{
 "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
 "version": "2.1.0",
 "runs": [
  {
   "tool": {
    "driver": {
     "name": "Kestrova",
     "fullName": "Kestrova (Slither)",
     "informationUri": "https://kestrova.onrender.com",
     "rules": [
      {
       "id": "arbitrary-send-eth",
       "name": "arbitrary-send-eth",
       "shortDescription": {
        "text": "ETH can be sent to an arbitrary address"
       },
       "fullDescription": {
        "text": "A function sends the contract's ETH to an address chosen by the caller. If access control is missing or weak, anyone may be able to drain funds."
       },
       "help": {
        "text": "Restrict who can call the function (for example onlyOwner or a role check using msg.sender), and send only to trusted or pre-approved addresses."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "error",
        "security-severity": "8.0"
       }
      },
      {
       "id": "reentrancy-eth",
       "name": "reentrancy-eth",
       "shortDescription": {
        "text": "Possible reentrancy (ETH can be withdrawn repeatedly)"
       },
       "fullDescription": {
        "text": "A function sends ETH or calls another contract before it finishes updating its own balances. A malicious contract can call back in during that call and repeat the withdrawal."
       },
       "help": {
        "text": "Update state before making external calls (checks-effects-interactions), and consider a reentrancy guard such as OpenZeppelin ReentrancyGuard."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "error",
        "security-severity": "8.0"
       }
      },
      {
       "id": "tx-origin",
       "name": "tx-origin",
       "shortDescription": {
        "text": "tx.origin used for authorisation"
       },
       "fullDescription": {
        "text": "Checking tx.origin lets a malicious contract act on behalf of a user who calls it, for example by tricking the owner into a transaction."
       },
       "help": {
        "text": "Use msg.sender for access control."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "warning",
        "security-severity": "5.0"
       }
      },
      {
       "id": "unchecked-send",
       "name": "unchecked-send",
       "shortDescription": {
        "text": "Return value of send() is not checked"
       },
       "fullDescription": {
        "text": "send() returns false on failure instead of reverting. If the result is ignored, the contract may continue as if the payment succeeded."
       },
       "help": {
        "text": "Check the returned bool, or use call{value: ...}(\"\") and require success."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "warning",
        "security-severity": "5.0"
       }
      },
      {
       "id": "missing-zero-check",
       "name": "missing-zero-check",
       "shortDescription": {
        "text": "Address not checked for zero"
       },
       "fullDescription": {
        "text": "An address parameter is used without checking it is not address(0)."
       },
       "help": {
        "text": "Add require(addr != address(0)) where a zero address would be a mistake."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "note",
        "security-severity": "3.0"
       }
      },
      {
       "id": "low-level-calls",
       "name": "low-level-calls",
       "shortDescription": {
        "text": "Low-level call used"
       },
       "fullDescription": {
        "text": "A low-level call bypasses some compiler checks; this is informational."
       },
       "help": {
        "text": "Make sure the result is checked and the call is necessary."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "note",
        "security-severity": "1.0"
       }
      },
      {
       "id": "solc-version",
       "name": "solc-version",
       "shortDescription": {
        "text": "Compiler version note"
       },
       "fullDescription": {
        "text": "The pragma allows compiler versions with known issues, or is very broad."
       },
       "help": {
        "text": "Pin a recent, well-tested compiler version."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "note",
        "security-severity": "1.0"
       }
      },
      {
       "id": "immutable-states",
       "name": "immutable-states",
       "shortDescription": {
        "text": "Variable could be immutable"
       },
       "fullDescription": {
        "text": "A state variable is only set in the constructor and could be declared immutable to save gas."
       },
       "help": {
        "text": "Declare it immutable."
       },
       "helpUri": "https://github.com/crytic/slither/wiki/Detector-Documentation",
       "properties": {
        "tags": [
         "security",
         "solidity",
         "slither"
        ],
        "problem.severity": "note",
        "security-severity": "0.5"
       }
      }
     ]
    }
   },
   "results": [
    {
     "ruleId": "arbitrary-send-eth",
     "ruleIndex": 0,
     "level": "error",
     "message": {
      "text": "Vault.sweep(address) (Vault.sol#20-23) sends eth to arbitrary user\n\tDangerous calls:\n\t- to.send(address(this).balance) (Vault.sol#22)"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 20,
         "endLine": 23
        }
       }
      },
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 22,
         "endLine": 22
        }
       }
      }
     ],
     "properties": {
      "impact": "High",
      "confidence": "Medium"
     }
    },
    {
     "ruleId": "reentrancy-eth",
     "ruleIndex": 1,
     "level": "error",
     "message": {
      "text": "Reentrancy in Vault.withdraw() (Vault.sol#13-18):\n\tExternal calls:\n\t- (ok,None) = msg.sender.call{value: amt}() (Vault.sol#15)\n\tState variables written after the call(s):\n\t- balances[msg.sender] = 0 (Vault.sol#17)\n\tVault.balances (Vault.sol#6) can be used in cross function reentrancies:\n\t- Vault.balances (Vault.sol#6)\n\t- Vault.deposit() (Vault.sol#11)\n\t- Vault.withdraw() (Vault.sol#13-18)"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 13,
         "endLine": 18
        }
       }
      },
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 15,
         "endLine": 15
        }
       }
      },
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 17,
         "endLine": 17
        }
       }
      }
     ],
     "properties": {
      "impact": "High",
      "confidence": "Medium"
     }
    },
    {
     "ruleId": "tx-origin",
     "ruleIndex": 2,
     "level": "warning",
     "message": {
      "text": "Vault.sweep(address) (Vault.sol#20-23) uses tx.origin for authorization: require(bool,string)(tx.origin == owner,not owner) (Vault.sol#21)"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 20,
         "endLine": 23
        }
       }
      },
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 21,
         "endLine": 21
        }
       }
      }
     ],
     "properties": {
      "impact": "Medium",
      "confidence": "Medium"
     }
    },
    {
     "ruleId": "unchecked-send",
     "ruleIndex": 3,
     "level": "warning",
     "message": {
      "text": "Vault.sweep(address) (Vault.sol#20-23) ignores return value by to.send(address(this).balance) (Vault.sol#22)"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 20,
         "endLine": 23
        }
       }
      },
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 22,
         "endLine": 22
        }
       }
      }
     ],
     "properties": {
      "impact": "Medium",
      "confidence": "Medium"
     }
    },
    {
     "ruleId": "missing-zero-check",
     "ruleIndex": 4,
     "level": "note",
     "message": {
      "text": "Vault.sweep(address).to (Vault.sol#20) lacks a zero-check on :\n\t\t- to.send(address(this).balance) (Vault.sol#22)"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 20,
         "endLine": 20
        }
       }
      },
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 22,
         "endLine": 22
        }
       }
      }
     ],
     "properties": {
      "impact": "Low",
      "confidence": "Medium"
     }
    },
    {
     "ruleId": "low-level-calls",
     "ruleIndex": 5,
     "level": "note",
     "message": {
      "text": "Low level call in Vault.withdraw() (Vault.sol#13-18):\n\t- (ok,None) = msg.sender.call{value: amt}() (Vault.sol#15)"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 13,
         "endLine": 18
        }
       }
      },
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 15,
         "endLine": 15
        }
       }
      }
     ],
     "properties": {
      "impact": "Informational",
      "confidence": "High"
     }
    },
    {
     "ruleId": "solc-version",
     "ruleIndex": 6,
     "level": "note",
     "message": {
      "text": "Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)\n\t- VerbatimInvalidDeduplication\n\t- FullInlinerNonExpressionSplitArgumentEvaluationOrder\n\t- MissingSideEffectsOnSelectorAccess.\nIt is used by:\n\t- ^0.8.20 (Vault.sol#3)"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 3,
         "endLine": 3
        }
       }
      }
     ],
     "properties": {
      "impact": "Informational",
      "confidence": "High"
     }
    },
    {
     "ruleId": "immutable-states",
     "ruleIndex": 7,
     "level": "note",
     "message": {
      "text": "Vault.owner (Vault.sol#7) should be immutable"
     },
     "locations": [
      {
       "physicalLocation": {
        "artifactLocation": {
         "uri": "Vault.sol"
        },
        "region": {
         "startLine": 7,
         "endLine": 7
        }
       }
      }
     ],
     "properties": {
      "impact": "Optimization",
      "confidence": "High"
     }
    }
   ],
   "properties": {
    "report_id": "SAMPLE",
    "generated_utc": "2026-10-27T00:00:00Z",
    "code_sha256": "acb623731b502ec9bc225ac50c2427f00d2a9098110b376b83380ca71b62b68d",
    "disclaimer": "Automated static analysis with Slither. Findings are possible issues, not verified vulnerabilities, and may include false positives. A report with no findings does not mean the code is secure. This report is not a substitute for a professional security audit."
   }
  }
 ]
}