audit-breadth-scan

Audit Breadth Scan

Purpose

The breadth scan is a systematic, contract-by-contract review that ensures every function is examined at least once. The goal is NOT to find every bug — it's to identify high-risk areas that warrant depth analysis.

Methodology

Pass 1: Contract-Level Assessment

For each contract in scope, assess:

## [Contract Name] — Breadth Assessment

### Overview
- Lines of code: X
- Inheritance chain: A -> B -> C
- State variables: Y
- External calls: Z

### Complexity Rating: [Low | Medium | High | Critical]
Factors: math complexity, external interactions, state machine logic,
         upgrade mechanics, cross-contract dependencies

### Initial Risk Notes
- [Any patterns that stand out]

Pass 2: Function-Level Risk Assessment

Rate each function on a risk matrix:

Risk Factor	Weight	Criteria
External calls	High	Calls to untrusted contracts
State changes	Medium	Modifies critical state (balances, shares)
Math operations	Medium	Division, multiplication with large numbers
Access control	High	Missing or incorrect
Value transfer	Critical	ETH or token movement
User input	Medium	Complex parameter handling

### Function Risk Matrix

| Function | External Calls | State Change | Math | Value Transfer | Risk |
|----------|---------------|--------------|------|----------------|------|
| deposit() | transferFrom | balances, supply | share calc | tokens in | HIGH |
| withdraw() | transfer, strategy | balances, supply | share calc | tokens out | CRITICAL |
| setFee() | none | fee param | none | none | LOW |
| harvest() | aave.withdraw | deployed amount | yield calc | tokens move | HIGH |

Pass 3: Attack Surface Mapping

For each high/critical risk function, map potential attack vectors:

### Attack Surface: withdraw()

**Preconditions**: User has shares, vault has assets

**Attack Vectors**:
1. Reentrancy via token callback (ERC777, hooks)
   - Mitigation: ReentrancyGuard
   - Status: CHECK if guard applied

2. Share price manipulation
   - Donate tokens to inflate totalAssets before withdraw
   - Status: CHECK virtual shares mitigation

3. Front-running
   - Sandwich attack around large withdrawals
   - Status: CHECK slippage protection

4. Oracle manipulation
   - Stale/manipulated price affects withdrawal amount
   - Status: CHECK staleness validation

5. Integer overflow/underflow
   - Share calculation edge cases
   - Status: CHECK Solidity 0.8 overflow protection