StakingVault.sol

Score 56 out of 100, grade D

Source uploaded: 1 file, 61 lines of code, audited 19 Oct 2026, 12:39 UTC in 1 min 18 s.

Not attested onchain. Use the verifier below to check whether any registry record points at this file.

Findings by severity

Critical	1	−10 pts
High	6	−30 pts
Medium	1	−2 pts
Low	2	−2 pts
Info	0	0 pts

Where findings come from

Model and Slither agree40%4
Model only20%2
Slither only40%4

Confirmed by static analysis: 80%. AI only: 20%.

Models: cx/gpt-5.6-terra
Quorum reviewers: ag/claude-sonnet-4-6
Static analysis: Slither 0.11.6, solc 0.8.30, 8 detector results
Receipts: 2 signed receipts, attester 0xef63…FdC5
Source hash: 0xbf9700…3db2b0
Report CID: bafkreie…qfwwva

10 findings

Each cell is one line of code. Select a cell to jump to its finding.

StakingVault.sol80 lines, 10 findings

45 }

47 function earned(address account) public view returns (uint256) {

48 return (staked[account] * (rewardPerToken() - userRewardPerTokenPaid[account])) / 1e18 + rewards[account];

49 }

51 function stake(uint256 amount) external updateReward(msg.sender) {

52 require(amount > 0, "zero");

53 stakingToken.transferFrom(msg.sender, address(this), amount);

54 staked[msg.sender] += amount;

55 totalStaked += amount;

56 }

58 function withdraw(uint256 amount) external updateReward(msg.sender) {

59 staked[msg.sender] -= amount;

60 totalStaked -= amount;

61 stakingToken.transfer(msg.sender, amount);

62 }

64 function claim() external updateReward(msg.sender) {

65 uint256 reward = rewards[msg.sender];

66 rewardToken.transfer(msg.sender, reward);

67 rewards[msg.sender] = 0;

68 }

70 /// @notice Lets the team change emissions.

71 function setRewardRate(uint256 rate) external {

72 rewardRate = rate;

73 }

75 /// @notice Recovers tokens in an emergency.

76 function emergencyWithdraw(address token, address to, uint256 amount) external {

77 IERC20(token).transfer(to, amount);

78 }

79}

Signed inference receipts

Every model call is recorded with the prompt and response hashes, the provider request id and token usage, and signed by the Sentinel attester as EIP-712 data. The Merkle root of these receipts is stored onchain with the audit.

#0cx/gpt-5.6-terra via 9router.dea.web.id, analysis:StakingVault.solrequest resp_071263d3dd2fc45c016ad60f4042648194ae1873da65a3a9662,014 in, 1,958 out, 1 min 13 ssig 0xe6a8…881c
#1ag/claude-sonnet-4-6 via 9router.dea.web.id, quorum:F-01request chatcmpl-msg_vrtx_011CgBcNUGt8Yf1Go7SQPkdS2,622 in, 62 out, 3.0 ssig 0xc357…941c

Verify this report yourself

Your browser recomputes the report hash, the CID, every receipt signature and the Merkle root from the file, then reads AuditRegistry on Base Sepolia directly and compares. No Sentinel server is trusted for this.

Report JSON MarkdownThe JSON is the exact byte sequence whose keccak256 is the report hash onchain.