DicksonWu654/web3-audit-findings

Web3 Audit Corpus

A linked audit corpus with a metadata knowledge graph. Every released finding occurrence has a plain-text Markdown file, including metadata-only records. Report-level finding extracts are also retained. AI-assisted extraction and annotation may contain errors. Check the linked original before relying on a finding.

Snapshot v1.3.0, 2026-10-22: 180,907 finding occurrences, 13,979 reports, 65 publishers, 13,040 industry audits (13,047 engagement records), 11,262 observed project labels. 165,451 findings have released body text; 15,456 are metadata only. Revisions can repeat findings. These counts do not represent unique bugs.

Browse

Start with the hub map, then choose a firm, project label, class, language or chain. Hubs link to complete paginated report and finding tables. The DEX token-handling and oracle/lending pages give search recipes that require source review.

The metadata graph exports released relationships and their provenance. Project labels are observed strings, not resolved protocol identities. There is no authoritative DEX/lending category field. No semantic search or measured improvement in agent accuracy is claimed. GitHub code search requires login and may omit generated data or limit results. Browsing and local searches are separate paths.

Clone and search

Search it in your browser at web3-audits.dicksonwu.xyz. Code, methods and bulk downloads (Parquet, CSV, JSONL, Markdown ZIP) live in DicksonWu654/web3-audit-corpus. This repo is tagged corpus-v1.3.0.

git clone --depth 1 --branch corpus-v1.3.0 \
  https://github.com/DicksonWu654/web3-audit-findings.git
cd web3-audit-findings

For a metadata-first partial clone:

git clone --depth 1 --filter=blob:none --sparse --branch corpus-v1.3.0 \
  https://github.com/DicksonWu654/web3-audit-findings.git
cd web3-audit-findings
git sparse-checkout set --cone hubs index docs scripts schema
git sparse-checkout add findings/openzeppelin reports/openzeppelin

--depth 1 limits history. --filter=blob:none delays file contents. Sparse checkout limits populated paths; a full checkout still fetches its blobs. Adding paths needs network until hydrated. rg only sees checked-out files. A complete offline review needs the complete snapshot. Check SOURCE.json and CHECKSUMS.sha256 before claiming absence or completeness.

Open the folder in your agent and start with AGENTS.md, the agent guide and query recipes. List candidate paths, narrow the scope, then read selected findings:

rg -l -i 'fee.on.transfer|rebasing|safeerc20|transferFrom' findings/openzeppelin/
rg --files findings/openzeppelin | rg -i 'token|oracle|swap'
nice -n 19 python3 -I scripts/query.py --firm openzeppelin --limit 10

Cite finding_uid, report_id, original_url and source release. Keep reported fixes separate from proposed tests.

Bulk query

The unchanged v1.3.0 release provides Parquet, JSONL, CSV and the Markdown ZIP. Use index CSV for local exact filters, graph CSV for relationship joins, or DuckDB over the original Parquet. Do not count report text as another independent finding population.

duckdb -c "SET threads=1; SELECT severity, count(*) FROM 'findings.parquet' GROUP BY severity ORDER BY severity;"

The optional SQLite asset is built separately outside this tree after the core passes. See the SQLite query contract and the local read-only query tool. It uses no service, API key or automatic downloads.

Rights and reproducibility

Derived metadata uses CC BY 4.0. Publisher text retains its own rights. Withheld and missing bodies stay metadata plus source links; do not reconstruct them. Oak Security attribution and CC BY-ND terms remain attached to verbatim excerpts. Preserve all rights, redaction and truncation fields. See rights and requests and the data dictionary.

The build guide describes the deterministic local generator, checksums, validation, size measurement and publication checks. No PDFs, bulk archives, dependencies or database binaries belong in this repo. Source evidence, methods and bulk release history remain in web3-audit-corpus.