/src/etherscan/flatten.rs | 61 | /// provided compiler. If the compiler is missing it will be installed. | COMMENT |
| LOW | crates/config/src/coverage.rs | 21 | Attribution, | COMMENT |
| LOW | crates/config/src/coverage.rs | 41 | #[serde(default = "default_lcov_version", deserialize_with = "deserialize_lcov_version")] | COMMENT |
| LOW | crates/config/src/coverage.rs | 61 | pub exclude_tests: bool, | COMMENT |
| LOW | crates/config/src/fee.rs | 1 | //! EIP-1559 fee estimation configuration. | COMMENT |
| LOW | crates/config/src/symbolic.rs | 41 | /// Whether fuzz branch frontiers should guide targeted symbolic fuzz-test seeding. | COMMENT |
| LOW | crates/config/src/symbolic.rs | 61 | pub solver_command: Option<String>, | COMMENT |
| LOW | crates/config/src/symbolic.rs | 81 | /// Maximum number of calls in a bounded symbolic invariant sequence. | COMMENT |
| LOW | crates/config/src/vyper.rs | 21 | #[serde(default, skip_serializing_if = "Option::is_none")] | COMMENT |
| LOW | crates/config/src/extend.rs | 1 | use std::collections::HashMap; | COMMENT |
| LOW | crates/config/src/mutation.rs | 41 | Vec::new() | COMMENT |
| LOW | crates/config/src/mutation.rs | 61 | /// other mutants can proceed. Cleanup backlog is bounded by the configured | COMMENT |
| LOW | crates/config/src/error.rs | 101 | COMMENT | |
| LOW | crates/config/src/fs_permissions.rs | 41 | } | COMMENT |
| LOW | crates/config/src/lib.rs | 161 | #[cfg(not(test))] | COMMENT |
| LOW | crates/config/src/lib.rs | 181 | /// The profile is set to the value of the `profile` field. | COMMENT |
| LOW | crates/config/src/lib.rs | 201 | /// selected on the `Figment`. When a `Config` is extracted, this field is | COMMENT |
| LOW | crates/config/src/lib.rs | 221 | /// Base files cannot extend (inherit) other files. | COMMENT |
| LOW | crates/config/src/lib.rs | 241 | pub auto_detect_remappings: bool, | COMMENT |
| LOW | crates/config/src/lib.rs | 281 | /// Whether to include gas reports for tests. | COMMENT |
| LOW | crates/config/src/lib.rs | 301 | /// install it | COMMENT |
| LOW | crates/config/src/lib.rs | 321 | pub model_checker: Option<ModelCheckerSettings>, | COMMENT |
| LOW | crates/config/src/lib.rs | 341 | /// rpc_headers = ["x-custom-header:value", "x-another-header:another-value"] | COMMENT |
| LOW | crates/config/src/lib.rs | 361 | pub deny: DenyLevel, | COMMENT |
| LOW | crates/config/src/lib.rs | 381 | #[serde(rename = "no_match_path", with = "from_opt_glob")] | COMMENT |
| LOW | crates/config/src/lib.rs | 401 | pub coverage: CoverageConfig, | COMMENT |
| LOW | crates/config/src/lib.rs | 441 | /// Block gas limit. | COMMENT |
| LOW | crates/config/src/lib.rs | 461 | pub block_difficulty: u64, | COMMENT |
| LOW | crates/config/src/lib.rs | 481 | /// "evm.bytecode", | COMMENT |
| LOW | crates/config/src/lib.rs | 501 | /// Whether to print the names of the compiled contracts. | COMMENT |
| LOW | crates/config/src/lib.rs | 521 | /// Disables storage caching entirely. This overrides any settings made in | COMMENT |
| LOW | crates/config/src/lib.rs | 541 | /// so results do not change; unused keys cost extra RPC requests. Requires storage caching. | COMMENT |
| LOW | crates/config/src/lib.rs | 561 | /// | COMMENT |
| LOW | crates/config/src/lib.rs | 581 | /// Configuration for `forge fmt` | COMMENT |
| LOW | crates/config/src/lib.rs | 601 | COMMENT | |
| LOW | crates/config/src/lib.rs | 661 | COMMENT | |
| LOW | crates/config/src/lib.rs | 681 | /// PRIVATE: This structure may grow, As such, constructing this structure should | COMMENT |
| LOW | crates/config/src/lib.rs | 881 | /// Unlike [`load_with_root`](Self::load_with_root), if the selected profile (via | COMMENT |
| LOW | crates/config/src/lib.rs | 1241 | /// src = "src" | COMMENT |
| LOW | crates/config/src/lib.rs | 1381 | /// Returns the directory in which dependencies should be installed | COMMENT |
| LOW | crates/config/src/lib.rs | 1921 | /// | COMMENT |
| LOW | crates/config/src/lib.rs | 1941 | /// # Example | COMMENT |
| LOW | crates/config/src/lib.rs | 1961 | /// # Returns | COMMENT |
| LOW | crates/config/src/lib.rs | 2041 | /// let rpc_url = config.get_rpc_url_or("http://localhost:8545").unwrap(); | COMMENT |
| LOW | crates/config/src/lib.rs | 2061 | /// ``` | COMMENT |
| LOW | crates/config/src/lib.rs | 2341 | venom: self.vyper.venom.clone(), | COMMENT |
| LOW | crates/config/src/lib.rs | 2361 | /// use serde::Deserialize; | COMMENT |
| 616 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …9d27527Ada2CF29fBDAB2973cfa243845a08Bd3F/metadata.json | 13 | "content": "// SPDX-License-Identifier: MIT\npragma solidity 0.8.9;\n\nimport \"@openzeppelin/contracts/utils/ | CODE |
| LOW | …9d27527Ada2CF29fBDAB2973cfa243845a08Bd3F/metadata.json | 43 | "content": "// SPDX-License-Identifier: MIT\npragma solidity 0.8.9;\n\nimport \"./BleepsRoles.sol\";\nimport \ | CODE |
| LOW | …Db53f47aC61FE54F456A4eb3E09832D08Dd7BEec/metadata.json | 1 | [{"SourceCode":{"language":"Solidity","sources":{"@solidstate/contracts/token/ERC1155/base/ERC1155Base.sol":{"content":" | CODE |
| LOW | …3a23F943181408EAC424116Af7b7790c94Cb97a5/metadata.json | 1 | [{"SourceCode":{"language":"Solidity","sources":{"src/bridges/hop/interfaces/amm.sol":{"content":"// SPDX-License-Identi | CODE |
| LOW | …9AB6b21cDF116f611110b048987E58894786C244/metadata.json | 1 | [{"SourceCode":{"language":"Solidity","sources":{"contracts/InterestRates/InterestRatePositionManager.f.sol":{"content": | CODE |
| LOW | …71356E37e0368Bd10bFDbF41dC052fE5FA24cD05/metadata.json | 1 | [{"SourceCode":{"language":"Solidity","sources":{"@openzeppelin/contracts/access/IAccessControl.sol":{"content":"// SPDX | CODE |
| LOW | …35Fb958109b70799a8f9Bc2a8b1Ee4cC62034193/metadata.json | 1 | [{"SourceCode":"/**\r\n *Submitted for verification at Etherscan.io on 2022-02-19\r\n*/\r\n\r\n/**\r\n *Submitted for ve | CODE |
| LOW | …044b75f554b886A065b9567891e45c79542d7357/metadata.json | 1 | [{"SourceCode":{"language":"Solidity","sources":{"contracts/InputStream.sol":{"content":"// SPDX-License-Identifier: UNL | CODE |
| LOW⚡ | crates/cast/tests/cli/selectors.rs | 311 | function myUniqueFunctionWithinLocalProject(uint256 a) external { | CODE |
| LOW⚡ | crates/cast/tests/cli/selectors.rs | 321 | function myUniqueLibFunctionWithinLocalProject(E) external pure {} | CODE |
| LOW⚡ | crates/cast/tests/cli/selectors.rs | 323 | function myUniqueLibStructWithinLocalProject(S calldata) external pure {} | CODE |
| LOW | crates/cast/tests/cli/run.rs | 196 | function updateCounterInExternalLib(CounterInExternalLib.Info storage counterInfo, uint256 counter) public { | CODE |
| LOW | crates/forge/tests/cli/coverage.rs | 1055 | function testTypeConversionCoverage() external { | CODE |
| LOW | crates/forge/tests/cli/coverage.rs | 4356 | function getArtifactPathByDeployedCode(bytes calldata code) external view returns (string memory); | CODE |
| LOW | crates/forge/tests/cli/coverage.rs | 4534 | function testConstructorTrailingData() external { | CODE |
| LOW | crates/forge/tests/cli/inline_config.rs | 343 | function testInlineIsolateCanCreateFile() public { | CODE |
| LOW | crates/forge/tests/cli/config.rs | 2668 | function testSnapshotGasSectionExternal() public {{ | CODE |
| LOW | crates/forge/tests/cli/build.rs | 260 | function testExternalArtifactIsDeployable() public { | CODE |
| LOW | crates/forge/tests/cli/failure_assertions.rs | 433 | function testDSTestFailingAssertions() public { | CODE |
| LOW | crates/forge/tests/cli/failure_assertions.rs | 483 | function testShouldBeMarkedAsFailedBecauseOfSetup() public { | CODE |
| LOW | crates/forge/tests/cli/failure_assertions.rs | 515 | function testFailShouldBeMarkedAsFailedBecauseOfAfterInvariant() | CODE |
| LOW | crates/forge/tests/cli/failure_assertions.rs | 551 | function testFailShouldBeMarkedAsFailedBecauseOfSetup() public { | CODE |
| LOW | crates/forge/tests/cli/failure_assertions.rs | 581 | function emitAnonymousEventNonIndexed(uint256 a) external { | CODE |
| LOW | crates/forge/tests/cli/failure_assertions.rs | 596 | function testShouldFailEmitDifferentEventNonIndexed() public { | CODE |
| LOW | crates/forge/tests/cli/failure_assertions.rs | 643 | function testShortPartialDoesNotMatch(uint256) public view { | CODE |
| LOW | crates/forge/tests/cli/json.rs | 26 | function testJsonParseAndSerialize() public { | CODE |
| LOW | crates/forge/tests/cli/lint.rs | 25 | function divideBeforeMultiplyMedium() public { | CODE |
| LOW | crates/forge/tests/cli/lint.rs | 1309 | 15 | function divideBeforeMultiplyMedium() public { | CODE |
| LOW | crates/forge/tests/cli/lint.rs | 1399 | 15 | function divideBeforeMultiplyMedium() public { | CODE |
| LOW | crates/forge/tests/cli/lint.rs | 1492 | 15 | function divideBeforeMultiplyMedium() public { | CODE |
| LOW⚡ | crates/forge/tests/cli/bind_json.rs | 91 | function deserializeTopLevelStruct(string memory json) public pure returns (TopLevelStruct memory) { | CODE |
| LOW⚡ | crates/forge/tests/cli/bind_json.rs | 95 | function deserializeTopLevelStruct(string memory json, string memory path) public pure returns (TopLevelStruct memor | CODE |
| LOW⚡ | crates/forge/tests/cli/bind_json.rs | 99 | function deserializeTopLevelStructArray(string memory json, string memory path) public pure returns (TopLevelStruct[ | CODE |
| LOW⚡ | crates/forge/tests/cli/bind_json.rs | 111 | function deserializeContractLevelStruct(string memory json) public pure returns (BindJsonTest.ContractLevelStruct me | CODE |
| LOW⚡ | crates/forge/tests/cli/bind_json.rs | 115 | function deserializeContractLevelStruct(string memory json, string memory path) public pure returns (BindJsonTest.Co | CODE |
| LOW⚡ | crates/forge/tests/cli/bind_json.rs | 119 | function deserializeContractLevelStructArray(string memory json, string memory path) public pure returns (BindJsonTe | CODE |
| LOW | crates/forge/tests/cli/svm.rs | 198 | function testLargeContractDeployment() public { | CODE |
| LOW | crates/forge/tests/cli/svm.rs | 209 | function testCalldataFloorPreservesRegularGas() public { | CODE |
| LOW | crates/forge/tests/cli/svm.rs | 223 | function testValueTransferWithLowGas() public { | CODE |
| LOW | crates/forge/tests/cli/svm.rs | 236 | function testStateGasSnapshotIncludesRefund() public { | CODE |
| LOW | crates/forge/tests/cli/svm.rs | 251 | function testCalldataFloorWithLowGas() public { | CODE |
| LOW | crates/forge/tests/cli/svm.rs | 261 | function testDeployCodeChargesCreateStateGas() public { | CODE |
| LOW | crates/forge/tests/cli/precompiles.rs | 483 | function expectKeychainAdminVerified(address account, bytes32 digest, bytes calldata signature) external; | CODE |
| LOW | crates/forge/tests/cli/doc.rs | 2390 | function explicitActionWithLocalNotice(uint256 value) external; | CODE |
| LOW | crates/forge/tests/cli/doc.rs | 2428 | function explicitActionWithLocalNotice(uint256 value) external override {} | CODE |
| LOW | crates/forge/tests/cli/test_cmd/core.rs | 58 | function testMultipleAssertFailures() public { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/core.rs | 113 | function testRevertedCallFailureIsDropped() public { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 67 | function checkAssumeNoRevertInvalidChild() public { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 102 | function checkSymbolicCalldataLoad(uint16 offset, uint256 marker) public pure { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 123 | function checkSymbolicCalldataCopy(uint16 offset, uint256 marker) public pure { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 145 | function checkSymbolicCalldataCopyDest(uint16 dest, uint256 marker) public pure { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 164 | function checkSymbolicCalldataCopySize(uint8 n) public pure { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 189 | function checkCalldataCopyDestAndSize(uint8 rawDest, uint8 rawSize, bytes32 marker) public { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 271 | function checkSymbolicCallInputOffset(uint16 offset, uint256 marker) public view { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 308 | function checkSymbolicCallOutputSize(uint8 rawSize) public view { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 348 | function checkSymbolicCallInputSize(uint8 rawSize, uint256 marker) public view { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 665 | function checkMockedSymbolicTargetMayMiss(address callee, address user) public { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 675 | function checkMockedSymbolicTargetAlwaysHits(address callee) public { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 738 | function checkExpectRevertOnSymbolicTarget(address target, uint256 x) public { | CODE |
| LOW | crates/forge/tests/cli/test_cmd/symbolic_calls.rs | 744 | function checkForbiddenCallOnSymbolicTarget(address target, uint256 x) public { | CODE |
| 391 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | crates/verify/src/etherscan/flatten.rs | 27 | let metadata = context.project.settings.solc.metadata.as_ref(); | CODE |
| CRITICAL | crates/cast/src/cmd/erc20/permit.rs | 187 | self.send_tx.eth.wallet.from.is_none_or(|from| from == owner), | CODE |
| CRITICAL | crates/script/src/build.rs | 315 | if self.args.evm.rpc.rpc_url.is_some() { | CODE |
| CRITICAL | crates/script/src/build.rs | 348 | && self.args.evm.rpc.rpc_url.is_some() | CODE |
| CRITICAL | crates/script/src/library_deployments.rs | 160 | || self.script_config.evm_opts.env.gas_price.is_some() | CODE |
| CRITICAL | crates/script/src/library_deployments.rs | 164 | || self.script_config.config.fs_permissions.permissions.iter().any(|permission| { | CODE |
| CRITICAL | crates/chisel/src/dispatcher.rs | 350 | let executor_builder = self.session.source.config.executor_builder.clone(); | CODE |
| CRITICAL | crates/forge/src/runner.rs | 523 | self.mcr.tcfg.multi_network.pass_network.as_ref(), | CODE |
| CRITICAL | crates/forge/src/runner.rs | 993 | [] if !self.mcr.tcfg.multi_network.all_override_networks.is_empty() => { | CODE |
| CRITICAL | crates/forge/src/runner.rs | 1869 | if (self.cr.mcr.tcfg.showmap.is_some() || self.cr.mcr.tcfg.fuzz_only) | CODE |
| CRITICAL | crates/forge/src/runner.rs | 1877 | if let Some(showmap) = self.cr.mcr.tcfg.showmap.as_ref() { | CODE |
| CRITICAL | crates/forge/src/runner.rs | 3891 | let execution_pass = if self.cr.mcr.tcfg.multi_network.all_override_networks.is_empty() { | CODE |
| CRITICAL | crates/forge/src/runner.rs | 3893 | } else if self.cr.mcr.tcfg.multi_network.pass_network.is_some() { | CODE |
| CRITICAL | crates/forge/src/runner.rs | 3957 | let showmap = self.cr.mcr.tcfg.showmap.as_ref(); | CODE |
| CRITICAL | crates/forge/src/runner.rs | 3958 | let minimize = self.cr.mcr.tcfg.fuzz_minimize.as_ref(); | CODE |
| CRITICAL | crates/forge/src/runner.rs | 5053 | let fuzz_input = self.cr.mcr.tcfg.fuzz_input.as_ref(); | CODE |
| CRITICAL | crates/forge/src/runner.rs | 5074 | if let Some(showmap) = self.cr.mcr.tcfg.showmap.as_ref() { | CODE |
| CRITICAL | crates/forge/src/runner.rs | 5091 | if let Some(minimize) = self.cr.mcr.tcfg.fuzz_minimize.as_ref() { | CODE |
| CRITICAL | crates/evm/core/src/evm/eth.rs | 124 | Ok(ResultAndState::new(result, self.ctx.journaled_state.inner.state.clone())) | CODE |
| CRITICAL | crates/evm/core/src/evm/tempo.rs | 142 | Ok(ResultAndState::new(result, self.ctx.journaled_state.inner.state.clone())) | CODE |
| CRITICAL | crates/anvil/tests/it/fork.rs | 2132 | let status = tx.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/fork.rs | 2259 | let status = tx.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/fork.rs | 2274 | let status = tx.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/fork.rs | 2337 | let status = tx.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/fork.rs | 2624 | let status = res.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/fork.rs | 2757 | let status = tx.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/fork.rs | 2772 | let status = tx.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/traces.rs | 2258 | let status = tx.inner.inner.inner.receipt.status.coerce_status(); | CODE |
| CRITICAL | crates/anvil/tests/it/logs.rs | 135 | .flat_map(|receipt| receipt.unwrap().inner.inner.inner.receipt.logs.clone()) | CODE |
| CRITICAL | crates/anvil/src/eth/backend/mem/in_memory_db.rs | 444 | self.inner.inner.cache.block_hashes.remove(&(min_number - U256::ONE)); | CODE |
| CRITICAL | crates/anvil/src/eth/backend/mem/in_memory_db.rs | 446 | self.inner.inner.cache.block_hashes.insert(number, hash); | CODE |
| CRITICAL | crates/anvil/src/eth/backend/mem/in_memory_db.rs | 481 | self.block_hash_head = self.inner.inner.cache.block_hashes.keys().copied().max(); | CODE |
| CRITICAL | crates/anvil/src/eth/backend/mem/in_memory_db.rs | 812 | db.inner.inner.cache.accounts.get_mut(&deleted).unwrap().account_state = | CODE |
| CRITICAL | crates/anvil/src/eth/backend/mem/in_memory_db.rs | 942 | db.inner.inner.cache.accounts.get_mut(&deleted).unwrap().account_state = | CODE |
| CRITICAL | crates/anvil/src/eth/backend/mem/in_memory_db.rs | 952 | fresh.inner.inner.cache.accounts.get_mut(&deleted).unwrap().account_state = | CODE |
| CRITICAL | crates/cheatcodes/src/inspector.rs | 3756 | let result = if ccx.state.core.config.blocked_cheatcodes.contains(&cheat.func.selector_bytes) { | CODE |
| CRITICAL | crates/cheatcodes/src/evm.rs | 1903 | ccx.state.core.config.running_artifact.clone().expect("expected running contract").name | CODE |
| CRITICAL | crates/cheatcodes/src/evm.rs | 2549 | let artifacts = ccx.state.core.config.available_artifacts.as_ref()?; | CODE |
| CRITICAL | crates/cheatcodes/src/evm/fork.rs | 428 | let mut evm_opts = ccx.state.core.config.evm_opts.clone(); | CODE |
| CRITICAL | crates/cheatcodes/src/evm/fork.rs | 444 | && ccx.state.core.config.rpc_storage_caching.enable_for_endpoint(&url), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/forge/tests/cli/lint.rs | 2562 | "rendered": "warning: unused lint suppression for 'divide-before-multiply'\n ╭▸ src/Json.sol:5:5\n │\n5 │ // for | CODE |
| MEDIUM | crates/doc/src/render.rs | 28 | // ── rendering context ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 67 | // ── contract ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 276 | // ── free functions ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 294 | // ── constants ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 316 | // ── standalone items ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 339 | // ── function section ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 432 | // ── natspec comment collection ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 675 | // ── markdown output helpers ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/render.rs | 1084 | // ── public entry point ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/vocs.rs | 92 | // ── vocs.config.ts ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/vocs.rs | 271 | // ── homepage ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/vocs.rs | 307 | // ── homepage link rewriting ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/vocs.rs | 544 | // ── package.json ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/vocs.rs | 563 | // ── helpers ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/hir_ext.rs | 26 | // ── name-to-page map ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/hir_ext.rs | 139 | // ── inheritance links ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/hir_ext.rs | 179 | // ── inheritdoc resolution ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/hir_ext.rs | 682 | // ── inline link replacement ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/hir_ext.rs | 1100 | // ── path helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/utils.rs | 16 | // ── git source ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/doc/src/utils.rs | 42 | // ── deployments ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/cheatcodes/src/expected_emit.rs | 25 | /// ┌───────┬───────┬───────┬───────┬────┐ | COMMENT |
| MEDIUM | crates/cheatcodes/src/expected_emit.rs | 27 | /// └───────┴───────┴───────┴───────┴────┘ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1400 | // Step 1: Tempo Accounts store lookup. | COMMENT |
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1405 | // Step 2: RPC reachability. | COMMENT |
| LOW | crates/cast/src/cmd/keychain.rs | 1435 | // Step 3: chain-id match + final entry selection. | COMMENT |
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1459 | // Step 4: local signing readiness. | COMMENT |
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1462 | // Step 5: on-chain key state. | COMMENT |
| LOW | crates/forge/src/cmd/bind_json.rs | 54 | // Step 1: Read and preprocess sources | COMMENT |
| LOW⚡ | crates/forge/src/cmd/bind_json.rs | 73 | // Step 2: Preprocess sources to handle potentially invalid bindings | COMMENT |
| LOW⚡ | crates/forge/src/cmd/bind_json.rs | 79 | // Step 3: Find structs and generate bindings | COMMENT |
| LOW⚡ | crates/forge/src/cmd/bind_json.rs | 83 | // Step 4: Write bindings | COMMENT |
| LOW | crates/evm/core/src/backend/mod.rs | 1172 | // here's an edge case where we need to check if this account has been created, in | COMMENT |
| LOW | crates/cheatcodes/src/test/revert_handlers.rs | 194 | // we need to check if it matches our criteria | COMMENT |
| LOW | crates/cheatcodes/src/test/revert_handlers.rs | 200 | // We need to check if this revert matches our expected criteria | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 605 | # Step 1: Get the fee_payer_signature_hash using --tempo.print-sponsor-hash | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 606 | # Step 2: Sign it with the sponsor's private key | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 607 | # Step 3: Send with --tempo.sponsor and --tempo.sponsor-signature | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 625 | # Step 1: Get the hash that the sponsor needs to sign | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 631 | # Step 2: Sponsor signs the hash | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 635 | # Step 3: Send the sponsored transaction with the signature. With --json, cast reports | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1400 | // Step 1: Tempo Accounts store lookup. | COMMENT |
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1405 | // Step 2: RPC reachability. | COMMENT |
| LOW | crates/cast/src/cmd/keychain.rs | 1435 | // Step 3: chain-id match + final entry selection. | COMMENT |
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1459 | // Step 4: local signing readiness. | COMMENT |
| LOW⚡ | crates/cast/src/cmd/keychain.rs | 1462 | // Step 5: on-chain key state. | COMMENT |
| LOW | crates/forge/src/cmd/bind_json.rs | 54 | // Step 1: Read and preprocess sources | COMMENT |
| LOW⚡ | crates/forge/src/cmd/bind_json.rs | 73 | // Step 2: Preprocess sources to handle potentially invalid bindings | COMMENT |
| LOW⚡ | crates/forge/src/cmd/bind_json.rs | 79 | // Step 3: Find structs and generate bindings | COMMENT |
| LOW⚡ | crates/forge/src/cmd/bind_json.rs | 83 | // Step 4: Write bindings | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 605 | # Step 1: Get the fee_payer_signature_hash using --tempo.print-sponsor-hash | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 606 | # Step 2: Sign it with the sponsor's private key | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 607 | # Step 3: Send with --tempo.sponsor and --tempo.sponsor-signature | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 625 | # Step 1: Get the hash that the sponsor needs to sign | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 631 | # Step 2: Sponsor signs the hash | COMMENT |
| LOW⚡ | .github/scripts/tempo-check.sh | 635 | # Step 3: Send the sponsored transaction with the signature. With --json, cast reports | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/release.yml | 220 | # Create the GitHub release as a draft up-front so that all matrix jobs | COMMENT |
| MEDIUM | .github/scripts/combine-benchmarks.sh | 12 | # Define the benchmark files and their section names | COMMENT |
| MEDIUM | .github/scripts/tempo-check.sh | 197 | # Create an access key for testing | COMMENT |
| MEDIUM | .github/scripts/tempo-check.sh | 594 | # Create a sponsor wallet for testing sponsored (gasless) transactions | COMMENT |
| MEDIUM | .github/scripts/tempo-check.sh | 729 | # Create a script that calls multiple contracts and batch them into a single tx | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/forge/src/cmd/doc.rs | 29 | /// ready-to-use [vocs](https://vocs.dev) site scaffold alongside the | COMMENT |
| MEDIUM | crates/doc/src/vocs.rs | 42 | // Write user-editable scaffold files only on first run so that manual | COMMENT |
| MEDIUM | crates/doc/src/vocs.rs | 77 | // Always regenerate: unlike user-editable scaffold files, index.mdx is | COMMENT |
| MEDIUM | crates/doc/src/builder.rs | 31 | /// Total time spent writing the vocs site scaffold. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/common/src/preprocessor/data.rs | 144 | /// Example usage: | COMMENT |
| LOW | crates/cheatcodes/spec/src/vm.rs | 3508 | /// Example usage: | COMMENT |
| LOW | .github/scripts/bump-tempo.sh | 7 | # Usage: | COMMENT |
| LOW | .github/scripts/bump-solar.sh | 7 | # Usage: | COMMENT |
| LOW | .github/scripts/tempo-mpp.sh | 10 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …9AB6b21cDF116f611110b048987E58894786C244/metadata.json | 1 | [{"SourceCode":{"language":"Solidity","sources":{"contracts/InterestRates/InterestRatePositionManager.f.sol":{"content": | CODE |
| MEDIUM | crates/primitives/src/network/mod.rs | 27 | /// Note: This is a basic implementation ("for now") that provides the core Network | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .github/scripts/tests/test_tempo_check.py | 20 | trap 'kill "$pid" 2>/dev/null || true; wait "$pid" 2>/dev/null || true' EXIT | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/forge/src/result.rs | 49 | /// Essentially `identifier => signature => result`. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/matrices.py | 101 | CODE | |
| LOW | .github/scripts/compare-benchmark-thresholds.py | 77 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/lint/docs/todo-comment.md | 24 | // TODO: implement access control | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/setup-foundryup.sh | 9 | # Check if foundryup script exists in the repo | COMMENT |