# STOX Perps — Automated Static Analysis (Slither)

**Tool:** Slither v0.10+ (Trail of Bits), 102 detectors.
**Compiler:** solc 0.8.26, optimizer runs 200, viaIR=true. Remapping `@openzeppelin=node_modules/@openzeppelin` (OZ Contracts 5.4.0).
**Source:** verified bytecode recovered from Blockscout on 2026‑10‑22 (byte‑identical to Robinhood Chain mainnet, chainId 4663).
**What this is:** the raw output of a public third‑party analysis tool plus a line‑by‑line triage. It is **not** a certified audit by an audit firm and must not be presented as one.

Reproduce:
```
solc-select use 0.8.26
npm i @openzeppelin/contracts@5.4.0
slither contracts/<Name>.sol \
  --solc-remaps "@openzeppelin=node_modules/@openzeppelin" \
  --solc-args "--optimize --optimize-runs 200 --via-ir"
```

---

## Results by contract

| Contract | High | Medium | Low | Info | Opt |
|---|---|---|---|---|---|
| Exchange | 1 | 24 | 71 | 63 | 1 |
| PriceRelay | 1 | 12 | 12 | 25 | — |
| HouseShare | 0 | 5 | 15 | 11 | — |
| Staking | 1 | 2 | 17 | 18 | 3 |
| Reserve | 0 | 1 | 6 | 12 | — |
| Treasury | 2 | 1 | 7 | 9 | — |

`SessionRouter` could not be auto‑compiled from the recovered flattened source (a Blockscout flattening artifact turned `new bool[](n)` into `new bool`); it was reviewed manually in AUDIT.md and is unaffected.

---

## High findings — triage

All five "High" flags are detector heuristics; each was checked against the code. None is an exploitable loss of funds.

1. **Exchange `_drawReserve()` reentrancy-balance** — the external call is `reserve.pull()` into our own Reserve, the whole function is `nonReentrant`, and balances are read before/after with a `require(... >= drawn)` check. Guarded. **Not exploitable.**
2. **PriceRelay `incorrect-exp` (Math.mulDiv)** — false positive inside OpenZeppelin's `Math.sol` (`^` is used in a comment/annotation context the detector misreads). OZ library code, not ours. **False positive.**
3. **Staking `claim()` reentrancy-eth** — `claim()` is `nonReentrant`; pending is zeroed before the ETH send (checks‑effects‑interactions). Guarded. **Not exploitable.**
4. **Treasury `arbitrary-send-eth` (×2)** — by design: `distribute()` sends to the *fixed* sinks (Reserve/Buyback/Staking) set by the owner, along a hard‑coded waterfall; there is no caller‑controlled recipient. The owner cannot withdraw. **By design, not a vulnerability.**

## Medium findings — triage (categories)

- **divide-before-multiply (Exchange, HouseShare, OZ Math):** intentional fixed‑point math (1e18/1e8 scaling); ordering chosen to keep precision within tolerance. The OZ `Math.mulDiv`/`invMod` hits are library internals. **Accepted / false positive.**
- **incorrect-equality (`== 0` / strict equals):** all are zero‑checks on counters or balances (`amount == 0`, `totalShares == 0`, queue emptiness) — safe by construction, not price/threshold comparisons. **Accepted.**
- **reentrancy-no-eth (Exchange `_settle` / `_executeOpen` / `_drawReserve`):** state effects complete before external token transfers; all external entry points are `nonReentrant` and use SafeERC20. **Guarded.**
- **uninitialized-local (Exchange `_settle` outputs, PriceRelay `_verifyQuorum` loop vars, Staking `penalty`):** Solidity zero‑initializes these; each is assigned before use. **Not a bug.**
- **unused-return (PriceRelay Chainlink read, Reserve `weth.approve`):** return values intentionally ignored; the Chainlink read is wrapped in try/catch and the breaker degrades safely if the feed is unavailable. **Accepted.**

---

## Conclusion

Slither surfaced **no exploitable fund‑loss issue**. Every High/Medium flag is either a guarded pattern (`nonReentrant` + checks‑effects‑interactions + SafeERC20), an intentional design choice (Treasury waterfall, fixed‑point ordering), or a library/false‑positive. This agrees with the manual review in `AUDIT.md`: custody is sound (no owner‑drain path on the pool); the principal *trust* risk is the price‑relayer quorum (AUDIT.md H‑1), which Slither does not evaluate because it is an operational/economic property, not a code bug.

*Raw per‑contract JSON: `protocol/*-slither.json`. This is automated tooling output, not a certified third‑party audit.*