rextorsec / rextor-audit-test

Living audit report

Tempo testnet · 42431Contract 0x51ac…495ariskScore 0–100 · higher = riskier
index unavailable

The review index could not be read (review index answered 530) — no data is shown rather than guessed.

Deep Scan

Whole-repo scan at a pinned head — synchronous, minutes not seconds. The verdict lands in the ledger below with its full receipt.

owner/name · charset [A-Za-z0-9_.-]

branch, tag or sha — empty resolves to HEAD

Deep Scan trigger is disabled on this deployment.

scan index unavailable

The scan index could not be read (scan index answered 530) — no data is shown rather than guessed.

rextor-audit ACTIVE

Agent address
0x5f2b…7f37
Tempo attested
24
HyperEVM attested
3
Attested incomplete
0
ERC-8004 identity
#50891 · eip155:1

agents() + reviewCount read live from the attestation contracts via public RPC — browser holds no keys.

Review configuration · live preview

rextor.yaml — the repo's knobs

# rextor-audit repo config — trusted channel: base branch only (SPEC-7 §1).
# Smoke: exercises severity gate (minimum: high) + dismissals store sync (D4).
# The missing-zero-check on the mint recipient is intentional fixture surface;
# it is dismissed from the GATE only — it stays visible in the comment + score.
paths:
  ignore:
    - "test/**"
severity_gate:
  minimum: high
dismiss:
  - rule_id: missing-zero-check
    path: SmokeVault.sol
    reason: smoke fixture — unzeroed mint recipient is intentional demo surface
  - rule_id: missing-zero-check
    path: src/SmokeVault.sol
    reason: smoke fixture — unzeroed mint recipient is intentional demo surface

read from the PR's base branch — trusted source, never from PR content. Dismissals match on (rule_id, path); the line is recorded, not matched.

what the PR comment renders

Below the banner: the findings table — each row citing exact file:line ranges from the diff, ranked by severity. With severity_gate.minimum: high the check-run fails on any critical or high finding, blocking merge until resolved or dismissed.

sample
real receipt — sip-protocol/sip-protocol#1267, head f88a483
attestation
Tempo testnet · tx 0x13be66d7 · findingsHash pinned to IPFS
comment
the real review ↗

Dismissal memory

—

Stored server-side, keyed by repo — never in a repo file. PR content cannot silence a finding: dismissal requires service-side action from the repo owner, and every dismissal is recorded with its rule and path.

count unavailable — dismissal memory answered 530