feat: ground vuln taxonomy + audit report in real Solana audit practice

[daemon-blockint-tech]

Context

Follow-up to the merged CI PR (#6). The goal here was to make ARES's output resemble how real Solana audits are actually done and reported, using canonical public sources — Sealevel Attacks, Neodyme's common pitfalls, the solsec corpus, the Neodyme workshop, and the empirical multi-auditor study of 1,669 findings — and, along the way, to close the outstanding dependency-security and test-coverage gaps.

What changed

1. Vulnerability taxonomy — grounded in real audit practice

src/knowledge/solana-vulns.ts: 20 → 28 classes. Added 8 professionally-recognized classes the catalog was missing, each with detection hints, remediation, and references:

• type-cosplay (account/type confusion — Sealevel Add opt-in Computer Use Agent (CUA) investigation analyzer #3, Neodyme)
• unsafe-type-cast (unchecked as truncation — Neodyme)
• missing-slippage-protection (front-running/MEV — the dominant DeFi finding)
• denial-of-service (compute exhaustion / account bloat)
• business-logic-error (accounting/state-machine — empirically the single largest finding category)
• upgrade-authority-risk (program-upgrade centralization)
• token-2022-extension-risk (transfer hooks / fees / permanent delegate)
• remaining-accounts-validation (unvalidated ctx.remaining_accounts)

2. Severity methodology + professional report format

• New src/knowledge/severity.ts — the industry impact × likelihood severity matrix, per-level definitions, a deterministic severity-distribution counter, a markdown severity-summary table, and stable finding-ID formatting (ARES-001…).
• REPORT prompt + node rewritten to emit a professional assessment: executive summary with a severity table, scope & methodology, severity classification, findings summary table, per-finding description / impact / recommendation / evidence, coverage, and a disclaimer. Counts and IDs are computed in-node so the headline numbers can't be hallucinated.

3. Dependency security

• npm overrides pinning uuid ^11.1.1, clearing the moderate uuid → jayson → @solana/web3.js advisory chain. npm audit: 8 advisories → 3.
• New SECURITY.md documenting the reporting process, ARES's read-only runtime posture, the resolved uuid advisory, and the accepted residual bigint-buffer advisory (no upstream fix; availability-only CVSS; unreachable with adversarial input given read-only RPC parsing).

4. Test coverage

+20 tests (31 → 51). New suites for the severity module, the previously-untested crystalline-store (round-trip, recall, activation, spreading activation, consolidation promotion), and retrieval/synthCrystal.

Verification

typecheck  ✓
lint       ✓
test       ✓  7 files, 51 tests
build      ✓
npm audit  8 → 3 (residual = unfixable bigint-buffer)

The report node's stable IDs and deterministic severity table were additionally confirmed end-to-end against the live graph in both black-box (findings downgraded to speculative) and source modes — the table faithfully tracks the pipeline's final severities in each.

Notes

• CI intentionally does not run a blocking npm audit step — the unfixable bigint-buffer advisory would make every build red for no actionable reason. It's tracked via Dependabot and SECURITY.md instead.
• No behavior change to the analyzer fan-out, retrieval, or persistence; changes are additive (new knowledge/report structure) plus the dependency override.

🤖 Generated with Claude Code

https://claude.ai/code/session_017ZB4NjNJZ6zWTqypbSiihy

---

Generated by Claude Code