Security Toolchain
Verify locally: make security && make test-invariant.
Current Status
The workflow badge above is live CI. Do not treat checked-in Aderyn counts as a scoreboard — they go stale as soon as someone reruns the analyzer.
- Run
make aderynand readreport.md. - H-1 (keccak of id, timestamp, prevrandao, nonce) is certificate-id uniqueness, not a lottery. Do not replace it with Chainlink VRF.
- Invariants:
make test-invariant(chain/test/invariants/).
Tools
Aderyn
Real-time static linting. Fast feedback while coding.
Foundry Invariant Tests
Stateful fuzzing for core accounting rules (256 runs / 50 depth).
Invariants tested:
shares_issued <= shares_authorized(issuer and stock classes)- Stakeholder/stock class index mapping consistency
- Count consistency between contract and tracked state
- Stock class authorized never exceeds issuer authorized
Unit Tests
Tests covering core flows, edge cases, access control, factory logic, and operator role verification. All passing.
Commands
| Command | Description |
|---|---|
make test | Run all unit tests |
make test-invariant | Short invariant fuzz (256 runs, 50 depth) |
make test-invariant-deep | Deep invariant fuzz (2000 runs, 100 depth) |
make aderyn | Run Aderyn → report.md |
make security | Run Aderyn |
Philosophy
- Catch obvious stuff early (Aderyn)
- Stress-test logic over sequences (Invariants)
- Verify specific behaviors & errors (Unit tests)
- Pre-audit cleanup → reduces noise for auditors
- No single tool replaces a full audit
Last updated on