refactor: move all remaining files to orig/ directory

Completed clean root directory structure:
- Root now contains only: .git, .env, docs/, orig/
- Moved all remaining files and directories to orig/:
  - Config files (.claude, .dockerignore, .drone.yml, etc.)
  - All .env variants (except active .env)
  - Git config (.gitconfig, .github, .gitignore, etc.)
  - Tool configs (.golangci.yml, .revive.toml, etc.)
  - Documentation (*.md files, @prompts)
  - Build files (Dockerfiles, Makefile, go.mod, go.sum)
  - Docker compose files
  - All source directories (scripts, tests, tools, etc.)
  - Runtime directories (logs, monitoring, reports)
  - Dependency files (node_modules, lib, cache)
  - Special files (--delete)

- Removed empty runtime directories (bin/, data/)

V2 structure is now clean:
- docs/planning/ - V2 planning documents
- orig/ - Complete V1 codebase preserved
- .env - Active environment config (not in git)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Administrator
2025-11-10 10:53:05 +01:00
parent 803de231ba
commit c54c569f30
718 changed files with 8304 additions and 8281 deletions

View File

@@ -0,0 +1,128 @@
# MEV Bot Math Audit Report
**Generated:** 2025-10-19T23:18:22-05:00
**Test Vectors:** default
**Error Tolerance:** 1.0 basis points
## Executive Summary
**Overall Status:** ✅ PASS
### Summary Statistics
| Metric | Value |
|--------|-------|
| Total Tests | 10 |
| Passed Tests | 10 |
| Failed Tests | 0 |
| Success Rate | 100.00% |
| Exchanges Tested | 4 |
## Exchange Results
### UNISWAP_V2
**Status:** ✅ PASS
**Duration:** 0s
#### Test Statistics
| Metric | Value |
|--------|-------|
| Total Tests | 4 |
| Passed | 4 |
| Failed | 0 |
| Max Error | 0.0000 bp |
| Avg Error | 0.0000 bp |
#### Test Breakdown
| Category | Tests |
|----------|-------|
| Pricing Functions | 0 |
| Amount Calculations | 1 |
| Price Impact | 1 |
### UNISWAP_V3
**Status:** ✅ PASS
**Duration:** 0s
#### Test Statistics
| Metric | Value |
|--------|-------|
| Total Tests | 2 |
| Passed | 2 |
| Failed | 0 |
| Max Error | 0.0000 bp |
| Avg Error | 0.0000 bp |
#### Test Breakdown
| Category | Tests |
|----------|-------|
| Pricing Functions | 0 |
| Amount Calculations | 1 |
| Price Impact | 0 |
### CURVE
**Status:** ✅ PASS
**Duration:** 0s
#### Test Statistics
| Metric | Value |
|--------|-------|
| Total Tests | 2 |
| Passed | 2 |
| Failed | 0 |
| Max Error | 0.0000 bp |
| Avg Error | 0.0000 bp |
#### Test Breakdown
| Category | Tests |
|----------|-------|
| Pricing Functions | 0 |
| Amount Calculations | 1 |
| Price Impact | 0 |
### BALANCER
**Status:** ✅ PASS
**Duration:** 0s
#### Test Statistics
| Metric | Value |
|--------|-------|
| Total Tests | 2 |
| Passed | 2 |
| Failed | 0 |
| Max Error | 0.0000 bp |
| Avg Error | 0.0000 bp |
#### Test Breakdown
| Category | Tests |
|----------|-------|
| Pricing Functions | 0 |
| Amount Calculations | 1 |
| Price Impact | 0 |
## Recommendations
✅ All mathematical validations passed successfully.
### Next Steps
- Consider running extended test vectors for comprehensive validation
- Implement continuous mathematical validation in CI/CD pipeline
- Monitor for precision degradation with production data
---
*This report was generated by the MEV Bot Math Audit Tool*
*Report generated at: 2025-10-19T23:18:22-05:00*

View File

@@ -0,0 +1,129 @@
{
"timestamp": "2025-10-19T23:18:22.27323505-05:00",
"vectors_file": "default",
"tolerance_bp": 1,
"exchange_results": {
"balancer": {
"exchange_type": "balancer",
"total_tests": 2,
"passed_tests": 2,
"failed_tests": 0,
"max_error_bp": 0,
"avg_error_bp": 0,
"failed_cases": [],
"test_results": [
{
"test_name": "Weighted_80_20_Pool",
"passed": true,
"error_bp": 0,
"duration": 7985,
"description": "Price calculation test for balancer"
},
{
"test_name": "Weighted_Pool_Swap",
"passed": true,
"error_bp": 0,
"duration": 31,
"description": "Amount calculation test for balancer"
}
],
"duration": 8931
},
"curve": {
"exchange_type": "curve",
"total_tests": 2,
"passed_tests": 2,
"failed_tests": 0,
"max_error_bp": 0,
"avg_error_bp": 0,
"failed_cases": [],
"test_results": [
{
"test_name": "Stable_USDC_USDT",
"passed": true,
"error_bp": 0,
"duration": 6725,
"description": "Price calculation test for curve"
},
{
"test_name": "Stable_Swap_Low_Impact",
"passed": true,
"error_bp": 0,
"duration": 21,
"description": "Amount calculation test for curve"
}
],
"duration": 7851
},
"uniswap_v2": {
"exchange_type": "uniswap_v2",
"total_tests": 4,
"passed_tests": 4,
"failed_tests": 0,
"max_error_bp": 0,
"avg_error_bp": 0,
"failed_cases": [],
"test_results": [
{
"test_name": "ETH_USDC_Basic",
"passed": true,
"error_bp": 0,
"duration": 10469,
"description": "Price calculation test for uniswap_v2"
},
{
"test_name": "WBTC_ETH_Basic",
"passed": true,
"error_bp": 0,
"duration": 4963,
"description": "Price calculation test for uniswap_v2"
},
{
"test_name": "ETH_to_USDC_Swap",
"passed": true,
"error_bp": 0,
"duration": 73,
"description": "Amount calculation test for uniswap_v2"
},
{
"test_name": "Large_ETH_Swap_Impact",
"passed": true,
"error_bp": 0,
"duration": 67,
"description": "Price impact test for uniswap_v2"
}
],
"duration": 19068
},
"uniswap_v3": {
"exchange_type": "uniswap_v3",
"total_tests": 2,
"passed_tests": 2,
"failed_tests": 0,
"max_error_bp": 6.8468e-13,
"avg_error_bp": 3.4234e-13,
"failed_cases": [],
"test_results": [
{
"test_name": "ETH_USDC_V3_Basic",
"passed": true,
"error_bp": 6.8468e-13,
"duration": 16441,
"description": "Price calculation test for uniswap_v3"
},
{
"test_name": "V3_Concentrated_Liquidity",
"passed": true,
"error_bp": 0,
"duration": 71,
"description": "Amount calculation test for uniswap_v3"
}
],
"duration": 17977
}
},
"overall_passed": true,
"total_tests": 10,
"total_passed": 10,
"total_failed": 0
}

View File

@@ -0,0 +1,70 @@
{
"summary": {
"generated_at": "2025-10-20T04:25:07.908285289Z",
"total_vectors": 1,
"vectors_passed": 1,
"total_assertions": 1,
"assertions_passed": 1,
"property_checks": 4,
"property_succeeded": 4
},
"vectors": [
{
"name": "uniswap_v2_usdc_weth",
"description": "Uniswap V2 style pool with 10k WETH against 20M USDC",
"exchange": "uniswap_v2",
"passed": true,
"tests": [
{
"name": "amount_out_5_weth",
"type": "amount_out",
"passed": true,
"delta_bps": 0,
"expected": "9871580343970612988504",
"actual": "9871580343970612988504",
"annotations": [
"tolerance 1.0000 bps"
]
}
]
}
],
"property_checks": [
{
"name": "price_conversion_round_trip",
"type": "property",
"passed": true,
"delta_bps": 0,
"expected": "",
"actual": "",
"details": "all samples within 0.1% tolerance"
},
{
"name": "tick_conversion_round_trip",
"type": "property",
"passed": true,
"delta_bps": 0,
"expected": "",
"actual": "",
"details": "ticks round-trip within ±1"
},
{
"name": "price_monotonicity",
"type": "property",
"passed": true,
"delta_bps": 0,
"expected": "",
"actual": "",
"details": "higher ticks produced higher prices"
},
{
"name": "price_symmetry",
"type": "property",
"passed": true,
"delta_bps": 0,
"expected": "",
"actual": "",
"details": "price * inverse remained within 0.1%"
}
]
}

View File

@@ -0,0 +1,20 @@
# Math Audit Report
- Generated: 2025-10-20 04:25:07 UTC
- Vectors: 1/1 passed
- Assertions: 1/1 passed
- Property checks: 4/4 passed
## Vector Results
| Vector | Exchange | Status | Notes |
| --- | --- | --- | --- |
| uniswap_v2_usdc_weth | uniswap_v2 | ✅ PASS | |
## Property Checks
- ✅ price_conversion_round_trip — all samples within 0.1% tolerance
- ✅ tick_conversion_round_trip — ticks round-trip within ±1
- ✅ price_monotonicity — higher ticks produced higher prices
- ✅ price_symmetry — price * inverse remained within 0.1%

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3Router",
"from": "0x8cc6ab9ac1d1b7c5f6fc33f767aded9a305744e3",
"function": "exactOutputSingle",
"function_sig": "0xdb3e2198",
"hash": "0x69bad4eca82a4e139aad810777dc72faf5414e338b0a1b648e8472cd4904f93e",
"input_data": "0xdb3e2198000000000000000000000000ff970a61a04b1ca14834a43f5de4533ebddb5cc8000000000000000000000000912ce59144191c1204e64559fe8253a0e49e654800000000000000000000000000000000000000000000000000000000000001f40000000000000000000000008cc6ab9ac1d1b7c5f6fc33f767aded9a305744e30000000000000000000000000000000000000000000000000000000068ed0bbd00000000000000000000000000000000000000000000001b1ae4d6e2ef500000000000000000000000000000000000000000000000000000000000000a482cf40000000000000000000000000000000000000000000000000000000000000000",
"protocol": "UniswapV3",
"to": "0xe592427a0aece92de3edee1f18e0157c05861564",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3Router",
"from": "0x8cc6ab9ac1d1b7c5f6fc33f767aded9a305744e3",
"function": "exactOutputSingle",
"function_sig": "0xdb3e2198",
"hash": "0x69aaa929dace9feee6e1579f4b0fae055868fd56bb7fbd653a02ebd787e348f3",
"input_data": "0xdb3e2198000000000000000000000000ff970a61a04b1ca14834a43f5de4533ebddb5cc8000000000000000000000000912ce59144191c1204e64559fe8253a0e49e654800000000000000000000000000000000000000000000000000000000000001f40000000000000000000000008cc6ab9ac1d1b7c5f6fc33f767aded9a305744e30000000000000000000000000000000000000000000000000000000068ed0bc000000000000000000000000000000000000000000000001b1ae4d6e2ef500000000000000000000000000000000000000000000000000000000000000a48f10c0000000000000000000000000000000000000000000000000000000000000000",
"protocol": "UniswapV3",
"to": "0xe592427a0aece92de3edee1f18e0157c05861564",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3Router",
"from": "0x8cc6ab9ac1d1b7c5f6fc33f767aded9a305744e3",
"function": "exactOutputSingle",
"function_sig": "0xdb3e2198",
"hash": "0xf6431652d3e4e9de83d259de062488064ead35e5f112d13ae110b24b8782e242",
"input_data": "0xdb3e2198000000000000000000000000ff970a61a04b1ca14834a43f5de4533ebddb5cc8000000000000000000000000912ce59144191c1204e64559fe8253a0e49e654800000000000000000000000000000000000000000000000000000000000001f40000000000000000000000008cc6ab9ac1d1b7c5f6fc33f767aded9a305744e30000000000000000000000000000000000000000000000000000000068ed0bc300000000000000000000000000000000000000000000001b1ae4d6e2ef500000000000000000000000000000000000000000000000000000000000000a49b5240000000000000000000000000000000000000000000000000000000000000000",
"protocol": "UniswapV3",
"to": "0xe592427a0aece92de3edee1f18e0157c05861564",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "TraderJoeRouter",
"from": "0x3855808a7f42dbaebacf07291e0ae0a7ed692ecb",
"function": "multicall",
"function_sig": "0xac9650d8",
"hash": "0xaf6228fcef1fa34dafd4e8d6e359b845e052a1a6597c88c1c2c94045c6140f9f",
"input_data": "0xac9650d800000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000000447d39aaf100000000000000000000000031ef83a530fde1b38ee9a18093a333d8bbbc40d50000000000000000000000000000000000000000000000000002d407c9f880c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000344f59c48eb0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000098d7803aea152ff1009f000000000000000000000000000000000000000000000000000000000000000012f0569e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000031a27787e450000000000000000000000000000000000000000000000000002d407c9f880c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000003855808a7f42dbaebacf07291e0ae0a7ed692ecb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000000000000000000000000001000000000000000000000000de967676db7b1ccdba2bd94b01b5b19de4b563e4000000000000000000000000af88d065e77c8cc2239327c5edb3a432268e583100000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"protocol": "Multicall",
"to": "0x87d66368cd08a7ca42252f5ab44b2fb6d1fb8d15",
"value": "796079871787200"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3Router",
"from": "0x8cc6ab9ac1d1b7c5f6fc33f767aded9a305744e3",
"function": "exactOutputSingle",
"function_sig": "0xdb3e2198",
"hash": "0x725db13de678e9da4590bf4fe40051f397ff4c8625ef5f1e343a39905151fa7b",
"input_data": "0xdb3e2198000000000000000000000000ff970a61a04b1ca14834a43f5de4533ebddb5cc8000000000000000000000000912ce59144191c1204e64559fe8253a0e49e654800000000000000000000000000000000000000000000000000000000000001f40000000000000000000000008cc6ab9ac1d1b7c5f6fc33f767aded9a305744e30000000000000000000000000000000000000000000000000000000068ed0bc600000000000000000000000000000000000000000000001b1ae4d6e2ef500000000000000000000000000000000000000000000000000000000000000a4a793c0000000000000000000000000000000000000000000000000000000000000000",
"protocol": "UniswapV3",
"to": "0xe592427a0aece92de3edee1f18e0157c05861564",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "",
"from": "0xe0beeedbb7d392e6958741c8f9f4bc2e45231e4c",
"function": "multicall",
"function_sig": "0xac9650d8",
"hash": "0xe821c9a0ec256c0fd38f6e57eab070bf79b0048d2104989c2cd4c666d46657aa",
"input_data": "0xac9650d80000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000124c04b8d59000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000e0beeedbb7d392e6958741c8f9f4bc2e45231e4c0000000000000000000000000000000000000000000000000000000068fa3aac00000000000000000000000000000000000000000000000506a66f2e4143c000000000000000000000000000000000000000000000000000000000000586e04600000000000000000000000000000000000000000000000000000000000000285d3a1ff2b6bab83b63cd9ad0787074081a52ef34af88d065e77c8cc2239327c5edb3a432268e583100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"protocol": "Multicall",
"to": "0x1f721e2e82f6676fce4ea07a5958cf098d339e18",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3PositionManager",
"from": "0xe5e58921dfa6602792e3f5624e91d291c01dc135",
"function": "decreaseLiquidity",
"function_sig": "0x0c49ccbe",
"hash": "0x5992966aa1cc733367aa0a00e2b3098b6d0d6b88835affbc43e02e1101ac4b8b",
"input_data": "0x0c49ccbe00000000000000000000000000000000000000000000000000000000004c1f2c00000000000000000000000000000000000000000000000000000001e20e0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000068ed105b",
"protocol": "UniswapV3",
"to": "0xc36442b4a4522e871399cd717abdd847ab11fe88",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "TraderJoeRouter",
"from": "0xcdd200769654f3c986fe6e48584585705a7941f6",
"function": "multicall",
"function_sig": "0xac9650d8",
"hash": "0xca9f939fa7f27921ce356dbd103c7613b464dba7356c6a5ce522619c21f14fbb",
"input_data": "0xac9650d800000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000247489ec235815d3beeae78016c1c0a784c92f5411014e58dd317dbe6562f2140c65f61ece00000000000000000000000000000000000000000000000000000000",
"protocol": "Multicall",
"to": "0x87d66368cd08a7ca42252f5ab44b2fb6d1fb8d15",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV2Router02",
"from": "0xba7a224852693f9a1695334105c2e63159eb2311",
"function": "swapExactTokensForTokens",
"function_sig": "0x38ed1739",
"hash": "0xee2af12f5e40c87e7452f70ef439bcf22663a726cc1bdf9f0def2e0f33f72320",
"input_data": "0x38ed17390000000000000000000000000000000000000000000000053220a269ab55c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000ba7a224852693f9a1695334105c2e63159eb23110000000000000000000000000000000000000000000000000000000068ed12b5000000000000000000000000000000000000000000000000000000000000000200000000000000000000000003f6921f6e948016631ce796331294d5a863a9ee000000000000000000000000dcc9691793633176acf5cfdc1a658cb3b982e2fb",
"protocol": "UniswapV2",
"to": "0x4752ba5dbc23f44d87826276bf6fd6b1c372ad24",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "",
"from": "0x3b0795a13dad67005c629cf02afd8ed515643655",
"function": "swapExactTokensForTokens",
"function_sig": "0x38ed1739",
"hash": "0x3a4869a8dcc5d309eaf3687ec47bfa220f21029375863d3e2e4f3a797e096497",
"input_data": "0x38ed173900000000000000000000000000000000000000000000000246ddf97976680000000000000000000000000000000000000000000000000000000000000b0baa4900000000000000000000000000000000000000000000000000000000000000a00000000000000000000000003b0795a13dad67005c629cf02afd8ed5156436550000000000000000000000000000000000000000000000000000000068ed102400000000000000000000000000000000000000000000000000000000000000020000000000000000000000001009c5c11cdd44bffeac3c70db7eb143df2faad1000000000000000000000000fd086bc7cd5c481dcc9c85ebe478a1c0b69fcbb9",
"protocol": "UniswapV2",
"to": "0x82dfd2b94222bdb603aa6b34a8d37311ab3db800",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3PositionManager",
"from": "0xe5e58921dfa6602792e3f5624e91d291c01dc135",
"function": "collect",
"function_sig": "0xfc6f7865",
"hash": "0x2b55abd5ee9bc902e5370824e8f618cde32c1fdfd0307e433fb3aabb22e6a86a",
"input_data": "0xfc6f786500000000000000000000000000000000000000000000000000000000004c1f2c000000000000000000000000e5e58921dfa6602792e3f5624e91d291c01dc13500000000000000000000000000000000ffffffffffffffffffffffffffffffff00000000000000000000000000000000ffffffffffffffffffffffffffffffff",
"protocol": "UniswapV3",
"to": "0xc36442b4a4522e871399cd717abdd847ab11fe88",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3PositionManager",
"from": "0x9e47fbb2a2a27b3b02e4a63b3ef5a3dc863c0223",
"function": "multicall",
"function_sig": "0xac9650d8",
"hash": "0xa467b01f88098a11878e4c4e43956c943f6d7766139825bb7cbf2bb8efe69578",
"input_data": "0xac9650d80000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000160000000000000000000000000000000000000000000000000000000000000022000000000000000000000000000000000000000000000000000000000000002a000000000000000000000000000000000000000000000000000000000000000a40c49ccbe00000000000000000000000000000000000000000000000000000000004c1daa000000000000000000000000000000000000000000000000004c4269abc13855000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000068ed12a7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000084fc6f786500000000000000000000000000000000000000000000000000000000004c1daa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffff00000000000000000000000000000000ffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004449404b7c00000000000000000000000000000000000000000000000000225dcd56988ae70000000000000000000000009e47fbb2a2a27b3b02e4a63b3ef5a3dc863c0223000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064df2ab5bb000000000000000000000000fd086bc7cd5c481dcc9c85ebe478a1c0b69fcbb90000000000000000000000000000000000000000000000000000000002637ba50000000000000000000000009e47fbb2a2a27b3b02e4a63b3ef5a3dc863c022300000000000000000000000000000000000000000000000000000000",
"protocol": "Multicall",
"to": "0xc36442b4a4522e871399cd717abdd847ab11fe88",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3Router",
"from": "0x8cc6ab9ac1d1b7c5f6fc33f767aded9a305744e3",
"function": "exactOutputSingle",
"function_sig": "0xdb3e2198",
"hash": "0x71b76f0e28627051c8e349f4a5af835fb716f39549b50532eb5d8261e9780d2a",
"input_data": "0xdb3e2198000000000000000000000000ff970a61a04b1ca14834a43f5de4533ebddb5cc8000000000000000000000000912ce59144191c1204e64559fe8253a0e49e654800000000000000000000000000000000000000000000000000000000000001f40000000000000000000000008cc6ab9ac1d1b7c5f6fc33f767aded9a305744e30000000000000000000000000000000000000000000000000000000068ed0bd300000000000000000000000000000000000000000000001b1ae4d6e2ef500000000000000000000000000000000000000000000000000000000000000a4adb480000000000000000000000000000000000000000000000000000000000000000",
"protocol": "UniswapV3",
"to": "0xe592427a0aece92de3edee1f18e0157c05861564",
"value": "0"
}

View File

@@ -0,0 +1,12 @@
{
"block_number": "",
"contract_name": "UniswapV3Router",
"from": "0x196beae17c9577256a4c20d72a3c01cae5d00e9e",
"function": "exactInputSingle",
"function_sig": "0x414bf389",
"hash": "0xd39c510f44355cca3b7ee947b9697ef95df8921c8a90b3639572382092afe90c",
"input_data": "0x414bf38900000000000000000000000082af49447d8a07e3bd95bd0d56f35241523fbab1000000000000000000000000440017a1b021006d556d7fc06a54c32e42eb745b0000000000000000000000000000000000000000000000000000000000000bb8000000000000000000000000196beae17c9577256a4c20d72a3c01cae5d00e9e0000000000000000000000000000000000000000000000000000000068ed0e0e0000000000000000000000000000000000000000000000000024a689f2b2e3f0000000000000000000000000000000000000000000000011470476b682d78b380000000000000000000000000000000000000000000000000000000000000000",
"protocol": "UniswapV3",
"to": "0xe592427a0aece92de3edee1f18e0157c05861564",
"value": "0"
}

File diff suppressed because it is too large Load Diff

View File

View File

View File

@@ -0,0 +1,71 @@
# MEV Bot Security Audit
**Date:** 2025-11-03
**Auditor:** Codex (GPT-5)
## 1. Scope & Methodology
- Reviewed on-chain contracts in `contracts/` with emphasis on `ProductionArbitrageExecutor.sol` and Balancer flash-loan receivers.
- Inspected Go runtime components under `pkg/security`, `pkg/arbitrum`, `pkg/transport`, and CLI tooling in `cmd/`.
- Assessed operational scripts and configuration artifacts within `scripts/`, `config/`, and documentation references.
- Static analysis only; no live transactions executed.
## 2. Executive Summary
The repository still embeds production credentials (Chainstack RPC token and an Alchemy API key), contains placeholder authentication logic, and ships a non-compilable main arbitrage contract. These issues allow credential theft, brute-force attacks on wallet material, and prevent reliable deployment. Immediate remediation is required before any production use.
## 3. Critical Findings
### C-01 Hardcoded RPC Credential
- **Location:** `pkg/arbitrum/connection.go:197`, `pkg/pools/discovery.go:594-597`, `pkg/market/manager.go:118-123`, `README.md:68-69`
- **Risk:** Embedded Chainstack token grants public RPC access; attackers can hijack traffic or exhaust quotas. The client falls back to this token silently, so operators may unintentionally deploy with leaked credentials.
- **Recommendation:** Rotate the Chainstack token. Remove every hardcoded endpoint, require operators to supply credentials via secrets storage or environment variables, and add CI checks that block `chainstack.com/<token>` strings.
### C-02 Exposed Alchemy API Key
- **Location:** `scripts/check-wallet-balance.sh:8`
- **Risk:** Public key can be abused for unlimited balance queries, risking rate-limit bans or service suspension.
- **Recommendation:** Treat the key as compromised, rotate it, and load RPC URLs from configuration rather than shipping them in scripts.
### C-03 Placeholder Authentication With Static Passwords
- **Location:** `pkg/security/keymanager.go:1550-1567`
- **Risk:** Any adversary can authenticate with `secure_admin_password_123` or `default_password`, granting access to signing keys.
- **Recommendation:** Remove the stub entirely. Integrate a real credential store (bcrypt/argon2 hashes, salted) and enforce MFA/whitelisting policies defined in config.
### C-04 Weak Keystore Derivation
- **Location:** `pkg/security/keymanager.go:295-301`
- **Risk:** Uses `keystore.LightScryptN/ LightScryptP` which is labelled “testing only” in go-ethereum and reduces brute-force cost dramatically.
- **Recommendation:** Restore `keystore.StandardScryptN`/`StandardScryptP` for production or migrate to Argon2id. Update tests/benchmarks accordingly.
### C-05 Unsafe Legacy Flash-Loan Executor
- **Location:** `contracts/balancer/FlashLoanReceiver.sol:112-139`
- **Risk:** Sets `amountOutMinimum` to zero and leaves token approvals unlimited, enabling routers to drain assets if trusted routes are compromised.
- **Recommendation:** Retire this contract or align it with the hardened `FlashLoanReceiverSecure` implementation (bounded slippage, allowance resets, SafeERC20).
### C-06 Non-Compilable Production Arbitrage Contract
- **Location:** `contracts/ProductionArbitrageExecutor.sol:548-570`
- **Risk:** Relies on `getRoleMember` without importing `AccessControlEnumerable`, so the supposedly “production-ready” contract cannot deploy. Documentation claiming the bytecode is live is inaccurate.
- **Recommendation:** Either extend `AccessControlEnumerable` or redesign withdrawals to avoid enumeration. Recompile and update docs/tests after the fix.
## 4. Medium Findings
### M-01 Insecure Private-Key Handling in Scripts
- **Location:** `scripts/check-wallet-balance.sh:7`, `scripts/setup-keystore.sh:8`
- **Risk:** Reads secrets from `/tmp/wallet_key.txt`, a predictable world-readable path on many systems.
- **Recommendation:** Require user-supplied secure paths or interactive input. Wipe temporary buffers after use.
### M-02 Default Test Private Key Fallback
- **Location:** `scripts/deploy-pool-detector.sh:30-37`
- **Risk:** Deployment scripts silently use a known Foundry test key, risking accidental mainnet deployment with a public private key.
- **Recommendation:** Fail fast if `PRIVATE_KEY` is unset. Keep test keys in local-only templates.
## 5. Positive Observations
- `contracts/balancer/FlashLoanReceiverSecure.sol` addresses the audit findings (slippage bounds, SafeERC20, non-reentrancy); prioritize this contract for deployment.
- `internal/logger` employs structured logging with secret scrubbing and level-based filtering, which will aid operational monitoring once credentials are externalized.
## 6. Recommendations & Next Steps
1. Rotate all leaked RPC/API credentials immediately and scrub them from repository history.
2. Replace the placeholder authentication/KDF logic with production-grade implementations and add regression tests.
3. Migrate to `FlashLoanReceiverSecure` and ensure `ProductionArbitrageExecutor` compiles; rerun Foundry and Go test suites post-changes.
4. Harden operational scripts to avoid writing secrets to predictable locations and to fail without explicit credentials.
5. Introduce CI checks (e.g., `ripgrep` rules) to block committed secrets, Chainstack/Alchemy tokens, or default passwords going forward.
## 7. Testing Performed
- Manual static review; no automated tests were executed in this pass. Re-run `go test ./...`, Foundry unit/integration tests, and any existing CI workflows after remediation.

View File

@@ -0,0 +1,96 @@
{
"generated_at": "2025-10-21T17:31:38Z",
"directory": "reports/payloads",
"file_count": 14,
"time_range": {
"earliest": "2025-10-13T14:24:32Z",
"latest": "2025-10-13T14:24:55Z"
},
"protocols": [
{
"name": "UniswapV3",
"count": 8,
"percentage": 57.14
},
{
"name": "Multicall",
"count": 4,
"percentage": 28.57
},
{
"name": "UniswapV2",
"count": 2,
"percentage": 14.29
}
],
"contracts": [
{
"name": "UniswapV3Router",
"count": 6,
"percentage": 42.86
},
{
"name": "UniswapV3PositionManager",
"count": 3,
"percentage": 21.43
},
{
"name": "TraderJoeRouter",
"count": 2,
"percentage": 14.29
},
{
"name": "unknown",
"count": 2,
"percentage": 14.29
},
{
"name": "UniswapV2Router02",
"count": 1,
"percentage": 7.14
}
],
"functions": [
{
"name": "exactOutputSingle",
"count": 5,
"percentage": 35.71
},
{
"name": "multicall",
"count": 4,
"percentage": 28.57
},
{
"name": "swapExactTokensForTokens",
"count": 2,
"percentage": 14.29
},
{
"name": "collect",
"count": 1,
"percentage": 7.14
},
{
"name": "decreaseLiquidity",
"count": 1,
"percentage": 7.14
},
{
"name": "exactInputSingle",
"count": 1,
"percentage": 7.14
}
],
"missing_block_number": 14,
"missing_recipient": 0,
"non_zero_value_count": 1,
"average_input_bytes": 362.86,
"sample_transaction_hashes": [
"0x69bad4eca82a4e139aad810777dc72faf5414e338b0a1b648e8472cd4904f93e",
"0x69aaa929dace9feee6e1579f4b0fae055868fd56bb7fbd653a02ebd787e348f3",
"0xf6431652d3e4e9de83d259de062488064ead35e5f112d13ae110b24b8782e242",
"0xaf6228fcef1fa34dafd4e8d6e359b845e052a1a6597c88c1c2c94045c6140f9f",
"0x725db13de678e9da4590bf4fe40051f397ff4c8625ef5f1e343a39905151fa7b"
]
}

View File

@@ -0,0 +1,47 @@
# Payload Capture Analysis
- Generated at: 2025-10-21T17:31:38Z
- Source directory: `reports/payloads`
- Files analysed: **14**
- Capture window: 2025-10-13T14:24:32Z → 2025-10-13T14:24:55Z
- Average calldata size: 362.86 bytes
- Payloads with non-zero value: 1
- Missing block numbers: 14
- Missing recipients: 0
## Protocol Distribution
| Protocol | Count | Share |
| --- | ---:| ---:|
| UniswapV3 | 8 | 57.14% |
| Multicall | 4 | 28.57% |
| UniswapV2 | 2 | 14.29% |
## Contract Names
| Contract | Count | Share |
| --- | ---:| ---:|
| UniswapV3Router | 6 | 42.86% |
| UniswapV3PositionManager | 3 | 21.43% |
| TraderJoeRouter | 2 | 14.29% |
| unknown | 2 | 14.29% |
| UniswapV2Router02 | 1 | 7.14% |
## Function Signatures
| Function | Count | Share |
| --- | ---:| ---:|
| exactOutputSingle | 5 | 35.71% |
| multicall | 4 | 28.57% |
| swapExactTokensForTokens | 2 | 14.29% |
| collect | 1 | 7.14% |
| decreaseLiquidity | 1 | 7.14% |
| exactInputSingle | 1 | 7.14% |
## Sample Transactions
- `0x69bad4eca82a4e139aad810777dc72faf5414e338b0a1b648e8472cd4904f93e`
- `0x69aaa929dace9feee6e1579f4b0fae055868fd56bb7fbd653a02ebd787e348f3`
- `0xf6431652d3e4e9de83d259de062488064ead35e5f112d13ae110b24b8782e242`
- `0xaf6228fcef1fa34dafd4e8d6e359b845e052a1a6597c88c1c2c94045c6140f9f`
- `0x725db13de678e9da4590bf4fe40051f397ff4c8625ef5f1e343a39905151fa7b`

View File

@@ -0,0 +1,58 @@
{
"generated_at": "2025-10-21T17:31:38Z",
"vector_path": "tools/simulation/vectors/default.json",
"network": "arbitrum-one",
"window": "2024-09-15T00:00:00Z/2024-09-15T01:00:00Z",
"sources": [
"uniswap-v3",
"camelot",
"sushiswap"
],
"attempts": 5,
"executed": 4,
"conversion_rate": 0.8,
"successful": 3,
"failed": 1,
"hit_rate": 0.75,
"gross_profit_eth": "0.101000",
"gas_cost_eth": "0.013700",
"net_profit_eth": "0.087300",
"average_profit_per_trade_eth": "0.021825",
"average_gas_cost_eth": "0.003425",
"profit_factor": 6.372262773722627,
"exchange_breakdown": [
{
"exchange": "camelot",
"executed": 2,
"successful": 1,
"hit_rate": 0.5,
"gross_profit_eth": "0.012000",
"net_profit_eth": "0.006100",
"gas_cost_eth": "0.005900"
},
{
"exchange": "sushiswap",
"executed": 1,
"successful": 1,
"hit_rate": 1,
"gross_profit_eth": "0.049200",
"net_profit_eth": "0.044500",
"gas_cost_eth": "0.004700"
},
{
"exchange": "uniswap-v3",
"executed": 1,
"successful": 1,
"hit_rate": 1,
"gross_profit_eth": "0.039800",
"net_profit_eth": "0.036700",
"gas_cost_eth": "0.003100"
}
],
"skip_reasons": [
{
"reason": "below_min_profit",
"count": 1
}
]
}

View File

@@ -0,0 +1,31 @@
# Profitability Simulation Report
- Generated at: 2025-10-21T17:31:38Z
- Vector source: `tools/simulation/vectors/default.json`
- Network: **arbitrum-one**
- Window: 2024-09-15T00:00:00Z/2024-09-15T01:00:00Z
- Exchanges: uniswap-v3, camelot, sushiswap
## Summary
- Opportunities analysed: **5**
- Executed: **4** (conversion 80.0%)
- Successes: **3** / 4 (hit rate 75.0%)
- Gross profit: **0.101000 ETH**
- Gas spent: **0.013700 ETH**
- Net profit after gas: **0.087300 ETH**
- Avg profit per trade: **0.021825 ETH**
- Avg gas cost per trade: **0.003425 ETH**
- Profit factor (net/gas): **6.37**
## Exchange Breakdown
| Exchange | Executed | Success | Hit Rate | Gross Profit (ETH) | Gas (ETH) | Net Profit (ETH) |
| --- | ---:| ---:| ---:| ---:| ---:| ---:|
| camelot | 2 | 1 | 50.0% | 0.012000 | 0.005900 | 0.006100 |
| sushiswap | 1 | 1 | 100.0% | 0.049200 | 0.004700 | 0.044500 |
| uniswap-v3 | 1 | 1 | 100.0% | 0.039800 | 0.003100 | 0.036700 |
## Skip Reasons
- below_min_profit: 1

View File

@@ -0,0 +1,153 @@
Unused Go packages (not reachable from any main package)
- github.com/fraktal/mev-beta/bindings/contracts [dir: bindings/contracts]
* arbitrageexecutor.go
* baseflashswapper.go
* dexmath.go
* iflashswapper.go
* shared_types.go
* uniswapv2flashswapper.go
* uniswapv3flashswapper.go
- github.com/fraktal/mev-beta/bindings/core [dir: bindings/core]
* iarbitrage.go
* shared_types.go
- github.com/fraktal/mev-beta/internal/secure [dir: internal/secure]
* config_manager.go
- github.com/fraktal/mev-beta/pkg/bindings [dir: pkg/bindings]
* bindings.go
- github.com/fraktal/mev-beta/pkg/execution [dir: pkg/execution]
* queue.go
- github.com/fraktal/mev-beta/pkg/lifecycle [dir: pkg/lifecycle]
* dependency_injection.go
* health_monitor.go
* interfaces.go
* module_registry.go
* shutdown_manager.go
* state_machine.go
- github.com/fraktal/mev-beta/pkg/monitoring [dir: pkg/monitoring]
* dashboard.go
- github.com/fraktal/mev-beta/pkg/orchestrator [dir: pkg/orchestrator]
* coordinator.go
- github.com/fraktal/mev-beta/pkg/patterns [dir: pkg/patterns]
* pipeline.go
- github.com/fraktal/mev-beta/pkg/performance [dir: pkg/performance]
* optimizer.go
* pools.go
- github.com/fraktal/mev-beta/pkg/pricing [dir: pkg/pricing]
* engine.go
- github.com/fraktal/mev-beta/pkg/risk [dir: pkg/risk]
* manager.go
* manager_test.go
* profit_validator.go
- github.com/fraktal/mev-beta/pkg/slippage [dir: pkg/slippage]
* protection.go
- github.com/fraktal/mev-beta/pkg/uniswap/lookup [dir: pkg/uniswap/lookup]
* lookup_bench_test.go
* optimized.go
* tables.go
- github.com/fraktal/mev-beta/test/benchmarks [dir: test/benchmarks]
* pricing_bench_test.go
- github.com/fraktal/mev-beta/test/integration [dir: test/integration]
* corruption_simulation_test.go
- github.com/fraktal/mev-beta/test/mocks [dir: test/mocks]
* arbitrum_mock_test.go
* mock_types.go
- github.com/fraktal/mev-beta/test/testutils [dir: test/testutils]
* testutils.go
- github.com/fraktal/mev-beta/tools/tests [dir: tools/tests]
* ci_agent_bridge_test.go
Directories failing go list (potentially invalid/mixed packages)
- ./test: found packages test (contract_type_validation_test.go) and main (validation_fix_test.go) in /home/administrator/projects/mev-beta/test
- ./test/e2e: package github.com/fraktal/mev-beta/test/e2e: build constraints exclude all Go files in /home/administrator/projects/mev-beta/test/e2e
- ./test/fuzzing: package github.com/fraktal/mev-beta/test/fuzzing: build constraints exclude all Go files in /home/administrator/projects/mev-beta/test/fuzzing
- ./test/production: package github.com/fraktal/mev-beta/test/production: build constraints exclude all Go files in /home/administrator/projects/mev-beta/test/production
- ./test/property: package github.com/fraktal/mev-beta/test/property: build constraints exclude all Go files in /home/administrator/projects/mev-beta/test/property
- ./test/sequencer: package github.com/fraktal/mev-beta/test/sequencer: build constraints exclude all Go files in /home/administrator/projects/mev-beta/test/sequencer
- ./test/stress: package github.com/fraktal/mev-beta/test/stress: build constraints exclude all Go files in /home/administrator/projects/mev-beta/test/stress
- ./test/unit/scanner: package github.com/fraktal/mev-beta/test/unit/scanner: build constraints exclude all Go files in /home/administrator/projects/mev-beta/test/unit/scanner
- ./tests/integration: package github.com/fraktal/mev-beta/tests/integration: build constraints exclude all Go files in /home/administrator/projects/mev-beta/tests/integration
- ./tools/audit-orchestrator: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/audit-orchestrator
- ./tools/audit-orchestrator/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/audit-orchestrator/internal
- ./tools/cicd-audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/cicd-audit
- ./tools/cicd-audit/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/cicd-audit/internal
- ./tools/exchange-audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/exchange-audit
- ./tools/exchange-audit/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/exchange-audit/internal
- ./tools/gas-audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/gas-audit
- ./tools/gas-audit/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/gas-audit/internal
- ./tools/math-audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit
- ./tools/math-audit/cmd: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit/cmd
- ./tools/math-audit/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit/internal
- ./tools/math-audit/internal/audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit/internal/audit
- ./tools/math-audit/internal/checks: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit/internal/checks
- ./tools/math-audit/internal/loader: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit/internal/loader
- ./tools/math-audit/internal/models: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit/internal/models
- ./tools/math-audit/internal/report: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/math-audit/internal/report
- ./tools/opportunity-validator: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/opportunity-validator
- ./tools/opportunity-validator/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/opportunity-validator/internal
- ./tools/performance-audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/performance-audit
- ./tools/performance-audit/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/performance-audit/internal
- ./tools/profitability-audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/profitability-audit
- ./tools/profitability-audit/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/profitability-audit/internal
- ./tools/security-audit: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/security-audit
- ./tools/security-audit/internal: main module (github.com/fraktal/mev-beta) does not contain package github.com/fraktal/mev-beta/tools/security-audit/internal
Heuristic legacy/backup directories (keyword match)
- backup
- backup/logs
- backup/logs/20250917050536
- backup/logs/20250917052923
- backup/old-audits
- backup/old-implementations
- backup/old-misc
- backup/old-misc/git-secrets
- backup/old-misc/git-secrets/.git
- backup/old-misc/git-secrets/.git/hooks
- backup/old-misc/git-secrets/.git/info
- backup/old-misc/git-secrets/.git/logs
- backup/old-misc/git-secrets/.git/logs/refs
- backup/old-misc/git-secrets/.git/logs/refs/heads
- backup/old-misc/git-secrets/.git/logs/refs/remotes
- backup/old-misc/git-secrets/.git/logs/refs/remotes/origin
- backup/old-misc/git-secrets/.git/objects
- backup/old-misc/git-secrets/.git/objects/info
- backup/old-misc/git-secrets/.git/objects/pack
- backup/old-misc/git-secrets/.git/refs
- backup/old-misc/git-secrets/.git/refs/heads
- backup/old-misc/git-secrets/.git/refs/remotes
- backup/old-misc/git-secrets/.git/refs/remotes/origin
- backup/old-misc/git-secrets/.git/refs/tags
- backup/old-misc/git-secrets/.github
- backup/old-misc/git-secrets/.github/workflows
- backup/old-misc/git-secrets/test
- backup/old-misc/git-secrets/test/bats
- backup/old-misc/git-secrets/test/bats/bin
- backup/old-misc/git-secrets/test/bats/libexec
- backup/old-plans
- backup/old-reports
- backups
- backups/20251010_091058
- backups/20251010_091235
- backups/production
- backups/smoke
- pkg/security/backups