audit-report

Prompt file imported from onahprosper/auditor-agent-prompts (.github/prompts/audit-report.prompt.md). Fill in {{file}}, {{selection}}, {{workspaceFolder}}, {{issueDescription}}, {{affectedFunction}} before use. Copyright stays with the author.

Security Audit Report Generator

Generate a comprehensive security audit report following Code4rena standards and industry best practices.

Report Structure

Create a detailed audit report with the following sections:

1. Vulnerability Details

• Clear explanation of the vulnerability mechanism
• Root cause analysis with code references
• Technical explanation of why the issue exists
• Include relevant code snippets with inline comments highlighting issues
• Reference authoritative sources (EIPs, security research, industry standards)

2. Impact Assessment

• Detailed description of user impact
• Financial implications (gas costs, fund losses, DOS)
• Attack prerequisites and complexity
• Affected components/tokens/users
• Categorize working vs non-working scenarios

3. Proof of Concept

• Step-by-step attack walkthrough or failure scenario
• Complete Foundry test demonstrating the issue
• Include both setup and exploitation phases
• Show expected vs actual behavior
• Provide concrete examples with realistic values

4. Code Location

• Primary vulnerable function(s) with file paths and line numbers
• Related code locations (imports, interfaces, helpers)
• Documentation issues (if applicable)
• Include direct links to repository files when available

5. Recommended Mitigation

Provide multiple mitigation options when applicable:

Option 1: [Minimal/Documentation Fix]

• Clear documentation of limitations
• Code comments highlighting constraints
• User-facing guidance updates

Option 2: [Comprehensive Fix]

• Complete code implementation with error handling
• Support for edge cases
• Backward compatibility considerations

Option 3: [Alternative Approach] (if applicable)

• Different architectural solution
• Trade-offs and benefits

For each option:

• Provide complete code examples
• Include new error types/events needed
• Explain implementation considerations
• Reference industry-standard patterns

6. References

• Official standards (EIPs, RFCs)
• Security research and disclosures
• Similar vulnerabilities in other protocols
• OpenZeppelin or other library documentation
• Protocol documentation (especially contradictory claims)

Severity Classification

Use these guidelines for severity:

• [H-01] High: Direct loss of funds, critical DOS, protocol breakdown
• [M-01] Medium: Indirect loss, significant functionality impairment, user confusion
• [L-01] Low: Minor issues, informational findings

Code Examples Format

// Use inline comments to highlight issues
function vulnerableFunction() external {
    // @audit VULNERABLE: Unconditional call without error handling
    riskyOperation();
    
    // @audit User loses functionality when this fails
    criticalOperation();
}

Documentation References

When protocol documentation contradicts the implementation or standards:

• Include direct quotes with proper attribution
• Link to specific sections (use GitHub line anchors)
• Compare documentation claims vs actual behavior
• Highlight misleading information

Variables Available

• {{file}} - Current file being analyzed
• {{selection}} - Selected code snippet
• {{workspaceFolder}} - Workspace root directory
• {{issueDescription}} - Brief description of the vulnerability
• {{affectedFunction}} - Function name where issue exists

Analysis Approach

1. Understand the vulnerability: Research the issue mechanism thoroughly
2. Locate affected code: Find all instances and related components
3. Assess impact: Consider all user scenarios and edge cases
4. Develop PoC: Create reproducible test demonstrating the issue
5. Design mitigations: Provide multiple practical solutions with code
6. Gather references: Cite authoritative sources and similar issues

Example Usage

In the chat input:

/audit-report issueDescription="DAI token incompatibility with EIP-2612 permit" affectedFunction="depositToIntentWithPermit"

Or with file context:

/audit-report {{selection}}

Quality Checklist

Ensure the report includes:

• ✅ Clear technical explanation accessible to developers
• ✅ Complete Foundry test that can be run
• ✅ Multiple mitigation options with full code
• ✅ Authoritative references (EIPs, security research)
• ✅ Specific line numbers and file paths
• ✅ Direct quotes from contradictory documentation
• ✅ Real-world examples and scenarios
• ✅ Professional tone matching Code4rena standards

Notes

• Match the depth and detail level of successful Code4rena audit reports
• Reference actual security incidents and industry standards
• Provide actionable mitigation code, not just suggestions
• Include test code that can be directly added to the test suite
• Cite protocol documentation when it misleads developers
• Focus on practical impact and realistic attack scenarios