Audit Recon

# Slither — static analysis
slither . --filter-paths "test|script|node_modules" \
    --print human-summary \
    --print contract-summary

# Aderyn — Solidity-specific linter
aderyn . --exclude test/ --output aderyn-report.md

# Solidity Metrics — complexity and SLOC
solidity-metrics src/

# Dependency tree
forge tree

# Call graph
slither . --print call-graph

# Function summary (visibility, modifiers, state changes)
slither . --print function-summary

# Inheritance graph
slither . --print inheritance-graph

# Variables read/written per function
slither . --print vars-and-auth

# List all dependencies and versions
forge tree

# Check for known vulnerabilities
# Cross-reference OpenZeppelin version against security advisories
# https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories

## Contract Map

### Core
- Vault.sol (512 SLOC) — main entry point
  - Inherits: ERC4626, Ownable, ReentrancyGuard, Pausable
  - External calls: Strategy, Oracle, USDC
  - State: deposits, withdrawals, share pricing

### Periphery
- Strategy.sol (189 SLOC) — yield deployment
  - External calls: Aave Pool, USDC
  - Called by: Vault (only)

### Libraries
- MathLib.sol (45 SLOC) — fixed-point math
  - Pure functions, no state

## Entry Points

| Contract | Function | Access | State Changes | Risk |
|----------|----------|--------|---------------|------|
| Vault | deposit(uint256,address) | Anyone | balances, totalSupply | Medium |
| Vault | withdraw(uint256,address,address) | Owner/approved | balances, totalSupply | High |
| Vault | setStrategy(address) | Owner only | strategy | Critical |
| Vault | pause() | Owner only | paused flag | Low |
| Strategy | harvest() | Keeper only | deployed amount | Medium |
| Strategy | emergencyWithdraw() | Owner only | all state | Critical |

## Trust Boundaries

### Fully Trusted
- Owner multisig (can change parameters, pause, upgrade strategy)
- Timelock controller (executes governance decisions)

### Semi-Trusted
- Keeper bot (can trigger harvest, but cannot steal funds)
- Oracle feeds (Chainlink — trusted but can go stale)

### Untrusted
- End users (deposit/withdraw — fully adversarial)
- External protocols (Aave — could be exploited)
- Token contracts (USDC — could blacklist)

### Attack Surfaces by Trust Level
1. Untrusted user -> Vault: reentrancy, share manipulation, front-running
2. Stale oracle -> Vault: incorrect valuations, over-borrowing
3. Compromised keeper -> Strategy: timing attacks on harvest
4. External protocol exploit -> Strategy: loss of deployed funds

## External Calls

| Source | Target | Function | Untrusted? | Risk |
|--------|--------|----------|------------|------|
| Vault | USDC | transferFrom | No (known) | Low |
| Vault | Strategy | deploy | No (owned) | Low |
| Strategy | Aave Pool | supply | Semi | Medium |
| Strategy | Aave Pool | withdraw | Semi | Medium |
| Oracle | Chainlink | latestRoundData | Semi | Medium |

# Use Slither to enumerate access controls
slither . --print vars-and-auth

# Manually verify:
# 1. Every onlyOwner function is truly admin-only
# 2. No function missing access control that modifies state
# 3. Initializer functions protected against re-initialization
# 4. Constructor sets correct initial values

# Audit Recon Report — [Protocol Name]

## Summary
- **Total SLOC**: X
- **Contracts in scope**: Y
- **External dependencies**: Z
- **Compiler**: solc X.Y.Z

## Architecture Diagram
[Mermaid or text diagram]

## Entry Points (sorted by risk)
[Table from Step 4]

## External Calls
[Table from Step 6]

## Trust Boundaries
[From Step 5]

## Automated Tool Findings
- Slither: X high, Y medium, Z low (after triage)
- Aderyn: X findings

## Initial Leads for Depth Analysis
1. [Finding/area that needs deeper review]
2. [Suspicious pattern identified]
3. [Complex logic requiring manual review]