Code Analysis

Code Reconnaissance Methodology

Purpose

Rapidly understand what the code does through structural analysis and flow tracing. This is reconnaissance, not vulnerability hunting.

1. File Discovery

By Language

Skip These

• test/, tests/, *.t.sol, *.test.sol
• mock/, mocks/, *Mock.sol
• node_modules/, lib/ (dependencies)
• Generated/compiled files

2. Contract Structure Analysis

For Each Contract, Extract:

Contract: {Name}
File: {path}
Purpose: {one line description}
Inherits: {parent contracts}
Key State: {important state variables}
Entry Points: {external/public functions}

Inheritance Mapping

BaseContract
├── ChildA
│   └── GrandchildA1
└── ChildB

External Dependencies

3. Flow Tracing

The Core Question

"How does value enter, move through, and exit this protocol?"

Entry Flows (How users put value in)

Internal Flows (How value transforms)

Exit Flows (How users get value out)

Privileged Flows (Admin operations)

4. Protocol Type Classification

Identify by Code Patterns

5. Asset Storage Patterns

ETH Storage

// Direct balance
address(this).balance

// Wrapped
WETH.balanceOf(address(this))

Token Storage

// External balance check
IERC20(token).balanceOf(address(this))

// Internal accounting
mapping(address => uint256) balances;
uint256 totalDeposited;

Share/Receipt Tokens

// Protocol issues these
mapping(address => uint256) shares;
uint256 totalSupply;
function balanceOf(address) external view returns (uint256);

6. Notable Patterns to Mark

Mark location only. No analysis needed - Phase 2 handles that.

7. Search Queries

Find Entry Points

Grep("function.*external|function.*public", glob="**/*.sol")

Find Asset Movements

Grep("transfer\\(|transferFrom\\(|safeTransfer", glob="**/*.sol")

Find Privileged Functions

Grep("onlyOwner|onlyAdmin|onlyRole|require.*msg\\.sender", glob="**/*.sol")

Find External Calls

Grep("\\.call\\{|\\.delegatecall\\(|address\\(.*\\)\\..*\\(", glob="**/*.sol")

Output

Write findings to .vigilo/recon/code-findings.md following the format in template.md.

Additional Resources

• template.md - Output template for code reconnaissance findings
• examples/minimal-output.md - Minimal output example for small projects