▸case-01 I am developing a decentralized staking pool contract in Solidity. Could you perform a comprehensive security assessment on my deposit and withdraw functions? Please provide a detailed review highlighting potential attack vectors, actionable remediation steps, and verification procedures to ensure funds remain safe. | fail→fail | 17,911 | 20,320 | +13% | 1 | 1 | 0% | 1,213 | 1,750 | +44% | 0 | 0 | — |
▸case-02 We are getting ready for an external security audit on our ERC-20 lending protocol code written in Solidity. Please review our access management and state transition logic, and supply a structured report containing a breakdown of potential risks, clear remediation steps, and validation guidance. | pass→pass | 34,351 | 38,489 | +12% | 1 | 1 | 0% | 5,215 | 4,845 | -7% | 0 | 0 | — |
▸case-03 I need to refactor our reward distribution logic in a Solidity smart contract to prevent precision loss and reentrancy exploits. Please analyze this workflow and produce an actionable security assessment with step-by-step implementation changes and verification tests. | pass→pass | 30,107 | 29,856 | -1% | 1 | 1 | 0% | 3,289 | 5,338 | +62% | 0 | 0 | — |
▸case-04 We are developing a Curve-style Automated Market Maker contract in Vyper 0.3.10. Can you perform a security audit on our Vyper @external swap logic, specifically checking @nonreentrant decorator usage and integer arithmetic safety? Provide an assessment report. | fail→fail | 25,406 | 23,037 | -9% | 1 | 1 | 0% | 2,780 | 1,778 | -36% | 0 | 0 | — |
▸case-05 We are building a Solana lending program in Rust using the Anchor framework. Please audit our account constraint checks in our deposit instruction handler to ensure account spoofing is impossible. | fail→fail | 19,635 | 20,525 | +5% | 1 | 1 | 0% | 2,580 | 3,939 | +53% | 0 | 0 | — |
▸case-06 We are building a React Web3 frontend using ethers.js v6. Please review our JavaScript frontend code for wallet connection, transaction signing, and EIP-712 typed data signing logic to prevent UI clickjacking and transaction phishing. | fail→fail | 26,036 | 23,094 | -11% | 1 | 1 | 0% | 4,177 | 3,834 | -8% | 0 | 0 | — |
▸case-07 We are designing a lending protocol where collateral value is determined by reading reserves directly from a single Uniswap V2 pair pool. Developers suggested this is fast and safe because liquidity is high. Provide a security review of this price feed design and actionable steps to secure it. | pass→pass | 24,077 | 21,600 | -10% | 1 | 1 | 0% | 2,963 | 3,139 | +6% | 0 | 0 | — |
▸case-08 We are implementing an UUPS upgradeable proxy pattern in Solidity 0.8.20. A developer proposed declaring new state variables directly at the top of the implementation contract child class without storage gaps or ERC-1967 storage slots. Review this approach and provide remediation steps. | pass→pass | 16,067 | 17,925 | +12% | 1 | 1 | 0% | 2,925 | 3,682 | +26% | 0 | 0 | — |
▸case-09 In our Solidity transfer authorization function, we use require(tx.origin == owner) so that multisig wallets can execute transactions on behalf of the owner. Is this authorization pattern secure? Provide a detailed security review and fix. | pass→pass | 18,835 | 18,698 | -1% | 1 | 1 | 0% | 2,596 | 2,918 | +12% | 0 | 0 | — |
▸case-10 Our Solidity contract sends ETH using payable(user).call{value: amount}("") without inspecting the boolean return value, assuming Solidity automatically reverts on failure. Evaluate the security of this transfer pattern and provide the corrected implementation. | pass→pass | 16,631 | 11,407 | -31% | 1 | 1 | 0% | 1,960 | 2,339 | +19% | 0 | 0 | — |
▸case-11 We implemented an off-chain signature authorization feature using ecrecover(hash, v, r, s) in Solidity. The hash is calculated as keccak256(abi.encodePacked(user, amount)). Review this verification logic for replay vulnerabilities across chains or contracts. | pass→pass | 14,859 | 13,945 | -6% | 1 | 1 | 0% | 2,810 | 2,948 | +5% | 0 | 0 | — |
▸case-12 Our Solidity contract allows users to adjust token allowances by calling standard approve(spender, newAmount). A security reviewer flagged that changing an allowance from 100 to 50 allows a malicious spender to extract 150 tokens. Explain how this vulnerability works and how to remediate it. | pass→pass | 20,239 | 19,657 | -3% | 1 | 1 | 0% | 2,881 | 3,046 | +6% | 0 | 0 | — |
▸case-13 Our vault queries another protocol's flash-loanable liquidity pool balance via a view function to calculate share values. Developers claim view functions cannot cause reentrancy because state changes are prohibited in view calls. Evaluate this claim and explain potential risks. | pass→pass | 21,719 | 22,496 | +4% | 1 | 1 | 0% | 2,772 | 2,847 | +3% | 0 | 0 | — |
▸case-14 During NFT minting, our contract calls _safeMint(msg.sender, tokenId) before updating totalMinted counter and user balance mappings. Is _safeMint safe against reentrancy? Provide a security evaluation. | pass→pass | 17,975 | 11,479 | -36% | 1 | 1 | 0% | 2,156 | 2,441 | +13% | 0 | 0 | — |
▸case-15 Our Solidity contract iterates through an unbounded address array in a distribute() function to process transfers to thousands of token holders. Assess the security and operational risks of this design. | pass→pass | 19,036 | 24,386 | +28% | 1 | 1 | 0% | 1,596 | 3,730 | +134% | 0 | 0 | — |
▸case-16 We stored sensitive API secret keys and admin encryption passwords in private string privateData in our deployed Solidity contract. A developer claims private visibility prevents anyone on the blockchain from reading the contents. Evaluate this assumption. | pass→pass | 17,739 | 14,475 | -18% | 1 | 1 | 0% | 2,082 | 1,792 | -14% | 0 | 0 | — |
▸case-17 Our contract interacts with non-standard ERC-20 tokens like USDT that do not return a boolean on transfer or transferFrom. Calling IERC20(token).transfer(...) directly in Solidity causes transactions to revert. Explain why this happens and provide the standard secure solution. | pass→pass | 19,569 | 16,646 | -15% | 1 | 1 | 0% | 2,203 | 2,447 | +11% | 0 | 0 | — |
▸case-18 We are auditing an older Solidity codebase where several state-modifying functions omit explicit visibility specifiers like public or internal. What security risks does implicit default visibility introduce? | pass→pass | 19,666 | 15,621 | -21% | 1 | 1 | 0% | 2,301 | 1,870 | -19% | 0 | 0 | — |
▸case-19 Our Solidity lottery contract determines winning payouts by checking if (block.timestamp % 2 == 0). Is using block.timestamp safe for randomness or precise timing requirements? Analyze the vulnerability. | pass→pass | 15,602 | 15,072 | -3% | 1 | 1 | 0% | 2,682 | 2,855 | +6% | 0 | 0 | — |
▸case-20 Our vault contract contains logic require(address(this).balance == totalDeposits) to verify accounting accuracy. Can an attacker break this contract functionality? Explain the vector and fix. | pass→pass | 17,452 | 9,184 | -47% | 1 | 1 | 0% | 2,116 | 1,952 | -8% | 0 | 0 | — |
▸case-21 In our OpenZeppelin upgradeable contract, we defined function initialize(address owner) public without initializer modifier or _disableInitializers() in the constructor. Explain the security threat and remediation. | pass→pass | 16,899 | 15,617 | -8% | 1 | 1 | 0% | 2,161 | 2,056 | -5% | 0 | 0 | — |
▸case-22 Our dApp calls IERC20Permit(token).permit(...) on arbitrary user-provided token addresses before executing transferFrom. What security issue occurs if a token contract does not implement EIP-2612 but has a fallback function that succeeds? | fail→pass | 18,496 | 20,914 | +13% | 1 | 1 | 0% | 3,255 | 3,011 | -7% | 0 | 0 | — |
▸case-23 Our governance contract allows arbitrary users to execute low-level assembly ecrecover calls in a loop with arbitrary payload inputs. What vector allows attackers to cause resource exhaustion or unexpected transaction failure? | fail→fail | 13,939 | 23,199 | +66% | 1 | 1 | 0% | 2,350 | 2,078 | -12% | 0 | 0 | — |