fix(multicall): resolve critical multicall parsing corruption issues

- Added comprehensive bounds checking to prevent buffer overruns in multicall parsing
- Implemented graduated validation system (Strict/Moderate/Permissive) to reduce false positives
- Added LRU caching system for address validation with 10-minute TTL
- Enhanced ABI decoder with missing Universal Router and Arbitrum-specific DEX signatures
- Fixed duplicate function declarations and import conflicts across multiple files
- Added error recovery mechanisms with multiple fallback strategies
- Updated tests to handle new validation behavior for suspicious addresses
- Fixed parser test expectations for improved validation system
- Applied gofmt formatting fixes to ensure code style compliance
- Fixed mutex copying issues in monitoring package by introducing MetricsSnapshot
- Resolved critical security vulnerabilities in heuristic address extraction
- Progress: Updated TODO audit from 10% to 35% complete

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

docs/8_reports/subsystem_audit_checklist.md

@@ -0,0 +1,28 @@
+# Subsystem Audit Checklist
+
+Use this checklist to track the end-to-end review for every major subsystem. Mark each row as `[ ]` (todo), `[~]` (in-progress), or `[x]` (completed). Update the "Lead" column with initials/date as work progresses.
+
+| Subsystem | Status | Lead | Notes |
+|-----------|--------|------|-------|
+| Arbitrage Executor (`pkg/arbitrage/executor.go`) | [~] | | Flash swap now routed through contract binding with real gas estimation; remaining work: profit reconciliation from logs, config-driven fee caps, removal of legacy simulation paths. |
+| FlashSwap Executor (`pkg/arbitrage/flash_executor.go`) | [~] | | `submitTransaction`, `waitForConfirmation`, `calculateActualProfit`, and `encodeArbitrageData` use placeholder data (mock receipts, string-formatted calldata, assumed reserves). Replace with real contract bindings, log parsing, and ABI encoding. |
+| Arbitrage Service (`pkg/arbitrage/service.go`, `pkg/arbitrage/multihop.go`) | [~] | | Service still contains fallback poller and verbose placeholder logging (`fallbackBlockPolling`, `createArbitrumMonitor`) plus simplified slippage/min-output maths; needs production-grade sequencer integration and risk tuning. |
+| Detection Engine (`pkg/arbitrage/detection_engine.go`) | [~] | | Execution handler now wired to `ArbitrageService`, but scoring heuristics remain simplified—see `docs/8_reports/enhancements/detection_engine_plan.md`. |
+| Detection Engine Hardening Plan | [~] | | See `docs/8_reports/enhancements/detection_engine_plan.md` for detailed tasks. |
+| Simulation/Replay Tools (`tools/simulation`, `pkg/arbitrage` simulation helpers) | [~] | | Current vectors (`vectors/default.json`) are synthetic and the CLI assumes static fees/reserves; need historical captures, integration with real opportunities, and CI validation. |
+| Simulation Tooling Plan | [~] | | See `docs/8_reports/enhancements/simulation_tools_plan.md` for detailed tasks. |
+| Math & Pricing Core (`pkg/math`, `pkg/uniswap`, `pkg/pools`) | [~] | | Numerous "simplified" implementations (e.g., `pkg/math/dex_math.go`, `exchange_pricing.go`, `arbitrage_calculator.go`) still use placeholder formulas; see `docs/8_reports/enhancements/math_core_plan.md`. |
+| Risk Management (`pkg/risk`, `pkg/risk/manager.go`) | [~] | | Manager still relies on hard-coded limits; see `docs/8_reports/enhancements/risk_management_plan.md` for tasks. |
+| Market Data & Scanner (`pkg/market`, `pkg/scanner`, `pkg/monitor`) | [~] | | Validate concurrency controls, RPC fallback, and message buffering; see `docs/8_reports/enhancements/market_scanner_plan.md`. |
+| Arbitrum Integration (`pkg/arbitrum`, `pkg/monitor`) | [~] | | Check ABI decoding, sequencer monitoring, and failover logic; see `docs/8_reports/enhancements/arbitrum_integration_plan.md`. |
+| Database Layer (`pkg/database`, migrations) | [~] | | Inspect connection pooling, schema migrations, and transactional integrity; see `docs/8_reports/enhancements/database_plan.md`. |
+| Execution Queue & Orchestrator (`pkg/execution`, `pkg/orchestrator`) | [~] | | Ensure worker pools, retry strategies, and back-pressure mechanisms are production-ready; see `docs/8_reports/enhancements/execution_orchestrator_plan.md`. |
+| Metrics & Telemetry (`pkg/metrics`, monitoring configs) | [~] | | Confirm Prometheus/Grafana coverage for latency, error rate, hit rate, and profitability alerts; see `docs/8_reports/enhancements/metrics_plan.md`. Profit factor metric now exported and alert rules captured in `monitoring/alerts.yml`; Grafana updates still pending. |
+| Deployment & Scripts (`scripts/*.sh`, compose files) | [~] | | Replace placeholder secrets, document rollback/runbooks, verify environment parity; see `docs/8_reports/enhancements/deployment_scripts_plan.md`. |
+| CI/CD Pipelines (`.github/workflows`, scripts) | [~] | | Validate environment-specific pipelines meet security, lint, test, and simulation requirements; see `docs/8_reports/enhancements/cicd_plan.md`. |
+| Documentation & Runbooks (`docs/`, `docs/6_operations`, `docs/8_reports`) | [~] | | Ensure guides match current tooling, cover audit requirements, and include recovery steps; see `docs/8_reports/enhancements/documentation_plan.md`. |
+
+Append additional rows as new subsystems emerge. When a subsystem is complete, link to the validating PR/issue in the Notes column.
+
+| Subsystem | Status | Lead | Notes |
+| FlashSwap Executor Hardening Plan | [~] | | See `docs/8_reports/enhancements/arbitrage_executor_plan.md` for detailed task list. |