Skip to content

v7.0.0 — Full audit lifecycle, executable PoCs + patches, Rust pre-scanner + memory

Choose a tag to compare

@kauenet kauenet released this 11 Jul 03:16
· 472 commits to main since this release
34b3c97

auditor-skill graduates from a prose+grep audit corpus into a full audit-firm platform.

Highlights

A full audit-firm lifecycle, two ways

  • /auditor:audit-cycle — fully automated engagement (intake → context → threat model → tool-assisted pass → domain-partitioned review → triage → independent peer review → synthesis) → professional client report.
  • /auditor:audit-assist — the same pipeline, interactive, pausing at checkpoints for the calls only you can make.

Executable proofs, not just prose

  • /auditor:poc builds a runnable exploit (Mollusk / LiteSVM / Surfpool-fork / fuzz) that asserts the vulnerability; /auditor:patch drafts a minimal fix and proves it reverts the exploit.
  • Evidence tiers [PoC-REPRODUCED] … [PoC-PROSE] and fix tiers [FIX-VERIFIED] … [FIX-PROPOSED]. Prose is never dropped when a harness can't be built.

Token-efficient by construction (tools/auditor-tools/)

  • audit-scan — a Rust pre-scanner that enumerates the risky surface deterministically (~$0), cutting ~30-40% of input tokens on large programs.
  • audit-mem — SQLite cross-audit memory: exact dedup, regression detection, false-positive suppression, warm re-audits.

Deeper corpus — 20 checklists / 1,346 items / 131 vectors

  • Protocol methodologies 7 → 12: bridges, wallets/multisig/custody, Token-2022, NFT marketplaces, launchpads.
  • FV escalation ladder + reusable invariant catalog; design-vs-implementation pass; Notes & Nitpicks tier; Impact×Likelihood downgrade levers.

New commands & agents

  • Commands: /intake, /threat-model, /triage, /poc, /patch (15 total).
  • Agents: threat-modeler, poc-engineer, patch-engineer (8 total).

Docs

Getting started

git submodule update --init --recursive      # Trail of Bits execution tooling
cd tools/auditor-tools && cargo build --release   # optional: pre-scanner + memory

The native corpus works fully without the submodule or the Rust tools — they are optional accelerators.

Full diff: 5d0e838...v7.0.0