{"name":"skill:audit-imported-code","files":[{"path":".imd/reads/skills/audit-imported-code.md","digest":"c54ceb747cf9109f06ef18d06a74bce0b637bc23a5726cc3fad9e99ab3ffc59f","content":"This is a correctness and safety audit the requester commissioned of their own code, before it is\nreleased. Its product is a list of defects, each with a failing test input, for the author to fix.\n\nYou are the first to read this project. The requester wrote it or brought it here to launch; the\nagent that adapts it to the launch factory reads your findings next and fixes what reproduces, and a\nfull audit panel reads the adapted code again before anything deploys. So your report is a map for\nthe adapter as much as a verdict: say what is wrong, where, and how to see it.\n\nRead the supplied Pashov guide (`.imd/reads/skills/pashov-skill/REFERENCE.md`), its Senior Auditor's\nMindset first. It is a published auditor checklist of the ways contracts are known to fail; check the\ncode against it, working through every external and public function that changes state, who\nmay call it, what it moves, and what it trusts. Say which contracts you read and which you could not\nreach within your budget.\n\nIf this task's own rules allow helpers (the line beginning \"You may hand independent parts of this\ntask to subagents\"), split the guide's twelve specialties among them in four groups, one group to\neach: math (Math Precision, Boundary, Numerical Gap), permissions (Access Control, Trust Gap,\nAsymmetry), economics (Economic Security, Invariant, Flow Gap) and control flow (Execution Trace,\nPeriphery, First Principles). Each reads the code for its group's failure modes and reports what it\nfound, with the files and lines it rests on. Read the Mindset and the state-changing functions yourself, and\nreproduce every lead before it becomes a finding. Without helpers, make those passes yourself.\n\nReport, as findings with reproductions:\n- defects: loss of funds, funds paid to the wrong party, broken accounting, reentrancy, access\n  control that is weaker than the effect it guards, arithmetic that rounds the wrong way or\n  overflows, broken invariants;\n- what the launch forbids, as medium findings, so the adapter removes it: minting after launch;\n  pausing, freezing, blacklisting or seizing holder balances; DELEGATECALL, CALLCODE, SELFDESTRUCT;\n  proxies, initializers and anything configured after deployment rather than in a constructor.\n\nEach finding needs a concrete reproduction: the call sequence, inputs and state, and what happens\nagainst what should. For a critical or high one, attach a proof as the assignment describes. Severity\nfollows impact: critical and high for loss of funds or permanent breakage, medium for loss under\nconditions or a broken guarantee, low for the rest.\n\nYou write nothing: a submission that changes any file is rejected. Your output is findings."}]}