// Hero.jsx — headline + audit dashboard mock function Hero() { return (
{/* Headline block */}

AI audits that find real bugs.
In hours, not weeks.

We audit Solana programs in hours, not weeks. Anchor, native, Pinocchio. Every bug we flag is proved by a working exploit — so you skip the AI slop and only review real bugs.

Start an audit
{/* Dashboard mock — wider than container; auto-scales to fit viewport */}
); } /* Scale a fixed-width design to fit available container width. Measures the parent, applies transform: scale, and reserves height matching the scaled-down content so surrounding layout doesn't tear. */ function ScaleFrame({ designWidth, children }) { const outerRef = React.useRef(null); const innerRef = React.useRef(null); const [scale, setScale] = React.useState(1); const [innerH, setInnerH] = React.useState(0); React.useEffect(() => { let raf = 0; const measure = () => { cancelAnimationFrame(raf); raf = requestAnimationFrame(() => { const outer = outerRef.current; const inner = innerRef.current; if (!outer || !inner) return; const availW = outer.clientWidth; const s = Math.min(1, availW / designWidth); // Measure inner's natural (unscaled) height by reading scrollHeight, // which is unaffected by the parent's transform. const h = inner.offsetHeight; setScale(s); setInnerH(h); }); }; measure(); window.addEventListener('resize', measure); // Also re-measure when fonts/images load const t1 = setTimeout(measure, 200); const t2 = setTimeout(measure, 800); return () => { cancelAnimationFrame(raf); clearTimeout(t1); clearTimeout(t2); window.removeEventListener('resize', measure); }; }, [designWidth]); return (
{children}
); } /* ─────────────────────────────────────────────────────────────────────── */ const SEV_COLOR = { critical: '#b388ff', // violet high: '#ff8a3d', medium: '#f5b35a', low: '#7effa4', }; const FINDINGS = [ { n: 12, sev: 'critical', poc: true, title: 'Missing mint check on deposit allows depositing fake collateral', impact: 'fund-loss' }, { n: 9, sev: 'critical', poc: true, title: 'Rounding error in fee distribution allows draining the insurance fund', impact: 'fund-loss' }, { n: 7, sev: 'high', poc: true, title: 'Cross margin transfer skips the maintenance margin check', impact: 'fund-loss' }, { n: 5, sev: 'high', poc: true, title: 'PDA derivation is not validated when generating settlement receipts', impact: 'integrity' }, { n: 3, sev: 'medium', poc: true, title: 'Position open can be denial-of-serviced by front-running the create_account', impact: 'availability' }, ]; function DashboardMock() { const [activeTab, setActiveTab] = React.useState('all'); const [active, setActive] = React.useState(0); // index into FINDINGS const tabCounts = { all: 21, unreviewed: 21, critical: 2, high: 3, medium: 5, low: 9, info: 2, report: 21, excluded: 0, }; return (
); } /* ── Rail ─────────────────────────────────────────────────────────────── */ function Rail() { return (
n
); } function RailItem({ icon, label, active }) { return (
{icon} {label}
); } /* ── Header strip ─────────────────────────────────────────────────────── */ function HeaderStrip() { return (
perp-dex ai audit running Created May 12, 2026 · 7:57 PM
); } function Pulse() { return ( ); } /* ── Stats row ────────────────────────────────────────────────────────── */ function StatsRow() { return (
); } function Meta({ label, value, mono, link }) { return (
{label} {value}
); } function useTween(target, duration = 1200, delay = 200) { const [v, setV] = React.useState(0); React.useEffect(() => { let raf = 0; let start = 0; const ease = (t) => 1 - Math.pow(1 - t, 3); // easeOutCubic const tick = (ts) => { if (!start) start = ts; const elapsed = ts - start - delay; if (elapsed < 0) { raf = requestAnimationFrame(tick); return; } const t = Math.min(1, elapsed / duration); setV(target * ease(t)); if (t < 1) raf = requestAnimationFrame(tick); }; raf = requestAnimationFrame(tick); return () => cancelAnimationFrame(raf); }, [target, duration, delay]); return v; } function RiskRing({ score, grade }) { // Critical = violet glow const color = score < 40 ? '#b388ff' : score < 70 ? '#f5b35a' : '#7effa4'; const r = 38, c = 2 * Math.PI * r; const animScore = useTween(score, 1300, 200); const pct = animScore / 100; return (
{animScore > score - 0.5 ? grade : ''} {Math.round(animScore)} / 100
critical
); } function IssuesDonut({ total, counts }) { const segs = [ { v: counts.critical, c: '#b388ff' }, { v: counts.high, c: '#ff8a3d' }, { v: counts.medium, c: '#f5b35a' }, { v: counts.low, c: '#7effa4' }, ]; const r = 38, c = 2 * Math.PI * r; const sum = segs.reduce((a, s) => a + s.v, 0); const p = useTween(1, 1300, 350); // 0 → 1 progress // For each segment, we compute its full arc and its current visible arc. let cursorFull = 0; // running offset measured at full progress let cursorAnim = 0; // running offset measured at current p (only counts arcs already past) const dashed = segs.map((s) => { const fullLen = (s.v / sum) * c; const fullStart = cursorFull; const fullEnd = cursorFull + fullLen; cursorFull = fullEnd; const fillTo = p * c; // up to this arc length the perimeter is "filled in" let visibleLen = 0; if (fillTo > fullStart) { visibleLen = Math.min(fullLen, fillTo - fullStart); } const dash = `${visibleLen} ${c - visibleLen}`; const offset = -fullStart; return { ...s, dash, offset }; }); const animTotal = Math.round(useTween(total, 1100, 350)); return (
{dashed.map((s, i) => ( ))}
{animTotal} issues
by severity
); } /* ── Review progress ──────────────────────────────────────────────────── */ function ReviewProgress({ counts }) { return (
review progress 0 / 21 reviewed · 21 open
0% {counts.critical} C {counts.high} H {counts.medium} M {counts.low} L 21 in report
); } /* ── Filter strip ─────────────────────────────────────────────────────── */ function FilterStrip({ active, setActive, counts }) { const tabs = [ { k: 'all', l: 'All', n: counts.all, color: '#7effa4' }, { k: 'unreviewed', l: 'Unreviewed', n: counts.unreviewed }, { k: 'critical', l: 'Critical', n: counts.critical, color: SEV_COLOR.critical }, { k: 'high', l: 'High', n: counts.high, color: SEV_COLOR.high }, { k: 'medium', l: 'Medium', n: counts.medium, color: SEV_COLOR.medium }, { k: 'low', l: 'Low', n: counts.low, color: SEV_COLOR.low }, { k: 'report', l: 'In report', n: counts.report }, { k: 'excluded', l: 'Excluded', n: counts.excluded }, ]; return (
{tabs.map((t) => ( ))}
⌕ Search title…
); } /* ── List + Detail ────────────────────────────────────────────────────── */ function ListAndDetail({ active, setActive }) { const cur = FINDINGS[active] || FINDINGS[0]; return (
{/* List — mockup, only the active finding has full data, so clicks are inert */}
{FINDINGS.map((f, i) => ( ))}
{/* Detail */}
); } function IssueCard({ finding, active }) { const color = SEV_COLOR[finding.sev]; return (
#{finding.n} {finding.sev}
{finding.poc && ( ✓ poc )}
{finding.title}
impact: {finding.impact}
); } function IssueDetail({ finding }) { const color = SEV_COLOR[finding.sev]; return (
{/* Left: body */}
{/* Status row — nowrap so Copy as text stays right */}
#{finding.n} {finding.sev} ✓ poc confirmed
{/* Title */}

{finding.title}

{/* Impact / Likelihood chips */}
{/* Triage row — single row, compact */}
triage
{/* Summary */}
deposit credits the caller’s margin balance one-to-one with the transferred amount, but never asserts that deposit_mint equals the protocol’s configured collateral mint. An attacker can create a worthless SPL token and deposit any amount to obtain real margin credit, then borrow or open positions against it.
{/* Right: code */}
); } function Chip({ label, value }) { return (
{label}
{value}
); } function TriageBtn({ label }) { return ( ); } function Section({ label, children }) { return (
{label}
{children}
); } function CodePanel() { return (
programs/perp/src/instructions/deposit.rs:64-82 open
{'// programs/perp/src/instructions/deposit.rs'} {'// ── Accounts ──────────────────────────'} if !depositor_info.is_signer {'{'} {' '}return Err(PerpError::AccountNotSigner.into()); {'}'} let mint = Mint::try_from(deposit_mint_info)?; let mut margin = MarginAccount::load_mut(margin_info)?; {'// ── Transfer in (mint never checked) ─'} let cpi = CpiContext::new(token_program, Transfer {'{'} {' '}from: depositor_token_account, {' '}to: vault_token_account, {' '}authority: depositor_info, {'}'}); token::transfer(cpi, args.amount)?; margin.balance = margin.balance {' '}.checked_add(args.amount).ok_or(PerpError::MathOverflow)?;
); } function Code({ n, hl, children }) { return (
{n} {children}
); } function Cmt({ n, children }) { return (
{n} {children}
); } function K({ children }) { return {children}; } function T({ children }) { return {children}; } function F({ children }) { return {children}; } function V({ children }) { return {children}; } function S({ children }) { return {children}; } window.Hero = Hero;