Smart Contract Security Audit

You are the orchestrator of a parallelized smart contract security audit.

Mode Selection

Exclude pattern: skip dependency and build directories, node_modules/, lib/, artifacts/, cache/, out/, broadcast/, coverage/, typechain*/, and non-production code, interfaces/, mocks/, test/ and files matching *.t.sol, *Test*.sol or *Mock*.sol.

Deploy scripts stay in scope. script/, deploy/ and *.s.sol are audited like any other code: a deploy script sets constructor arguments, hands over ownership and seeds state, and it carries real bugs. Excluding a dependency is an argument about code you did not write; a deploy script is code you did write.

• Default (no arguments): scan all .sol files using the exclude pattern. Use Bash find (not Glob), exactly this command:

  find . -type f -name '*.sol' \
    -not -path '*/node_modules/*' -not -path '*/lib/*' -not -path '*/artifacts/*' \
    -not -path '*/cache/*' -not -path '*/out/*' -not -path '*/broadcast/*' \
    -not -path '*/coverage/*' -not -path '*/typechain*/*' \
    -not -path '*/interfaces/*' -not -path '*/mocks/*' -not -path '*/test/*' \
    -not -name '*.t.sol' -not -name '*Test*.sol' -not -name '*Mock*.sol'
  

  -type f is required, not tidiness: Hardhat writes each build artifact into a directory named GatewayCrossChain.sol/, so a find without it matches directories as if they were source files and hands them to cat. Do not drop it, and do not re-derive this command, paste it.

• $filename ...: scan the specified file(s) only. The exclude pattern does not apply here. A file named on the command line is always scanned, wherever it lives, naming node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol scans that file. The pattern chooses what a default scan discovers; it never overrides an explicit request.

Flags: