c54c569f30
Completed clean root directory structure: - Root now contains only: .git, .env, docs/, orig/ - Moved all remaining files and directories to orig/: - Config files (.claude, .dockerignore, .drone.yml, etc.) - All .env variants (except active .env) - Git config (.gitconfig, .github, .gitignore, etc.) - Tool configs (.golangci.yml, .revive.toml, etc.) - Documentation (*.md files, @prompts) - Build files (Dockerfiles, Makefile, go.mod, go.sum) - Docker compose files - All source directories (scripts, tests, tools, etc.) - Runtime directories (logs, monitoring, reports) - Dependency files (node_modules, lib, cache) - Special files (--delete) - Removed empty runtime directories (bin/, data/) V2 structure is now clean: - docs/planning/ - V2 planning documents - orig/ - Complete V1 codebase preserved - .env - Active environment config (not in git) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
72 lines
1.7 KiB
Markdown
72 lines
1.7 KiB
Markdown
# Security Audit
|
|
|
|
Perform a comprehensive security audit of the MEV bot focusing on: $ARGUMENTS
|
|
|
|
## Security Audit Checklist:
|
|
|
|
### 1. **Code Security Analysis**
|
|
```bash
|
|
# Static security analysis
|
|
gosec ./...
|
|
|
|
# Dependency vulnerabilities
|
|
go list -json -m all | nancy sleuth
|
|
|
|
# Secret scanning
|
|
git-secrets --scan
|
|
```
|
|
|
|
### 2. **Input Validation Review**
|
|
- Transaction data parsing validation
|
|
- RPC response validation
|
|
- Configuration parameter validation
|
|
- Mathematical overflow/underflow checks
|
|
- Buffer overflow prevention
|
|
|
|
### 3. **Cryptographic Security**
|
|
- Private key handling and storage
|
|
- Signature verification processes
|
|
- Random number generation
|
|
- Hash function usage
|
|
- Encryption at rest and in transit
|
|
|
|
### 4. **Network Security**
|
|
- RPC endpoint authentication
|
|
- TLS/SSL configuration
|
|
- Rate limiting implementation
|
|
- DDoS protection mechanisms
|
|
- WebSocket connection security
|
|
|
|
### 5. **Runtime Security**
|
|
- Memory safety in Go code
|
|
- Goroutine safety and race conditions
|
|
- Resource exhaustion protection
|
|
- Error information disclosure
|
|
- Logging security (no sensitive data)
|
|
|
|
## Specific MEV Bot Security Areas:
|
|
|
|
### **Transaction Processing**
|
|
- Validate all transaction inputs
|
|
- Prevent transaction replay attacks
|
|
- Secure handling of swap calculations
|
|
- Protection against malicious contract calls
|
|
|
|
### **Market Data Integrity**
|
|
- Price feed validation
|
|
- Oracle manipulation detection
|
|
- Historical data integrity
|
|
- Real-time data verification
|
|
|
|
### **Financial Security**
|
|
- Gas estimation accuracy
|
|
- Slippage protection
|
|
- Minimum profit validation
|
|
- MEV protection mechanisms
|
|
|
|
## Output Requirements:
|
|
- Detailed security findings report
|
|
- Risk assessment (Critical/High/Medium/Low)
|
|
- Remediation recommendations
|
|
- Implementation timeline for fixes
|
|
- Security testing procedures |