OpenZeppelin/openzeppelin-contracts

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

https://github.com/OpenZeppelin/openzeppelin-contracts.git · scanned 2026-05-16 13:30 UTC (1 day, 6 hours ago) · 10 languages

83 findings (6 legacy + 77 scanner)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 day, 10 hours ago · v1 · 83 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON

{# ── 2026-05-17 R27 #5: score breakdown panel ────────────────────── Surfaces the score_breakdown JSON that's been silently stored on Repository for months. Turns hidden math into a trust signal. #}

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

All 958 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`fixture`	software	healthy	`test/sanity.test.js:fixture`
`genOperation`	software	healthy	`test/governance/TimelockController.test.js:genOperation`
`genOperationBatch`	software	healthy	`test/governance/TimelockController.test.js:genOperationBatch`
`fixture`	software	healthy	`test/governance/TimelockController.test.js:fixture`
`reverts`	software	healthy	`test/governance/TimelockController.test.js:reverts`
`deployToken`	software	healthy	`test/governance/Governor.test.js:deployToken`
`fixture`	software	healthy	`test/governance/Governor.test.js:fixture`
`tamper`	software	healthy	`test/governance/Governor.test.js:tamper`
`shouldPropose`	software	healthy	`test/governance/Governor.test.js:shouldPropose`
`shouldBehaveLikeERC6372`	software	healthy	`test/governance/utils/ERC6372.behavior.js:shouldBehaveLikeE…`
`fixture`	software	healthy	`test/governance/utils/VotesExtended.test.js:fixture`
`fixture`	software	healthy	`test/governance/utils/Votes.test.js:fixture`
`shouldBehaveLikeVotes`	software	healthy	`test/governance/utils/Votes.behavior.js:shouldBehaveLikeVot…`
`expiry`	software	healthy	`test/governance/utils/Votes.behavior.js:expiry`
`fixture`	software	healthy	`test/governance/extensions/GovernorCountingOverridable.test…`
`fixture`	software	healthy	`test/governance/extensions/GovernorNoncesKeyed.test.js:fixt…`
`tamper`	software	healthy	`test/governance/extensions/GovernorNoncesKeyed.test.js:tamp…`
`fixture`	software	healthy	`test/governance/extensions/GovernorERC721.test.js:fixture`
`fixture`	software	healthy	`test/governance/extensions/GovernorTimelockCompound.test.js…`
`eta`	software	healthy	`test/governance/extensions/GovernorTimelockCompound.test.js…`
`deployToken`	software	healthy	`test/governance/extensions/GovernorSequentialProposalId.tes…`
`fixture`	software	healthy	`test/governance/extensions/GovernorSequentialProposalId.tes…`
`fixture`	software	healthy	`test/governance/extensions/GovernorStorage.test.js:fixture`
`fixture`	software	healthy	`test/governance/extensions/GovernorVotesQuorumFraction.test…`
`fixture`	software	healthy	`test/governance/extensions/GovernorVotesSuperQuorumFraction…`
`fixture`	software	healthy	`test/governance/extensions/GovernorTimelockControl.test.js:…`
`eta`	software	healthy	`test/governance/extensions/GovernorTimelockControl.test.js:…`
`fixture`	software	healthy	`test/governance/extensions/GovernorCountingFractional.test.…`
`fixture`	software	healthy	`test/governance/extensions/GovernorCrosschain.test.js:fixtu…`
`fixture`	software	healthy	`test/governance/extensions/GovernorProposalGuardian.test.js…`
`fixture`	software	healthy	`test/governance/extensions/GovernorPreventLateQuorum.test.j…`
`voteStart`	software	healthy	`test/governance/extensions/GovernorPreventLateQuorum.test.j…`
`voteEnd`	software	healthy	`test/governance/extensions/GovernorPreventLateQuorum.test.j…`
`snapshotTimepoint`	software	healthy	`test/governance/extensions/GovernorPreventLateQuorum.test.j…`
`deadlineTimepoint`	software	healthy	`test/governance/extensions/GovernorPreventLateQuorum.test.j…`
`extendedDeadline`	software	healthy	`test/governance/extensions/GovernorPreventLateQuorum.test.j…`
`fixture`	software	healthy	`test/governance/extensions/GovernorSuperQuorum.test.js:fixt…`
`prepareOperation`	software	healthy	`test/governance/extensions/GovernorTimelockAccess.test.js:p…`
`fixture`	software	healthy	`test/governance/extensions/GovernorTimelockAccess.test.js:f…`
`setAccessManagerIgnored`	software	healthy	`test/governance/extensions/GovernorTimelockAccess.test.js:s…`
`fixture`	software	healthy	`test/governance/extensions/GovernorWithParams.test.js:fixtu…`
`fixture`	software	healthy	`test/metatx/ERC2771Context.test.js:fixture`
`prepareAndSignRequest`	software	healthy	`test/metatx/ERC2771Context.test.js:prepareAndSignRequest`
`fixture`	software	healthy	`test/metatx/ERC2771Forwarder.test.js:fixture`
`forgeRequest`	software	healthy	`test/metatx/ERC2771Forwarder.test.js:forgeRequest`
`shouldBehaveLikeERC20`	software	healthy	`test/token/ERC20/ERC20.behavior.js:shouldBehaveLikeERC20`
`shouldBehaveLikeERC20Transfer`	software	healthy	`test/token/ERC20/ERC20.behavior.js:shouldBehaveLikeERC20Tra…`
`shouldBehaveLikeERC20Approve`	software	healthy	`test/token/ERC20/ERC20.behavior.js:shouldBehaveLikeERC20App…`
`fixture`	software	healthy	`test/token/ERC20/ERC20.test.js:fixture`
`fixture`	software	healthy	`test/token/ERC20/utils/SafeERC20.test.js:fixture`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`slither.config.json`	software	healthy	`slither.config.json`
`hardhat.config.js`	software	warning	`hardhat.config.js`
`renovate.json`	software	healthy	`renovate.json`
`README.md`	software	healthy	`README.md`
`netlify.toml`	software	healthy	`netlify.toml`
`package.json`	software	healthy	`package.json`
`solhint.config.js`	software	warning	`solhint.config.js`
`CONTRIBUTING.md`	software	healthy	`CONTRIBUTING.md`
`package-lock.json`	software	healthy	`package-lock.json`
`.solcover.js`	software	warning	`.solcover.js`
`FUNDING.json`	software	healthy	`FUNDING.json`
`RELEASING.md`	software	healthy	`RELEASING.md`
`CODE_OF_CONDUCT.md`	software	healthy	`CODE_OF_CONDUCT.md`
`SECURITY.md`	software	healthy	`SECURITY.md`
`CHANGELOG.md`	software	healthy	`CHANGELOG.md`
`foundry.toml`	software	healthy	`foundry.toml`
`.mocharc.js`	software	warning	`.mocharc.js`
`GUIDELINES.md`	software	healthy	`GUIDELINES.md`
`.codecov.yml`	software	healthy	`.codecov.yml`
`TESTING.md`	software	healthy	`test/TESTING.md`
`sanity.test.js`	software	healthy	`test/sanity.test.js`
`TimelockController.test.js`	software	healthy	`test/governance/TimelockController.test.js`
`Governor.test.js`	software	healthy	`test/governance/Governor.test.js`
`ERC6372.behavior.js`	software	healthy	`test/governance/utils/ERC6372.behavior.js`
`VotesExtended.test.js`	software	healthy	`test/governance/utils/VotesExtended.test.js`
`Votes.test.js`	software	healthy	`test/governance/utils/Votes.test.js`
`Votes.behavior.js`	software	healthy	`test/governance/utils/Votes.behavior.js`
`GovernorCountingOverridable.test.js`	software	healthy	`test/governance/extensions/GovernorCountingOverridable.test…`
`GovernorNoncesKeyed.test.js`	software	healthy	`test/governance/extensions/GovernorNoncesKeyed.test.js`
`GovernorERC721.test.js`	software	healthy	`test/governance/extensions/GovernorERC721.test.js`
`GovernorTimelockCompound.test.js`	software	healthy	`test/governance/extensions/GovernorTimelockCompound.test.js`
`GovernorSequentialProposalId.test.js`	software	healthy	`test/governance/extensions/GovernorSequentialProposalId.tes…`
`GovernorStorage.test.js`	software	healthy	`test/governance/extensions/GovernorStorage.test.js`
`GovernorVotesQuorumFraction.test.js`	software	healthy	`test/governance/extensions/GovernorVotesQuorumFraction.test…`
`GovernorVotesSuperQuorumFraction.test.js`	software	healthy	`test/governance/extensions/GovernorVotesSuperQuorumFraction…`
`GovernorTimelockControl.test.js`	software	healthy	`test/governance/extensions/GovernorTimelockControl.test.js`
`GovernorCountingFractional.test.js`	software	healthy	`test/governance/extensions/GovernorCountingFractional.test.…`
`GovernorCrosschain.test.js`	software	healthy	`test/governance/extensions/GovernorCrosschain.test.js`
`GovernorProposalGuardian.test.js`	software	healthy	`test/governance/extensions/GovernorProposalGuardian.test.js`
`GovernorPreventLateQuorum.test.js`	software	healthy	`test/governance/extensions/GovernorPreventLateQuorum.test.js`
`GovernorSuperQuorum.test.js`	software	healthy	`test/governance/extensions/GovernorSuperQuorum.test.js`
`GovernorTimelockAccess.test.js`	software	healthy	`test/governance/extensions/GovernorTimelockAccess.test.js`
`GovernorWithParams.test.js`	software	healthy	`test/governance/extensions/GovernorWithParams.test.js`
`ERC2771Context.test.js`	software	healthy	`test/metatx/ERC2771Context.test.js`
`ERC2771Forwarder.test.js`	software	healthy	`test/metatx/ERC2771Forwarder.test.js`
`ERC20.behavior.js`	software	healthy	`test/token/ERC20/ERC20.behavior.js`
`ERC20.test.js`	software	healthy	`test/token/ERC20/ERC20.test.js`
`SafeERC20.test.js`	software	healthy	`test/token/ERC20/utils/SafeERC20.test.js`
`draft-ERC20Bridgeable.test.js`	software	healthy	`test/token/ERC20/extensions/draft-ERC20Bridgeable.test.js`
`draft-ERC20TemporaryApproval.test.js`	software	healthy	`test/token/ERC20/extensions/draft-ERC20TemporaryApproval.te…`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`test`	software	healthy	`test`
`governance`	software	healthy	`test/governance`
`utils`	software	healthy	`test/governance/utils`
`extensions`	software	healthy	`test/governance/extensions`
`metatx`	software	healthy	`test/metatx`
`token`	software	healthy	`test/token`
`ERC20`	software	healthy	`test/token/ERC20`
`utils`	software	healthy	`test/token/ERC20/utils`
`extensions`	software	healthy	`test/token/ERC20/extensions`
`common`	software	healthy	`test/token/common`
`ERC1155`	software	healthy	`test/token/ERC1155`
`utils`	software	healthy	`test/token/ERC1155/utils`
`extensions`	software	healthy	`test/token/ERC1155/extensions`
`ERC6909`	software	healthy	`test/token/ERC6909`
`extensions`	software	healthy	`test/token/ERC6909/extensions`
`ERC721`	software	healthy	`test/token/ERC721`
`utils`	software	healthy	`test/token/ERC721/utils`
`extensions`	software	healthy	`test/token/ERC721/extensions`
`access`	software	healthy	`test/access`
`manager`	software	healthy	`test/access/manager`
`extensions`	software	healthy	`test/access/extensions`
`utils`	software	healthy	`test/utils`
`types`	software	healthy	`test/utils/types`
`structs`	software	healthy	`test/utils/structs`
`cryptography`	software	healthy	`test/utils/cryptography`
`introspection`	software	healthy	`test/utils/introspection`
`math`	software	healthy	`test/utils/math`
`crosschain`	software	healthy	`test/crosschain`
`proxy`	software	healthy	`test/proxy`
`beacon`	software	healthy	`test/proxy/beacon`
`utils`	software	healthy	`test/proxy/utils`
`transparent`	software	healthy	`test/proxy/transparent`
`ERC1967`	software	healthy	`test/proxy/ERC1967`
`finance`	software	healthy	`test/finance`
`helpers`	software	healthy	`test/helpers`
`account`	software	healthy	`test/account`
`utils`	software	healthy	`test/account/utils`
`extensions`	software	healthy	`test/account/extensions`
`examples`	software	healthy	`test/account/examples`
`audits`	software	healthy	`audits`
`docs`	software	healthy	`docs`
`templates`	software	healthy	`docs/templates`
`scripts`	software	healthy	`scripts`
`generate`	software	healthy	`scripts/generate`
`templates`	software	healthy	`scripts/generate/templates`
`helpers`	software	healthy	`scripts/generate/helpers`
`release`	software	healthy	`scripts/release`
`workflow`	software	healthy	`scripts/release/workflow`
`upgradeable`	software	healthy	`scripts/upgradeable`
`checks`	software	healthy	`scripts/checks`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`lint`	cicd	healthy	`.github/workflows/checks.yml`
`tests`	cicd	healthy	`.github/workflows/checks.yml`
`tests-upgradeable`	cicd	healthy	`.github/workflows/checks.yml`
`tests-foundry`	cicd	healthy	`.github/workflows/checks.yml`
`coverage`	cicd	healthy	`.github/workflows/checks.yml`
`harnesses`	cicd	healthy	`.github/workflows/checks.yml`
`slither`	cicd	healthy	`.github/workflows/checks.yml`
`codespell`	cicd	healthy	`.github/workflows/checks.yml`
`state`	cicd	healthy	`.github/workflows/release-cycle.yml`
`start`	cicd	healthy	`.github/workflows/release-cycle.yml`
`promote`	cicd	healthy	`.github/workflows/release-cycle.yml`
`changesets`	cicd	healthy	`.github/workflows/release-cycle.yml`
`publish`	cicd	healthy	`.github/workflows/release-cycle.yml`
`integrity_check`	cicd	healthy	`.github/workflows/release-cycle.yml`
`merge`	cicd	healthy	`.github/workflows/release-cycle.yml`
`build`	cicd	healthy	`.github/workflows/docs.yml`
`check`	cicd	healthy	`.github/workflows/changeset.yml`
`apply-diff`	cicd	healthy	`.github/workflows/formal-verification.yml`
`verify`	cicd	healthy	`.github/workflows/formal-verification.yml`
`halmos`	cicd	healthy	`.github/workflows/formal-verification.yml`
`transpile`	cicd	healthy	`.github/workflows/upgradeable.yml`
`state`	cicd	healthy	`.github/workflows/release-upgradeable.yml`
`publish`	cicd	healthy	`.github/workflows/release-upgradeable.yml`
`integrity_check`	cicd	healthy	`.github/workflows/release-upgradeable.yml`
`lint`	cicd	healthy	`.github/workflows/actionlint.yml`

Label	Layer	Status	Path
`GovernorHelper`	software	healthy	`test/helpers/governance.js:GovernorHelper`
`NonNativeSigner`	software	healthy	`test/helpers/signers.js:NonNativeSigner`
`P256SigningKey`	software	healthy	`test/helpers/signers.js:P256SigningKey`
`RSASigningKey`	software	healthy	`test/helpers/signers.js:RSASigningKey`
`RSASHA256SigningKey`	software	healthy	`test/helpers/signers.js:RSASHA256SigningKey`
`WebAuthnSigningKey`	software	healthy	`test/helpers/signers.js:WebAuthnSigningKey`
`MultiERC7913SigningKey`	software	healthy	`test/helpers/signers.js:MultiERC7913SigningKey`
`UserOperation`	software	healthy	`test/helpers/erc4337.js:UserOperation`
`ERC4337Helper`	software	healthy	`test/helpers/erc4337.js:ERC4337Helper`
`SmartAccount`	software	healthy	`test/helpers/erc4337.js:SmartAccount`
`EIP7702SmartAccount`	software	healthy	`test/helpers/erc4337.js:EIP7702SmartAccount`
`UserOperationWithContext`	software	healthy	`test/helpers/erc4337.js:UserOperationWithContext`
`ERC7739Signer`	software	healthy	`test/helpers/erc7739.js:ERC7739Signer`
`ERC4337Utils`	software	healthy	`test/helpers/erc7739.js:ERC4337Utils`
`BlockTries`	software	healthy	`test/helpers/trie.js:BlockTries`
`of`	software	healthy	`scripts/generate/templates/SafeCast.js:of`
`class`	software	healthy	`scripts/checks/compareGasReports.js:class`
`Base`	software	healthy	`scripts/solhint-custom/index.js:Base`
`extends`	software	healthy	`scripts/solhint-custom/index.js:extends`

Label	Layer	Status	Path
`gha::checks`	cicd	healthy	`.github/workflows/checks.yml`
`gha::release-cycle`	cicd	healthy	`.github/workflows/release-cycle.yml`
`gha::docs`	cicd	healthy	`.github/workflows/docs.yml`
`gha::changeset`	cicd	healthy	`.github/workflows/changeset.yml`
`gha::formal-verification`	cicd	healthy	`.github/workflows/formal-verification.yml`
`gha::upgradeable`	cicd	healthy	`.github/workflows/upgradeable.yml`
`gha::release-upgradeable`	cicd	healthy	`.github/workflows/release-upgradeable.yml`
`gha::actionlint`	cicd	healthy	`.github/workflows/actionlint.yml`

Label	Layer	Status	Path
`TITLE`	cicd	healthy	`—`
`CERTORAKEY`	cicd	healthy	`—`
`CODECOV_TOKEN`	cicd	healthy	`—`
`GITHUB_TOKEN`	cicd	healthy	`—`
`GH_TOKEN_UPGRADEABLE`	cicd	healthy	`—`
`NPM_TOKEN`	cicd	healthy	`—`

Label	Layer	Status	Path
`repobility-clone-4fdk_1i5`	software	healthy	`/tmp/repobility-clone-4fdk_1i5`

{# ── 2026-05-17 Round 14: AI-agent bridge footer ────────────────────── Discoverability: the /agents/voting/ guide + MCP manifest exist but aren't linked from anywhere users actually land. Small, opt-in footer. #}

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/47a2334c-e2e2-49cc-9087-a4a6fae9320b/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/47a2334c-e2e2-49cc-9087-a4a6fae9320b/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

OpenZeppelin/openzeppelin-contracts

Complete repo analysis

function 50+

file 50+

directory 50+

job 25

class 19

pipeline 8

env_var 6

repo 1