{ "cycle_merkle_roots": [ { "cycle_id": "20260511-183154", "engine_sha": "6cd742f25a9bcebeb9adc01136b129b5996397dd", "merkle_root": "141ffeb01d373ab2d1d8e0a24f244664eb40abda424d67ef1b66fa769ae20b1f", "n_findings": 20, "schema": "jelleo-cycle-merkle-v3" }, { "cycle_id": "20260511-141242", "engine_sha": "6cd742f25a9bcebeb9adc01136b129b5996397dd", "merkle_root": "005eda23a77ace29b30b9fa4d6a6f1d18588dbbfbf8c698a307a39af23a81467", "n_findings": 3, "schema": "jelleo-cycle-merkle-v3" }, { "cycle_id": "20260511-032554", "engine_sha": "1dc4466e1a6c3532f2781bc242fa4e4033751fb6", "merkle_root": "0711954bd1875a8f91d2c7bec78d08738189529730f954fed7dd77fcdfcca334", "n_findings": 7, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260511-015505", "engine_sha": "3c9c84908b7b28b041c9dbf56ea16c480ab8e7ce", "merkle_root": "770b2bb75a175c79e17891deb3aef297ceea9d6474d36e34c49645f47544652a", "n_findings": 1, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260511-002741", "engine_sha": "3c9c84908b7b28b041c9dbf56ea16c480ab8e7ce", "merkle_root": "1d35e464d1a5a010c61390a91a8b334fc91233751ea82127ba90cfed7a6e17c6", "n_findings": 1, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-193800", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "37622cbf5203dec4ab7cc4dd3b5ac77c55624fab66d28873277fb283a8790c94", "n_findings": 12, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-193640", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "a58f818577d4ce81dae786af46e0e8e757d390d3bac32115c14161f370e79842", "n_findings": 0, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-193720", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "605aa5a46db2bab1025d7df65fd52c7a72d5fb599a8bcdac7bb31d72bdc43a5d", "n_findings": 12, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-193520", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "46fb3d7ed0220ea7df8c6231003648e4fd0107b35add0eb6161207bee5ab94e6", "n_findings": 0, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-213920", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "2970ef70eb7462b8288ceaa471cedb4b221f6a89275398bd76f8cd4aef84bbda", "n_findings": 101, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-225814", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "43a60727ea461627680ac3eb591d185e2f76b7e33fe5f252f3f6fbb906cb7fee", "n_findings": 101, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-223736", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "db04b1506ba61294cc1bbd240fde03dcbd959497e5448e398e085066a37a84ee", "n_findings": 12, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260428-225139", "engine_sha": "a946e5508fcfe1bc250845a98a85ef614fdebb99", "merkle_root": "9fecf61c9ae96d4ee04f2314a926b9b69d921c189e4ef3cd8fc9d99b820e8f72", "n_findings": 12, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260506-194649-5059332", "engine_sha": "5059332", "merkle_root": "668f261264ae83c5354a58c5d687dfafe6d04b3a184f88b3c185377eb0a5ce51", "n_findings": 12, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260506-194213-5059332", "engine_sha": "5059332", "merkle_root": "5599b81e762564a2017049de875a9e1ef2e83c228a945b8327ced6f37ce3d53c", "n_findings": 101, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260506-221750-5059332", "engine_sha": "5059332", "merkle_root": "24ccc336487fabf8f0dca2fbf245cce3e3e2d88afc0181a8d55da06f4990c583", "n_findings": 12, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260506-220844-5059332", "engine_sha": "5059332", "merkle_root": "4b637435423a86c2026e813f239365621b5287fffe8adecff7102eefe5e4815f", "n_findings": 12, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260506-225557-5059332", "engine_sha": "5059332", "merkle_root": "40103b28cc53c588b041e43cba05aac87773950eac6975e923fbe282b7461f7a", "n_findings": 101, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260506-234757-04b854e", "engine_sha": "04b854e", "merkle_root": "482e6182541b2657f4ac8440cdfb8ad7ffb20e21e541e4e6474881b0d3af14ea", "n_findings": 101, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260507-002534-5059332", "engine_sha": "5059332", "merkle_root": "7e06fdde028e8fc653463d055796af138b28ec1d1bbeb082745420d18d114cc0", "n_findings": 0, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260507-004313-04b854e", "engine_sha": "04b854e", "merkle_root": "f870f5ddfae7a8eeda1986fa71138118fa665e365211a5582fed1bb570e4ac4c", "n_findings": 8, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260507-002648-5059332", "engine_sha": "5059332", "merkle_root": "9e00412adca5620eb7f47edc78c6689816bbb33753496e7a80762ef3b4423711", "n_findings": 8, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260507-003500-5059332", "engine_sha": "5059332", "merkle_root": "fca99cbe58e32282b51bbeead8e09213c184320ff3b0a802bf9ea83ca3341757", "n_findings": 8, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260507-004030-04b854e", "engine_sha": "04b854e", "merkle_root": "3011995d73f80e346c8bcd84f6d09fa50df555be6cd4ac6ac4560abd4e17548b", "n_findings": 8, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260507-004922-5059332", "engine_sha": "5059332", "merkle_root": "48ae3e7e8a24c33f550cdad88ce219e8faff6ba531819f473b076cf3d473d92d", "n_findings": 6, "schema": "jelleo-cycle-merkle-v2" }, { "cycle_id": "20260508-025038", "engine_sha": "3c9c84908b7b28b041c9dbf56ea16c480ab8e7ce", "merkle_root": "8673e88e44b1c57d8b46da640fad3ddd07d8135759aba40fbf11fe82f8427e4a", "n_findings": 101, "schema": "jelleo-cycle-merkle-v2" } ], "cycles_total": 46, "fix_bundle_stats": { "bundles_authorized": 0, "bundles_drafted": 21, "bundles_verified": 0, "by_status": { "drafted": 21 }, "prs_merged": 0, "prs_opened": 0 }, "generated_at": "2026-05-31T17:00:01+00:00", "generated_at_ms": 1780246801900, "loop_uptime_human": "13d 11h", "loop_uptime_source": "jelleo-shadow.service", "platform": "jelleo", "propagation_stats": { "bug_classes_declared": 1412, "bug_classes_with_signatures": 96, "dispatches_pending": 0, "dispatches_queued": 0, "findings_with_bug_class": 832, "propagation_reports": 2, "sibling_files": 1 }, "public_findings": [ { "bug_class": "rounding-favors-user", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL16-rounding-direction", "id": 311, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Every share-vault function rounds in the protocol's favor: mint rounds DOWN on shares minted (user pays more, gets less)", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": "oracle-staleness", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL26-oracle-staleness", "id": 322, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Every oracle price read checks the `updated_at` timestamp is within a max-staleness window. Stale prices during outages ", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": "clock-decrease", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL28-clock-not-monotonic", "id": 324, "n_siblings": 0, "poc_fired": true, "severity": "Low", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Every time-elapsed calculation handles the case where the current clock is LESS than the stored timestamp (clock drift, ", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": "wrapping-counter", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL46-wrapping-arith-on-security-counter", "id": 344, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Security-critical accumulators (claimed_amount, total_deposits, slash_pool) must use checked_add and abort on overflow, ", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": "lazy-init-race", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL51-lazy-state-init-during-mutation", "id": 350, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Account state fields MUST be set during the dedicated initializer instruction, not lazily on first mutating call. lendin", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": "share-rate-missing", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL55-shares-assets-conflation-no-exchange-rate", "id": 354, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Vault MUST maintain a share-to-asset exchange rate so accrued fees and pool balance changes propagate to share value. va", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": "daily-cap-bypass", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL56-epoch-boundary-daily-limit-bypass", "id": 355, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Daily-volume caps MUST use a rolling 24h window (or per-day with a per-period cap reset that resists boundary games). va", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": "buyer-inversion", "cycle_id": "20260517-014506", "disclosure_url": null, "hypothesis_id": "SOL61-settle-buyer-inversion", "id": 361, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 3, "target_name": "osec-solana-large", "title": "Sale settlement MUST resolve the buyer as the highest-bid bidder iff the bid meets the price floor; the caller is NEVER ", "updated_at": "2026-05-18T22:22:51+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD1-vault-withdraw-reentrancy", "id": 368, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "In ContractA.withdraw(shares, receiver), all state writes (shareBalance, totalShares, totalManagedAssets) MUST complete ", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD10-gov-sig-replay-no-nonce-no-chainid", "id": 369, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractC.executeBySig recovers a signer from `keccak256(abi.encodePacked(address(this), proposalId, voter))`. The diges", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD11-gov-distribute-rewards-dos-on-single-failure", "id": 370, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractC.distributeRewards loops over voters and reverts the ENTIRE batch if any single `transfer` returns false (or th", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD12-gov-distribute-rewards-dust-loss", "id": 371, "n_siblings": 0, "poc_fired": true, "severity": "Low", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractC.distributeRewards computes per-voter reward as `total / voters.length` (floor division). When the division is ", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD13-bridge-approve-race-non-zero-reset", "id": 372, "n_siblings": 0, "poc_fired": true, "severity": "Low", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractC.bridgeToken calls `approve(bridge, amount)` without first zeroing any existing allowance. USDT-style tokens re", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD2-vault-share-inflation-first-depositor", "id": 373, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "In ContractA.deposit, share computation uses `ShareMath.toShares(amount, totalShares, asset.balanceOf(this))` where `bal", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD3-vault-pause-bypass-on-state-mutations", "id": 374, "n_siblings": 0, "poc_fired": true, "severity": "Low", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractA.setDelegate and ContractA.requestWithdraw mutate user state but lack the `whenNotPaused` modifier present on e", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD4-pool-set-oracle-missing-onlyowner", "id": 375, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractB.setOracle is callable by ANY address. The oracle is the sole price source feeding `_isSolvent` (used by withdr", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD5-pool-repay-overcharges-on-excess", "id": 376, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "In ContractB.repay(account, amount), the local variable that caps repayment to outstanding debt is computed correctly (`", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD6-pool-oracle-no-staleness-check", "id": 377, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractB._isSolvent (called from withdraw, borrow, liquidate) consumes `oracle.price(collateralToken)` with no freshnes", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD7-pool-liquidate-collateral-clamp-leaks-debt", "id": 378, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractB.liquidate clamps the seized collateral when the computed amount exceeds `account.collateral` (`if (seize > col", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260517-193953", "disclosure_url": null, "hypothesis_id": "SOLD8-bridge-tx-origin-auth", "id": 379, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 7, "target_name": "osec-solidity-small", "title": "ContractC.bridgeToken authenticates the caller with `tx.origin == owner` instead of `msg.sender == owner`. An attacker w", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD14-vault-set-strategy-missing-access-control", "id": 386, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractA.setStrategy has NO access-control modifier (no `onlyGovernor`, no `onlyOperator`). Any address can swap the st", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD15-vault-total-assets-double-counts-managed", "id": 387, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractA.totalAssets returns `idle + invested + totalManaged`. After `deposit`, both `asset.balanceOf(this)` (idle) AND", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD17-gov-execute-uses-delegatecall-storage-takeover", "id": 388, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractC.execute executes proposal payloads via `p.target.delegatecall(p.data)`. Delegatecall runs the target's bytecod", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD18-gov-queue-cross-chain-replay-arbitrary-payload", "id": 389, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractC.queueCrossChain is permissionless, accepts caller-supplied `dstChain`, `receiver`, and `payload`, and doesn't ", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD19-order-signed-replay-drains-maker-approval", "id": 390, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "OrderSettlement.openSignedOrder validates a signature whose digest (in SignatureLib.recoverOrder) is `keccak256(ORDER_TY", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD2-vault-share-inflation-first-depositor", "id": 391, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "In ContractA.deposit, share computation uses `ShareMath.toShares(amount, totalShares, asset.balanceOf(this))` where `bal", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD20-initializable-unprotected-initialize-frontrun", "id": 392, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractC.initialize is gated only by the `initializer` modifier (sets a one-shot `initialized` flag) \u2014 there is no call", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD22-strategy-donation-inflates-fee-shares", "id": 393, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "SimpleStrategy.harvest reports `gainOrLoss = balanceOf(this) - accountedAssets` and updates `accountedAssets = balance`.", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD23-reward-distributor-set-recipient-corrupts-epoch-weight", "id": 394, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "RewardDistributor.setRecipient calls `epochs.addWeight(epochs.current(), weight)` on EVERY update \u2014 it adds the new weig", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD26-lending-liquidate-cei-collateral-transfer", "id": 395, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractB.liquidate transfers `collateralAsset` to the liquidator BEFORE calling `decreaseDebt` and updating `p.collater", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD27-lending-batch-liquidate-no-collateral-seized", "id": 396, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractB.batchLiquidate pulls `repayAmount` from the caller via `safeTransferFrom`, calls `positions[borrower].decrease", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD28-escrow-disputed-state-permanently-locks-funds", "id": 397, "n_siblings": 0, "poc_fired": false, "severity": "Medium", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "EscrowBook.dispute transitions an escrow to the `Disputed` state but the contract exposes no function that can release, ", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD6-pool-oracle-no-staleness-check", "id": 401, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractB._isSolvent (called from withdraw, borrow, liquidate) consumes `oracle.price(collateralToken)` with no freshnes", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD7-pool-liquidate-collateral-clamp-leaks-debt", "id": 402, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractB.liquidate clamps the seized collateral when the computed amount exceeds `account.collateral` (`if (seize > col", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD9-gov-vote-weight-flash-loanable", "id": 404, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractC.vote reads voter weight as `governanceToken.balanceOf(msg.sender)` at vote time, with no snapshot / checkpoint", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": "tx-origin-auth", "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD29-gov-emergency-pay-tx-origin-auth", "id": 405, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "ContractC.emergencyPay authenticates the caller with `if (tx.origin != governor) revert ContractCNotOriginGovernor();` a", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": "dos-on-batch-transfer", "cycle_id": "20260518-024129", "disclosure_url": null, "hypothesis_id": "SOLD30-reward-distributor-push-loop-dos", "id": 406, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 8, "target_name": "osec-solidity-medium", "title": "RewardDistributor.distributeEpoch loops over `recipients[]` and calls `rewardToken.safeTransfer(account, amount)` for ea", "updated_at": "2026-05-18T21:39:02+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD17-gov-execute-uses-delegatecall-storage-takeover", "id": 414, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "ContractC.executeModule forwards queued proposal payloads via delegatecall, allowing any executed proposal to overwrite ContractC's own storage (admin, guardian, paused, etc.) and atomically take over the governance contract.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD27-lending-batch-liquidate-no-collateral-seized", "id": 422, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "ContractB.batchLiquidate dispatches via this.liquidate(...), an external self-call that resets msg.sender to address(this); seized collateral is routed to the contract self instead of the EOA caller while the borrower's debt is correctly reduced.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD31-lending-borrow-permit-sig-no-chainid", "id": 427, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "ContractB.permitBorrow accepts a borrow-permit digest that omits chainId, address(this), and a per-borrower nonce, enabling cross-chain replay and indefinite same-chain replay of any captured signature.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD32-gov-proposal-sig-no-chainid", "id": 428, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "ContractC.proposeBySig accepts a proposal digest that omits chainId, address(this), and a per-proposer nonce, enabling cross-deployment replay across every ContractC instance and indefinite same-chain replay.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD34-price-router-zero-staleness-disables-check", "id": 430, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "PriceRouter.price short-circuits its staleness check when config.maxStaleness == 0, accepting arbitrarily stale prices either by RISK_ROLE configuration or by default for any uninitialized asset.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD36-modules-set-operator-instant-takeover", "id": 432, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "All ten protocol modules expose setOperator(address) as a one-step transfer with no timelock, letting a compromised operator key seize the role and lock out the legitimate operator in a single transaction across the entire surface.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD37-debt-ledger-reduce-debt-global-decoupling", "id": 433, "n_siblings": 0, "poc_fired": true, "severity": "High", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "DebtLedger._reduceDebt subtracts interest-scaled (current-value) units from totalDebtByAsset, which tracks only principal-scaled units, causing the global counter to drift irrecoverably downward with every interest-accruing repayment.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD42-risk-engine-assess-rebalance-threshold-mismatch", "id": 439, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "RiskEngine.assess4 / assess9 / assess10 use different BIAS and MULTIPLIER constants for identical inputs, letting an operator cherry-pick the variant that suppresses or forces a rebalance on any record.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD7-pool-liquidate-collateral-clamp-leaks-debt", "id": 445, "n_siblings": 0, "poc_fired": true, "severity": "Medium", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "ContractB.liquidate clamps the seized collateral when it exceeds the borrower's remaining collateral, but does not symmetrically reduce the applied debt \u2014 the liquidator pays full debt and receives less collateral than the bonus formula requires.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" }, { "bug_class": null, "cycle_id": "20260518-150020", "disclosure_url": null, "hypothesis_id": "SOLD9-gov-vote-weight-flash-loanable", "id": 447, "n_siblings": 0, "poc_fired": true, "severity": "Critical", "status": "disclosed", "target_id": 9, "target_name": "osec-solidity-large", "title": "ContractC.castVote reads voter weight as governanceToken.balanceOf(msg.sender) at vote time with no snapshot, letting any flash-loan source pass or defeat any proposal at zero capital cost.", "updated_at": "2026-05-18T21:35:49+00:00", "verdict": "TRUE" } ], "receipts_signed": 36, "recent_cycles": [ { "cost_usd": 78.05030000000002, "cycle_id": "20260519-230706", "engine_sha": "73110357c3", "finished_at": "2026-05-20T02:49:36+00:00", "n_confirmed": 12, "n_dispatched": 36, "receipt_fingerprint": null, "started_at": "2026-05-19T23:07:06+00:00", "target_id": 6, "target_name": "osec-c-large" }, { "cost_usd": 56.1, "cycle_id": "20260519-163207", "engine_sha": "640735f39c", "finished_at": "2026-05-19T21:40:05+00:00", "n_confirmed": 11, "n_dispatched": 25, "receipt_fingerprint": null, "started_at": "2026-05-19T16:32:07+00:00", "target_id": 5, "target_name": "osec-c-medium" }, { "cost_usd": 41.5925, "cycle_id": "20260519-001419", "engine_sha": "5deee49cd7", "finished_at": "2026-05-19T03:07:07+00:00", "n_confirmed": 8, "n_dispatched": 14, "receipt_fingerprint": null, "started_at": "2026-05-19T00:14:19+00:00", "target_id": 4, "target_name": "osec-c-small" }, { "cost_usd": 0, "cycle_id": "20260519-000908", "engine_sha": "5deee49cd7", "finished_at": null, "n_confirmed": 0, "n_dispatched": 0, "receipt_fingerprint": null, "started_at": "2026-05-19T00:09:08+00:00", "target_id": 4, "target_name": "osec-c-small" }, { "cost_usd": 0, "cycle_id": "20260519-000748", "engine_sha": "5deee49cd7", "finished_at": null, "n_confirmed": 0, "n_dispatched": 0, "receipt_fingerprint": null, "started_at": "2026-05-19T00:07:48+00:00", "target_id": 4, "target_name": "osec-c-small" }, { "cost_usd": 0, "cycle_id": "20260519-000309", "engine_sha": "5deee49cd7", "finished_at": null, "n_confirmed": 0, "n_dispatched": 0, "receipt_fingerprint": null, "started_at": "2026-05-19T00:03:09+00:00", "target_id": 4, "target_name": "osec-c-small" }, { "cost_usd": 0, "cycle_id": "20260519-000051", "engine_sha": "5deee49cd7", "finished_at": null, "n_confirmed": 0, "n_dispatched": 0, "receipt_fingerprint": null, "started_at": "2026-05-19T00:00:51+00:00", "target_id": 4, "target_name": "osec-c-small" }, { "cost_usd": 69.74130000000001, "cycle_id": "20260518-150020", "engine_sha": "e9dfd4210b", "finished_at": "2026-05-18T19:52:49+00:00", "n_confirmed": 10, "n_dispatched": 41, "receipt_fingerprint": null, "started_at": "2026-05-18T15:00:20+00:00", "target_id": 9, "target_name": "osec-solidity-large" }, { "cost_usd": 88.22370000000001, "cycle_id": "20260518-024129", "engine_sha": "f50aa5ef92", "finished_at": "2026-05-18T06:14:24+00:00", "n_confirmed": 17, "n_dispatched": 26, "receipt_fingerprint": null, "started_at": "2026-05-18T02:41:29+00:00", "target_id": 8, "target_name": "osec-solidity-medium" }, { "cost_usd": 61.962, "cycle_id": "20260517-193953", "engine_sha": "0c928be33e", "finished_at": "2026-05-18T01:05:52+00:00", "n_confirmed": 12, "n_dispatched": 13, "receipt_fingerprint": null, "started_at": "2026-05-17T19:39:53+00:00", "target_id": 7, "target_name": "osec-solidity-small" }, { "cost_usd": 0, "cycle_id": "20260517-021201", "engine_sha": "55bb98f670", "finished_at": "2026-05-17T02:12:01+00:00", "n_confirmed": 0, "n_dispatched": 0, "receipt_fingerprint": null, "started_at": "2026-05-17T02:12:01+00:00", "target_id": 3, "target_name": "osec-solana-large" }, { "cost_usd": 66.982, "cycle_id": "20260517-014506", "engine_sha": "55bb98f670", "finished_at": "2026-05-17T16:45:20+00:00", "n_confirmed": 8, "n_dispatched": 64, "receipt_fingerprint": null, "started_at": "2026-05-17T01:45:06+00:00", "target_id": 3, "target_name": "osec-solana-large" }, { "cost_usd": 103.377, "cycle_id": "20260516-030436", "engine_sha": "54036c39b9", "finished_at": "2026-05-16T18:47:49+00:00", "n_confirmed": 17, "n_dispatched": 44, "receipt_fingerprint": null, "started_at": "2026-05-16T03:04:36+00:00", "target_id": 2, "target_name": "osec-solana-medium" }, { "cost_usd": 20.076099999999983, "cycle_id": "20260515-192131", "engine_sha": "f280ea8a83", "finished_at": "2026-05-15T23:17:57+00:00", "n_confirmed": 16, "n_dispatched": 36, "receipt_fingerprint": null, "started_at": "2026-05-15T19:21:31+00:00", "target_id": 1, "target_name": "osec-solana-small" }, { "cost_usd": 251.629, "cycle_id": "20260514-233645", "engine_sha": "5f7bff30e6", "finished_at": "2026-05-15T12:52:07+00:00", "n_confirmed": 46, "n_dispatched": 75, "receipt_fingerprint": null, "started_at": "2026-05-14T23:36:45+00:00", "target_id": 12, "target_name": "osec-aptos-large" }, { "cost_usd": 19.57860000000002, "cycle_id": "20260514-151541", "engine_sha": "5527255c10", "finished_at": "2026-05-14T20:36:06+00:00", "n_confirmed": 42, "n_dispatched": 61, "receipt_fingerprint": null, "started_at": "2026-05-14T15:15:41+00:00", "target_id": 11, "target_name": "osec-aptos-medium" }, { "cost_usd": 42.3169, "cycle_id": "20260513-191318", "engine_sha": "e926fabc95", "finished_at": "2026-05-14T02:39:32+00:00", "n_confirmed": 7, "n_dispatched": 40, "receipt_fingerprint": null, "started_at": "2026-05-13T19:13:18+00:00", "target_id": 10, "target_name": "osec-aptos-small" }, { "cost_usd": 0, "cycle_id": "20260511-183154", "engine_sha": "6cd742f25a", "finished_at": "2026-05-11T19:01:54+00:00", "n_confirmed": 0, "n_dispatched": 0, "receipt_fingerprint": "df:77:18:53:8e:4c:76:03\u2026", "started_at": "2026-05-11T18:31:54+00:00", "target_id": 2, "target_name": "percolator-live" }, { "cost_usd": 0, "cycle_id": "20260511-182404", "engine_sha": "6cd742f25a", "finished_at": "2026-05-13T04:17:18+00:00", "n_confirmed": 0, "n_contested": 0, "n_debate_done": 0, "n_dispatched": 0, "n_kani_harnesses": 0, "n_litesvm": 0, "n_poc_logs": 0, "n_true_layer1": 0, "receipt_fingerprint": null, "started_at": "2026-05-11T18:24:04+00:00", "target_id": 1, "target_name": "default" }, { "cost_usd": 0.0594, "cycle_id": "20260511-141242", "engine_sha": "6cd742f25a", "finished_at": "2026-05-11T14:15:39+00:00", "n_confirmed": 0, "n_contested": 0, "n_debate_done": 0, "n_dispatched": 3, "n_kani_harnesses": 0, "n_litesvm": 0, "n_poc_logs": 0, "n_true_layer1": 0, "receipt_fingerprint": null, "started_at": "2026-05-11T14:12:42+00:00", "target_id": 1, "target_name": "default" } ], "services": [ { "key": "shadow", "last_tick_ms": 1779082614000, "state": "stale", "unit": "jelleo-shadow.service" }, { "key": "watch", "last_tick_ms": 1779082629000, "state": "stale", "unit": "jelleo-watch.service" }, { "key": "scheduler-24h", "last_tick_ms": 1780218029000, "state": "up", "unit": "jelleo-scheduler-24h.timer" }, { "key": "scheduler-weekly", "last_tick_ms": 1779700557000, "state": "stale", "unit": "jelleo-scheduler-weekly.timer" }, { "key": "scheduler-monthly", "last_tick_ms": 1778175216000, "state": "stale", "unit": "jelleo-scheduler-monthly.timer" }, { "key": "snapshot", "last_tick_ms": 1780246800000, "state": "up", "unit": "jelleo-snapshot.timer" }, { "key": "backup", "last_tick_ms": 1780201870000, "state": "up", "unit": "jelleo-backup.timer" }, { "key": "health", "last_tick_ms": 1780246662000, "state": "up", "unit": "jelleo-health.timer" }, { "key": "heartbeat", "last_tick_ms": 1780243920000, "state": "up", "unit": "jelleo-heartbeat.timer" } ], "spend": { "last_24h_usd": 0.0, "last_call_at": "2026-05-25T18:24:21+00:00", "n_calls_total": 3674, "source": "/root/.audit_api_calls.jsonl", "today_usd": 0.0, "total_usd": 443.06 }, "stats": { "by_severity_disclosed": { "Critical": 0, "High": 0, "Info": 0, "Low": 0, "Medium": 0 }, "n_cycles": 46, "n_findings_disclosed": 81, "n_findings_total": 1242, "n_targets": 21 }, "targets": [ { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-11T18:24:04+00:00", "last_cycle_id": "20260511-182404", "n_findings": 261, "n_findings_disclosed": 0, "name": "default", "severity_counts": { "Critical": 51, "High": 116, "Info": 21, "Low": 17, "Medium": 56 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-11T00:27:41+00:00", "last_cycle_id": "20260511-002741", "n_findings": 1, "n_findings_disclosed": 0, "name": "percolator", "severity_counts": { "Critical": 0, "High": 0, "Info": 1, "Low": 0, "Medium": 0 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-07T00:35:00+00:00", "last_cycle_id": "20260507-003500-5059332", "n_findings": 8, "n_findings_disclosed": 0, "name": "percolator-bounty3-regression", "severity_counts": { "Critical": 3, "High": 5, "Info": 0, "Low": 0, "Medium": 0 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-07T00:49:22+00:00", "last_cycle_id": "20260507-004922-5059332", "n_findings": 6, "n_findings_disclosed": 0, "name": "percolator-bounty3-wincondition", "severity_counts": { "Critical": 5, "High": 1, "Info": 0, "Low": 0, "Medium": 0 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-07T00:40:30+00:00", "last_cycle_id": "20260507-004030-04b854e", "n_findings": 8, "n_findings_disclosed": 0, "name": "percolator-bounty3-wrapper-r1", "severity_counts": { "Critical": 3, "High": 5, "Info": 0, "Low": 0, "Medium": 0 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-07T00:43:13+00:00", "last_cycle_id": "20260507-004313-04b854e", "n_findings": 8, "n_findings_disclosed": 0, "name": "percolator-bounty3-wrapper-r2", "severity_counts": { "Critical": 3, "High": 3, "Info": 0, "Low": 0, "Medium": 2 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-07T00:26:48+00:00", "last_cycle_id": "20260507-002648-5059332", "n_findings": 8, "n_findings_disclosed": 0, "name": "percolator-diff-hunt", "severity_counts": { "Critical": 0, "High": 2, "Info": 0, "Low": 2, "Medium": 4 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-11T18:31:54+00:00", "last_cycle_id": "20260511-183154", "n_findings": 359, "n_findings_disclosed": 0, "name": "percolator-live", "severity_counts": { "Critical": 82, "High": 175, "Info": 0, "Low": 15, "Medium": 87 } }, { "engine_repo": "aeyakovenko/percolator", "last_cycle_at": "2026-05-06T23:47:57+00:00", "last_cycle_id": "20260506-234757-04b854e", "n_findings": 101, "n_findings_disclosed": 0, "name": "percolator-wrapper-live", "severity_counts": { "Critical": 16, "High": 53, "Info": 0, "Low": 5, "Medium": 27 } }, { "engine_repo": "sahuang-osec/aptos-large", "last_cycle_at": "2026-05-14T23:36:45+00:00", "last_cycle_id": "20260514-233645", "n_findings": 75, "n_findings_disclosed": 10, "name": "osec-aptos-large", "severity_counts": { "Critical": 16, "High": 17, "Info": 26, "Low": 3, "Medium": 13 } }, { "engine_repo": "sahuang-osec/aptos-medium", "last_cycle_at": "2026-05-14T15:15:41+00:00", "last_cycle_id": "20260514-151541", "n_findings": 61, "n_findings_disclosed": 5, "name": "osec-aptos-medium", "severity_counts": { "Critical": 12, "High": 18, "Info": 11, "Low": 4, "Medium": 16 } }, { "engine_repo": "sahuang-osec/aptos-small", "last_cycle_at": "2026-05-13T19:13:18+00:00", "last_cycle_id": "20260513-191318", "n_findings": 40, "n_findings_disclosed": 2, "name": "osec-aptos-small", "severity_counts": { "Critical": 3, "High": 3, "Info": 26, "Low": 1, "Medium": 7 } }, { "engine_repo": "sahuang-osec/c-large", "last_cycle_at": "2026-05-19T23:07:06+00:00", "last_cycle_id": "20260519-230706", "n_findings": 36, "n_findings_disclosed": 0, "name": "osec-c-large", "severity_counts": { "Critical": 3, "High": 7, "Info": 3, "Low": 4, "Medium": 19 } }, { "engine_repo": "sahuang-osec/c-medium", "last_cycle_at": "2026-05-19T16:32:07+00:00", "last_cycle_id": "20260519-163207", "n_findings": 25, "n_findings_disclosed": 0, "name": "osec-c-medium", "severity_counts": { "Critical": 6, "High": 6, "Info": 5, "Low": 0, "Medium": 8 } }, { "engine_repo": "sahuang-osec/c-small", "last_cycle_at": "2026-05-19T00:14:19+00:00", "last_cycle_id": "20260519-001419", "n_findings": 14, "n_findings_disclosed": 0, "name": "osec-c-small", "severity_counts": { "Critical": 3, "High": 2, "Info": 5, "Low": 0, "Medium": 4 } }, { "engine_repo": "sahuang-osec/solana-large", "last_cycle_at": "2026-05-17T02:12:01+00:00", "last_cycle_id": "20260517-021201", "n_findings": 64, "n_findings_disclosed": 8, "name": "osec-solana-large", "severity_counts": { "Critical": 8, "High": 14, "Info": 25, "Low": 3, "Medium": 14 } }, { "engine_repo": "sahuang-osec/solana-medium", "last_cycle_at": "2026-05-16T03:04:36+00:00", "last_cycle_id": "20260516-030436", "n_findings": 44, "n_findings_disclosed": 10, "name": "osec-solana-medium", "severity_counts": { "Critical": 6, "High": 18, "Info": 17, "Low": 0, "Medium": 3 } }, { "engine_repo": "sahuang-osec/solana-small", "last_cycle_at": "2026-05-15T19:21:31+00:00", "last_cycle_id": "20260515-192131", "n_findings": 43, "n_findings_disclosed": 7, "name": "osec-solana-small", "severity_counts": { "Critical": 9, "High": 7, "Info": 20, "Low": 4, "Medium": 3 } }, { "engine_repo": "sahuang-osec/solidity-large", "last_cycle_at": "2026-05-18T15:00:20+00:00", "last_cycle_id": "20260518-150020", "n_findings": 41, "n_findings_disclosed": 10, "name": "osec-solidity-large", "severity_counts": { "Critical": 7, "High": 4, "Info": 21, "Low": 1, "Medium": 8 } }, { "engine_repo": "sahuang-osec/solidity-medium", "last_cycle_at": "2026-05-18T02:41:29+00:00", "last_cycle_id": "20260518-024129", "n_findings": 26, "n_findings_disclosed": 17, "name": "osec-solidity-medium", "severity_counts": { "Critical": 7, "High": 5, "Info": 7, "Low": 0, "Medium": 7 } }, { "engine_repo": "sahuang-osec/solidity-small", "last_cycle_at": "2026-05-17T19:39:53+00:00", "last_cycle_id": "20260517-193953", "n_findings": 13, "n_findings_disclosed": 12, "name": "osec-solidity-small", "severity_counts": { "Critical": 3, "High": 4, "Info": 0, "Low": 3, "Medium": 3 } } ], "version": "v0.1" }