multi-stance-audit-fanout

multi-stance-audit-fanout

Stance-based audit fan-out. Eight specialist personas read the same Solidity source through different mental models; findings are then deduplicated by group key with composite-chain detection. Distinct from evm-audit-flow (tool pipeline) — this fans out human-style review across audit lenses to catch logic bugs no detector finds.

Orchestration model (read first). This is a Chrono-orchestrated fan-out. Workers NEVER self-spawn, launch a model CLI, or dispatch sub-agents — that is Chrono's job. A security-analyst worker does NOT run the eight stances itself. Instead this skill defines (a) the stance roster + briefs, (b) the source bundle, and (c) the dedup/promotion method, so a worker can either surface the fan-out as a need (## NEEDS FROM CHRONO: dispatch the 8 stance packets over <bundle>) or, when acting AS the Chrono-appointed coordinator, dedup the returned stance outputs. Chrono dispatches N stance packets on the board rail; a coordinator role dedups and writes the single consolidated result.

When to use

• A contract has passed evm-audit-flow static + symbolic passes but still needs logic-bug coverage no detector catches.
• The target is small enough (≤2k nSLOC) for eight readers to cover end-to-end.
• You want stance diversity (8 lenses, 1 model) cheaply, before paying for model diversity (a full multi-model fan-out).
• Skip when a fresh equivalent report already exists; do not duplicate.

Stance roster

Each stance gets the SAME source bundle plus its own role brief. The eight stances are:

1. vector-scan — sweep known vuln classes (reentrancy, oracle manip, signature replay, storage collision, delegatecall hijack, slippage, sandwich, MEV).
2. math-precision — rounding direction, decimal scaling, fixed-point overflow, division before multiplication, dust accumulation, precision loss across token decimals.
3. access-control — role surface, two-step transfer correctness, initializer reentrancy, modifier ordering, bypass via internal-call routing.
4. economic-security — incentive design, MEV extraction, fee accrual paths, redemption griefing, donation attacks, rebalance arbitrage, liquidation race conditions.
5. execution-trace — pick the top 3 fund-flow paths, single-step from entry to settlement, note every state read/write/external call along the way; chase reachability not patterns.
6. invariant — derive invariants the protocol should hold (totalSupply == sum(balances), k for AMMs, collateralization ratio, share-to-asset monotonicity), then look for paths that break each one.
7. periphery — ERC-20/721/777 quirks, fee-on-transfer, rebasing, missing return values, safeTransfer gaps, permit front-running, callback re-entry surfaces.
8. first-principles — ignore checklists; ask "what is this contract trying to do, and what would I do as the attacker if I had infinite time?" Capture novel/unnamed bug classes.