Report

Audit Report Generation

Purpose

Generate professional security audit reports following industry standards from platforms like Code4rena, Cantina, Sherlock, and Immunefi.

Supported Platforms

Data Flow (Option B - Immutable Drafts)

.vigilo/findings/    ← Sub-auditor drafts (IMMUTABLE)
         +
.vigilo/poc/         ← PoC validation logs
         ↓
.vigilo/reports/submissions/  ← Final submission-ready reports

Key Principle: Original findings are preserved as audit trail. Final reports are synthesized from findings + PoC validation.

Workflow

Step 1: Collect Data Sources

# Sub-auditor draft findings
Glob(".vigilo/findings/**/*.md")

# PoC validation results
Glob(".vigilo/poc/*.md")

# Actual PoC code
Glob("test/poc/*.t.sol")

Step 2: Filter by Validation Status

Step 3: Select Platform

1. Check user-specified platform
2. Default: Code4rena format (most common)

Step 4: Generate Submission Reports

For each VALIDATED finding, create submission-ready report:

Filename format: {Severity}-{id}-{kebab-case-title}.md

.vigilo/reports/submissions/H-01-donation-attack-inflated-collateral.md

Each submission report MUST include:

1. Refined Attack Scenario - Updated based on PoC validation
2. Validated PoC Code - INLINE (not just reference)
3. Proof of Impact - Console output showing actual exploit
4. Platform-specific formatting

Step 5: Write Outputs

.vigilo/reports/
├── {date}_{platform}_audit.md      # Executive summary
└── submissions/
    ├── H-01-donation-attack-inflated-collateral.md   # Ready to submit
    ├── H-02-reentrancy-callback-drain.md
    ├── M-01-stale-price-check.md
    └── QA-report.md

Submission Report Template

Each submissions/{finding-id}.md must be immediately submittable:

# [H-01] Title Describing Vulnerability

## Summary
One-sentence description of the issue.

## Vulnerability Detail
Technical explanation of the vulnerability.
- Root cause
- Affected functions
- Attack vector

## Impact
Qualitative impact description (NO dollar amounts).

## Proof of Concept

\`\`\`solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "forge-std/Test.sol";

contract PoC_H01 is Test {
    function test_Exploit() public {
        // Full PoC code here - INLINE
        // Not just a file reference
    }
}
\`\`\`

**Execution:**
\`\`\`bash
forge test --match-test test_Exploit -vvv
\`\`\`

**Output:**
\`\`\`
[PASS] test_Exploit()
  Attacker balance before: 1 ETH
  Attacker balance after: 101 ETH
  Profit: 100 ETH
\`\`\`

## Recommendation
Specific fix with code example.

Severity Classification

All platforms use similar severity levels with slight variations:

See references/severity-classification.md for detailed criteria.

Output Structure

Report File Naming

.vigilo/reports/{YYYY_MM_DD_HHMM}_{platform}_audit.md

Examples:

• 2026_01_20_1430_code4rena_audit.md
• 2026_01_20_1430_standard_audit.md

Individual Finding Export

For contest submissions, also export individual findings:

Filename format: {Severity}-{id}-{kebab-case-title}.md

.vigilo/reports/submissions/
├── H-01-donation-attack-inflated-collateral.md
├── H-02-reentrancy-callback-drain.md
├── M-01-stale-price-check.md
└── QA-report.md

Submission Quality Checklist

Before marking a report as ready to submit:

Content Requirements

• Attack scenario refined based on PoC validation
• PoC code is INLINE (not just file reference)
• PoC output proves the claimed impact
• Impact is qualitative (NO dollar amounts)
• Recommendation includes specific code fix

Platform Compliance

• Follows exact platform template structure
• Severity mapped to platform standard
• Title format matches platform convention
• All required sections present

Submission Readiness

• Can be copy-pasted directly to platform
• No placeholder text remaining
• No internal notes or TODOs
• forge test command and output included

If any checkbox fails → NOT ready for submission

Additional Resources

Templates (Load based on target platform)

References (Load on demand)

External References (For validation)

• Code4rena Reports - Reference for report format
• Solodit Database - Cross-reference similar findings