D1
Access Control
Permission models, admin surface, reentrancy protection, and authorization boundaries. #1 exploit vector by dollar loss in DeFi history.
Weight 18%88% confidence
42
Concerning
info
How This Score Is Built
Permission models, admin surface, reentrancy protection, and authorization boundaries. #1 exploit vector by dollar loss in DeFi history.
+23Strong positive
+12Positive
+5Slight positive
−15Strong negative
−8Negative
−3Slight negative
Scoring Tree
BRI Formula
300 + 700 × ∏(Dᵢ/100)^wᵢ
617
Current BRI
D1Access Control
Weight 18%
42
(42/100)^0.18 = 0.8554
Contributing Factors
+10F1 class: inspect()-vs-build() systemic parameter binding gap across 6 hooks
+10Manager can substitute critical calldata (dstChainId, recipient, lltv, outputAmount)
+106 sub-findings (F1a-F1f) with validated PoCs — 10 lens hits across 4 agents
+10F1a composes with ACK'd H-3.1.2 for SuperPosition supply inflation (Critical)
-58Manager-as-strategist trust boundary is load-bearing with no on-chain enforcement
Score Composition
-58
Manager-as-strategist trust boundary is load-bearing with no on-chain enforcement
+10
F1 class: inspect()-vs-build() systemic parameter binding gap across 6 hooks
+10
Manager can substitute critical calldata (dstChainId, recipient, lltv, outputAmount)
+10
6 sub-findings (F1a-F1f) with validated PoCs — 10 lens hits across 4 agents
+10
F1a composes with ACK'd H-3.1.2 for SuperPosition supply inflation (Critical)
Evidence Chain (2 files)
GitHub APIMay 17, 2026, 06:58 PM
open_in_newGitHub (/)sha256:9a5a6974bc2e...
BlackHart AnalysisMay 13, 2026, 11:45 PM
open_in_newAccess Control — Source Codesha256:d2dd55c42db0...
Score History
No dimension-level score changes recorded yet.
Methodology: 2.1Formula: 1.1Weights: 1.1