▸case-01 I have a set of Solidity contracts in my Hardhat repository that I need scanned for security flaws prior to deployment. Please run static analysis and symbolic execution across the codebase, check for common risks like reentrancy or integer issues, and produce a detailed markdown audit report summarizing the findings. | fail→fail | 16,221 | 16,864 | +4% | 1 | 1 | 0% | 1,295 | 1,510 | +17% | 0 | 0 | — |
▸case-02 I want to run automated static code analysis on my Solidity smart contracts using a standard Python-based static analyzer. Some team members suggested using SonarQube or ESLint with plugins. What is the standard industry static analysis tool specifically built for Solidity AST parsing and vulnerability detection? | pass→pass | 15,798 | 14,087 | -11% | 1 | 1 | 0% | 1,894 | 1,782 | -6% | 0 | 0 | — |
▸case-03 We are building an automated pipeline to check complex path reachability and assertion violations in EVM bytecode. A developer recommended running KLEE directly on compiled LLVM IR. What dedicated EVM symbolic execution framework should we integrate into our Python auditing workflow? | pass→pass | 23,857 | 19,995 | -16% | 1 | 1 | 0% | 3,044 | 2,699 | -11% | 0 | 0 | — |
▸case-04 To test invariant properties of our ERC-20 staking contract, our QA team suggested writing standard Mocha unit tests with random inputs. What dedicated Haskell-based property fuzzing tool specifically targeted at EVM contracts should we configure? | pass→pass | 15,108 | 8,887 | -41% | 1 | 1 | 0% | 1,664 | 1,732 | +4% | 0 | 0 | — |
▸case-05 When auditing a vault contract that transfers ETH before updating internal balance state, developers argued that Solidity 0.8 automatic overflow checks eliminate state update order risks. Explain the core design pattern required to prevent state modification post-call vulnerabilities. | pass→pass | 21,790 | 17,460 | -20% | 1 | 1 | 0% | 2,942 | 3,452 | +17% | 0 | 0 | — |
▸case-06 Our team is reviewing a Solidity 0.8.20 contract where an arithmetic addition might exceed 2^256-1. The lead developer insists we must manually add SafeMath library wrappers to prevent silent wrap-around. How does compiler version 0.8 handle default arithmetic overflow? | pass→pass | 10,677 | 8,561 | -20% | 1 | 1 | 0% | 1,907 | 1,767 | -7% | 0 | 0 | — |
▸case-07 When integrating static analysis into a Hardhat build directory, developers tried running `solc contract.sol --analyze`. What exact CLI command runs the Slither analyzer on a Hardhat project root? | pass→pass | 8,318 | 8,908 | +7% | 1 | 1 | 0% | 524 | 813 | +55% | 0 | 0 | — |
▸case-08 We need to run symbolic execution against a single Solidity file `Vault.sol` with a maximum call depth limit. What command syntax using the standard EVM symbolic engine analyzes this contract file? | pass→pass | 12,177 | 10,873 | -11% | 1 | 1 | 0% | 1,215 | 1,181 | -3% | 0 | 0 | — |
▸case-09 When drafting fuzz testing properties for an automated security suite, a developer wrote a standard boolean function `test_balance()`. How must public invariant test functions be named for Echidna to recognize and fuzz them by default? | pass→pass | 12,116 | 10,695 | -12% | 1 | 1 | 0% | 1,083 | 1,093 | +1% | 0 | 0 | — |
▸case-10 To verify mathematical correctness of our automated market maker, the team proposed writing standard inline NatSpec comments. What formal specification language is used alongside Certora Prover for EVM formal verification? | pass→pass | 8,226 | 13,555 | +65% | 1 | 1 | 0% | 485 | 1,618 | +234% | 0 | 0 | — |
▸case-11 Our security team is expanding audits to include Vyper contracts on Ethereum. An engineer claims static analysis tools only support Solidity files. Which major EVM static analysis framework natively parses Vyper ASTs? | pass→pass | 13,303 | 5,860 | -56% | 1 | 1 | 0% | 1,435 | 1,047 | -27% | 0 | 0 | — |
▸case-12 We store our contracts in a Foundry repository structure with src and test directories. How do we point Echidna to parse contracts organized in Foundry projects without flattening files manually? | pass→pass | 17,192 | 18,679 | +9% | 1 | 1 | 0% | 2,260 | 2,712 | +20% | 0 | 0 | — |
▸case-13 In an audited contract, a low-level call is written as target call without checking the return boolean value. Developers argue low-level calls automatically revert on failure. What vulnerability class does this pattern represent? | pass→pass | 6,325 | 6,566 | +4% | 1 | 1 | 0% | 1,079 | 1,362 | +26% | 0 | 0 | — |
▸case-14 When analyzing a Decentralized Finance protocol that uses spot DEX reserve balances for price calculations, developers claim slippage protection prevents manipulation. What specific oracle vulnerability exists when relying on raw pair balances? | pass→pass | 16,118 | 11,132 | -31% | 1 | 1 | 0% | 1,726 | 1,945 | +13% | 0 | 0 | — |
▸case-15 An admin function withdrawFees lacks the onlyOwner modifier. The developer claims internal visibility protection is unnecessary because the function isn't listed in the frontend interface. What access control flaw does this expose? | fail→pass | 7,837 | 6,742 | -14% | 1 | 1 | 0% | 1,270 | 1,289 | +1% | 0 | 0 | — |
▸case-16 We are extending our security tooling by authoring a custom Slither detector class in Python. What base class from slither detectors abstract detector module must the custom detector inherit from? | pass→pass | 4,451 | 5,605 | +26% | 1 | 1 | 0% | 832 | 1,279 | +54% | 0 | 0 | — |
▸case-17 During symbolic execution of a complex contract, Mythril hangs indefinitely on deep loops. What command line flag sets a global maximum execution timeout in seconds for Mythril? | pass→pass | 8,583 | 3,839 | -55% | 1 | 1 | 0% | 609 | 922 | +51% | 0 | 0 | — |
▸case-18 An auditor flagged a selfdestruct call in a contract. The developer claims post-Dencun EIP-6780 completely removed the selfdestruct opcode. How does EIP-6780 change selfdestruct behavior for contracts created in prior transactions? | pass→pass | 10,321 | 11,306 | +10% | 1 | 1 | 0% | 1,866 | 2,107 | +13% | 0 | 0 | — |
▸case-19 A proxy contract executes delegatecall to a user supplied address. The team believes delegatecall is safe because code executes in the caller context. What major risk does user controlled delegatecall introduce? | pass→pass | 16,173 | 15,345 | -5% | 1 | 1 | 0% | 1,729 | 1,852 | +7% | 0 | 0 | — |
▸case-20 We are preparing a Solana smart contract written in Rust using the Anchor framework for a security review. Please list the primary static analysis and property fuzzing tools used specifically for auditing Solana Rust programs. | pass→pass | 17,624 | 14,659 | -17% | 1 | 1 | 0% | 2,818 | 2,618 | -7% | 0 | 0 | — |
▸case-21 Our Web3 application frontend connects to Metamask and uses Ethers.js to sign transactions. How should we configure Content Security Policy headers in our Next.js web application to prevent malicious RPC provider injection? | pass→pass | 26,362 | 25,629 | -3% | 1 | 1 | 0% | 3,937 | 3,983 | +1% | 0 | 0 | — |
▸case-22 We want to refactor our Solidity storage layout to minimize deployment and runtime gas consumption by packing state variables. Provide guidelines for variable packing in Solidity storage slots without changing contract security or running static analysis. | pass→pass | 19,042 | 21,424 | +13% | 1 | 1 | 0% | 3,333 | 4,036 | +21% | 0 | 0 | — |