Scoring and grades

Every report starts at 100 and loses points per finding:

score = max(0, 100 - sum of points)

The critical cap

Any critical left in the report caps the grade at C. A contract scoring 95 with one critical is graded C. The cap never raises a grade: 50 with a critical stays D.

Criticals that fail quorum are already downgraded to high before scoring, so every critical that is counted had at least two of three models agree it is real.

AuditRegistry.record recomputes this rule from the score and the critical count and reverts with GradeMismatch if they disagree, so a report cannot be recorded with a grade its own numbers do not support.

Which findings count

• Model findings are kept only when the model's confidence is above 0.6.
• Slither findings below medium impact are mostly informational; detectors that fit none of the ten categories (naming, pragma, dead code) appear as category "other".
• Findings inside dependencies (lib/, node_modules/) are filtered out; the dependency code is compiled but not graded.

Provisional grades

If Slither found nothing at medium or above and a model reports a critical that Slither does not confirm, the report is flagged needs human review and the grade is shown as provisional. The flag is stored onchain with the audit, so a launchpad sees it too.

Origin percentages

Each report states how many findings were confirmed by static analysis, how many came from models only and how many from Slither only. A report that is mostly "model only" deserves more skepticism than one where Slither and the models agree.