-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathproof.html
More file actions
139 lines (133 loc) · 8.63 KB
/
Copy pathproof.html
File metadata and controls
139 lines (133 loc) · 8.63 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Zero false positives — click through the proof · Juan (juan23z)</title>
<meta name="description" content="Every security flag my scanner raised on Morpho Blue, Uniswap V4 and Solady — and exactly why each one is a false positive. Interactive, verifiable.">
<style>
:root{--bg:#0b0f1a;--card:#111827;--bd:#1f2937;--tx:#e2e8f0;--mut:#94a3b8;--ac:#a5b4fc;--gr:#4ade80;--am:#fbbf24;--code:#0f1626}
*{box-sizing:border-box}
body{margin:0;background:var(--bg);color:var(--tx);font-family:system-ui,-apple-system,Segoe UI,Roboto,sans-serif;line-height:1.6}
.wrap{max-width:760px;margin:0 auto;padding:0 20px}
a{color:var(--ac);text-decoration:none}
a:hover{text-decoration:underline}
.hero{text-align:center;padding:56px 0 30px}
.hero h1{font-size:36px;line-height:1.15;margin:0 0 14px;font-weight:800;letter-spacing:-.5px}
.hero .sub{font-size:18px;color:var(--mut);max-width:600px;margin:0 auto}
.stats{display:grid;grid-template-columns:repeat(4,1fr);gap:12px;margin:30px 0 8px}
.stat{background:var(--card);border:1px solid var(--bd);border-radius:12px;padding:16px}
.stat .lbl{font-size:12px;color:var(--mut)}
.stat .num{font-size:28px;font-weight:800;font-variant-numeric:tabular-nums;margin-top:2px}
.stat.win{border-color:#166534;background:#0f1a14}
.stat.win .lbl,.stat.win .num{color:var(--gr)}
section{padding:30px 0;border-top:1px solid var(--bd)}
.hint{color:var(--mut);font-size:14px;margin:0 0 14px}
.sel{display:flex;gap:10px;flex-wrap:wrap;margin-bottom:20px}
.tab{padding:9px 16px;border:1px solid var(--bd);background:var(--card);color:var(--tx);border-radius:10px;
font-size:14px;cursor:pointer;font-family:inherit}
.tab.on{border-color:var(--ac);color:var(--ac);background:#141a2e}
.pname{font-size:20px;font-weight:800;margin:0}
.ptag{color:var(--mut);font-size:13px;margin:2px 0 16px}
.flag{border:1px solid var(--bd);border-radius:10px;margin-bottom:10px;background:var(--card);overflow:hidden}
.fhd{display:flex;align-items:center;gap:12px;padding:13px 15px;cursor:pointer}
.fhd:hover{background:#141a24}
.sev{font-size:11px;font-weight:700;padding:3px 9px;border-radius:6px;background:#2a1f06;color:var(--am);border:1px solid #78560f;white-space:nowrap}
.ftitle{flex:1;font-size:14.5px}
.fverd{font-size:12.5px;color:var(--gr);white-space:nowrap}
.fchev{color:var(--mut);transition:transform .15s}
.fchev.open{transform:rotate(180deg)}
.fwhy{padding:0 15px 15px 15px;font-size:14px;color:var(--mut);line-height:1.7;display:none}
.clean{display:flex;gap:12px;align-items:flex-start;background:#0f1a14;border:1px solid #166534;border-radius:12px;padding:16px 18px}
.clean .ic{color:var(--gr);font-size:22px;line-height:1;margin-top:1px}
.clean .t{font-size:14px;line-height:1.75}
.cta-row{text-align:center;padding:8px 0 4px}
.cta{display:inline-flex;align-items:center;gap:8px;background:var(--ac);color:#0b0f1a;font-weight:700;
padding:12px 22px;border-radius:10px;font-size:15px}
.foot{text-align:center;padding:40px 0;color:var(--mut);font-size:13px}
code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;color:#cbd5e1;font-size:.92em}
@media(max-width:560px){.stats{grid-template-columns:repeat(2,1fr)}.hero h1{font-size:28px}}
</style>
</head>
<body>
<div class="wrap">
<div class="hero">
<h1>Zero false positives — click through the proof</h1>
<p class="sub">I run a custom detector suite over major protocols. Here is every flag it raised — and exactly why each one is a false positive. Verify it yourself.</p>
</div>
<div class="stats">
<div class="stat"><div class="lbl">protocols scanned</div><div class="num">3</div></div>
<div class="stat"><div class="lbl">flags raised</div><div class="num">4</div></div>
<div class="stat"><div class="lbl">verified false positive</div><div class="num">4</div></div>
<div class="stat win"><div class="lbl">false positives shipped</div><div class="num">0</div></div>
</div>
<section>
<p class="hint">Pick a protocol, then click any flag to see why it is a false positive.</p>
<div class="sel" id="sel"></div>
<div id="detail"></div>
</section>
<section>
<div class="cta-row">
<p class="hint" style="margin-bottom:16px">Custom detectors calibrated to zero false positives across all of OpenZeppelin, plus line-by-line manual verification. When your code is clean, I tell you that and show you why — not a padded PDF.</p>
<a class="cta" href="index.html">Pre-mainnet? Get a review →</a>
</div>
</section>
<div class="foot">Juan · Solidity / DeFi security · <a href="index.html">juan23z.github.io</a></div>
</div>
<script>
var data = [
{id:'morpho', name:'Morpho Blue', tag:'Lending primitive · 3 flags', flags:[
{sev:'HIGH', title:'Cross-function reentrancy in liquidate()', verdict:'false positive',
why:'Strict checks-effects-interactions. Every state change — borrowShares, market totals, collateral, bad-debt realization — settles before the token transfer and the opt-in onMorphoLiquidate callback. Re-entering during that callback finds already-consistent accounting, so no reentrancy guard is needed by design.'},
{sev:'HIGH', title:'Cross-function reentrancy in _accrueInterest()', verdict:'false positive',
why:'The flagged external call is IIrm(irm).borrowRate(). The interest-rate model is fixed at market creation and is part of the immutable market parameters — not attacker-controlled. A reentrancy vector needs an attacker-controlled callee; this is a trusted, configured contract.'},
{sev:'MEDIUM', title:'Fee-on-transfer token not supported', verdict:'false positive',
why:'True, but by design: Morpho Blue explicitly documents that it is not compatible with rebasing or fee-on-transfer tokens. A stated, intentional assumption is spec — not a security finding.'}
]},
{id:'univ4', name:'Uniswap V4', tag:'Singleton AMM · 1 flag', flags:[
{sev:'HIGH', title:'Unprotected initialize() in PoolManager', verdict:'false positive',
why:'initialize() does not initialize the contract — it creates a pool. It takes a PoolKey and a start price, validates the ticks, and registers a new market. It sets no owner or admin, so there is nothing for an attacker to take over. Permissionless pool creation is the whole point, exactly as in V2 and V3. PoolManager is a singleton, not a proxy — no Initializable, no upgrade path to front-run — and the function carries a noDelegateCall guard.'}
]},
{id:'solady', name:'Solady', tag:'Gas-optimized library · 114 files', flags:[], clean:true,
note:'Zero flags across all 114 contracts — code that is mostly hand-written assembly, the kind that makes naive tools carpet-bomb false positives. The best example: the raw call() in SafeTransferLib looks like the classic unchecked-call bug, but it verifies success AND that the return value is true AND that the token address has code — more rigorous than a plain transferFrom, all in a few gas-golfed opcodes. Correct restraint: there was nothing to report.'}
];
function esc(s){return s.replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>');}
function render(p){
var h = '<p class="pname">'+esc(p.name)+'</p><p class="ptag">'+esc(p.tag)+'</p>';
if(p.clean){
h += '<div class="clean"><div class="ic">✓</div><div class="t">'+esc(p.note)+'</div></div>';
} else {
p.flags.forEach(function(f,i){
h += '<div class="flag"><div class="fhd" onclick="tog(\''+p.id+'\','+i+')">'+
'<span class="sev">'+f.sev+'</span>'+
'<span class="ftitle">'+esc(f.title)+'</span>'+
'<span class="fverd">✓ '+f.verdict+'</span>'+
'<span class="fchev" id="c-'+p.id+'-'+i+'">▾</span></div>'+
'<div class="fwhy" id="w-'+p.id+'-'+i+'">'+esc(f.why)+'</div></div>';
});
}
document.getElementById('detail').innerHTML = h;
}
function tog(pid,i){
var w=document.getElementById('w-'+pid+'-'+i), c=document.getElementById('c-'+pid+'-'+i);
var open = w.style.display==='block';
w.style.display = open?'none':'block';
c.className = 'fchev'+(open?'':' open');
}
(function(){
var sel=document.getElementById('sel');
data.forEach(function(p,i){
var b=document.createElement('button');
b.className='tab'+(i===0?' on':'');
b.textContent=p.name;
b.onclick=function(){
[].forEach.call(document.querySelectorAll('.tab'),function(x){x.classList.remove('on');});
b.classList.add('on'); render(p);
};
sel.appendChild(b);
});
render(data[0]);
})();
</script>
</body>
</html>