{"data":{"id":"pa_88e9978a36acb1b2","slug":"aave-v3-base","status":"complete","visibility":"public","featured":true,"protocol":"Aave v3 (Base Pool)","chainId":8453,"forkBlock":"52676275","score":83,"grade":"B","summary":{"cap":null,"cases":50,"flows":{"executed":5,"requested":5},"grade":"B","score":83,"findings":{"low":4,"high":1,"info":2,"medium":1,"critical":0},"forkBlock":"52676275","carefulSuccess":5},"reportHash":"0x000dc13e2f33a0d2acc4fc5d8d4599d8f32d3eba408c4cd6cb4fdedb9905a233","configHash":"0xab4d138249caa765cf1d118b1ce5f3fd4188453a736e072753789f44cf0ee68e","attestation":{"uid":"0xb0cb868ab5b32038da51fefc8eb9e08c4197fc70e5bcdc8a3a69383d4cb29fd1","tx":"0x80cbaf3c27b138471d43d14b8fb32d2bf4c1c7569fc91e6909ef9e784bf5cb1a","network":"eip155:11155111","url":"https://sepolia.easscan.org/attestation/view/0xb0cb868ab5b32038da51fefc8eb9e08c4197fc70e5bcdc8a3a69383d4cb29fd1"},"createdAt":"2026-10-16T09:09:31.242Z","startedAt":"2026-10-16T09:12:10.800Z","finishedAt":"2026-10-16T09:15:51.917Z","position":0,"error":null,"followups":[],"report":{"fork":{"block":"52676275","timestamp":"1792141897"},"score":{"cap":null,"grade":"B","total":83,"components":[{"id":"completion","title":"Task completion","detail":"5 of 5 executed flows completed by the careful agent","points":30,"weight":30},{"id":"naive_safety","title":"Safety for a naive agent","detail":"no price-sensitive flow in the config: no price-move exposure measured (full marks by construction)","points":25,"weight":25},{"id":"input_hardening","title":"Input hardening","detail":"0 of 25 weighted probe points were accepted unsafely","points":15,"weight":15},{"id":"error_legibility","title":"Error legibility","detail":"mean revert legibility 0.14 over 10 reverts raised by the protocol (7 raised by tokens not counted)","points":1.4,"weight":10},{"id":"approval_surface","title":"Approval surface","detail":"spender is upgradeable; 1 signature-accepting function(s)","points":6,"weight":10},{"id":"interface_clarity","title":"Interface clarity","detail":"7 static interface finding(s)","points":6,"weight":10}]},"tasks":[{"id":"supply-usdc","args":["$tokenIn","$amountIn","$onBehalf","0"],"kind":"deposit","notes":[],"title":"Deposit 1000 USDC on Pool","amount":"1000000000 base units of USDC","checks":["USDC balance decreases","aUSDC balance increases"],"origin":"aave-v3 supply","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"Pool (0xA238Dd80C259a72e81d7e4664a9801593F98d1c5)","function":"supply(address,uint256,address,uint16)","requires":[],"tokenOut":null,"approvals":[{"token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","spender":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5"}],"instruction":"Deposit 1000 USDC into Aave v3 (Base Pool) (Pool at 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 on Base) so that your wallet holds a position in it. Done when your USDC balance has decreased by 1000 and your position (receipt token or recorded balance) has increased."},{"id":"withdraw-usdc","args":["$tokenIn","$amountIn","$recipient"],"kind":"withdraw","notes":["position-reducing or borrowing flow: nothing is approved"],"title":"Withdraw 500 USDC on Pool","amount":"500000000 base units of USDC","checks":["USDC balance increases","aUSDC balance decreases"],"origin":"aave-v3 withdraw","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"Pool (0xA238Dd80C259a72e81d7e4664a9801593F98d1c5)","function":"withdraw(address,uint256,address)","requires":["supply-usdc"],"tokenOut":null,"approvals":[],"instruction":"Withdraw 500 USDC from your existing position in Aave v3 (Base Pool) (Pool at 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 on Base) back to your own wallet. Done when your USDC balance has increased and your position has decreased."},{"id":"supply-weth","args":["$tokenIn","$amountIn","$onBehalf","0"],"kind":"deposit","notes":[],"title":"Deposit 1 WETH on Pool","amount":"1000000000000000000 base units of WETH","checks":["WETH balance decreases","aWETH balance increases"],"origin":"aave-v3 supply","tokenIn":{"symbol":"WETH","address":"0x4200000000000000000000000000000000000006","decimals":18},"contract":"Pool (0xA238Dd80C259a72e81d7e4664a9801593F98d1c5)","function":"supply(address,uint256,address,uint16)","requires":[],"tokenOut":null,"approvals":[{"token":"0x4200000000000000000000000000000000000006","spender":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5"}],"instruction":"Deposit 1 WETH into Aave v3 (Base Pool) (Pool at 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 on Base) so that your wallet holds a position in it. Done when your WETH balance has decreased by 1 and your position (receipt token or recorded balance) has increased."},{"id":"borrow-usdc","args":["$tokenIn","$amountIn","2","0","$onBehalf"],"kind":"borrow","notes":["position-reducing or borrowing flow: nothing is approved"],"title":"Borrow 500 USDC on Pool","amount":"500000000 base units of USDC","checks":["USDC balance increases","variable debt of USDC increases"],"origin":"aave-v3 borrow (variable rate)","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"Pool (0xA238Dd80C259a72e81d7e4664a9801593F98d1c5)","function":"borrow(address,uint256,uint256,uint16,address)","requires":["supply-weth"],"tokenOut":null,"approvals":[],"instruction":"Borrow 500 USDC from Aave v3 (Base Pool) (Pool at 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 on Base) against the collateral you have already supplied. Done when your USDC balance has increased and your debt position has increased."},{"id":"repay-usdc","args":["$tokenIn","$amountIn","2","$onBehalf"],"kind":"repay","notes":[],"title":"Repay 250 USDC on Pool","amount":"250000000 base units of USDC","checks":["USDC balance decreases","variable debt of USDC decreases"],"origin":"aave-v3 repay (variable rate)","tokenIn":{"symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6},"contract":"Pool (0xA238Dd80C259a72e81d7e4664a9801593F98d1c5)","function":"repay(address,uint256,uint256,address)","requires":["borrow-usdc"],"tokenOut":null,"approvals":[{"token":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","spender":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5"}],"instruction":"Repay 250 USDC of your debt in Aave v3 (Base Pool) (Pool at 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 on Base). Done when your USDC balance has decreased and your debt position has decreased."}],"static":[{"errors":11,"events":16,"address":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5","contract":"Pool","userFacing":[{"flags":["no-return","sentinel-params"],"inputs":5,"outputs":0,"selector":"0xa415bcad","signature":"borrow(address,uint256,uint256,uint16,address)","mutability":"nonpayable"},{"flags":["no-return"],"inputs":1,"outputs":0,"selector":"0xd5eed868","signature":"borrow(bytes32)","mutability":"nonpayable"},{"flags":["no-return","sentinel-params"],"inputs":4,"outputs":0,"selector":"0xe8eda9df","signature":"deposit(address,uint256,address,uint16)","mutability":"nonpayable"},{"flags":["no-return","sentinel-params"],"inputs":7,"outputs":0,"selector":"0xab9c4b5d","signature":"flashLoan(address,address[],uint256[],uint256[],address,bytes,uint16)","mutability":"nonpayable"},{"flags":["no-return","sentinel-params"],"inputs":5,"outputs":0,"selector":"0x42b0b77c","signature":"flashLoanSimple(address,address,uint256,bytes,uint16)","mutability":"nonpayable"},{"flags":["no-return"],"inputs":5,"outputs":0,"selector":"0x00a718a9","signature":"liquidationCall(address,address,address,uint256,bool)","mutability":"nonpayable"},{"flags":["no-return"],"inputs":2,"outputs":0,"selector":"0xfd21ecff","signature":"liquidationCall(bytes32,bytes32)","mutability":"nonpayable"},{"flags":[],"inputs":1,"outputs":1,"selector":"0x563dd613","signature":"repay(bytes32)","mutability":"nonpayable"},{"flags":[],"inputs":4,"outputs":1,"selector":"0x573ade81","signature":"repay(address,uint256,uint256,address)","mutability":"nonpayable"},{"flags":[],"inputs":3,"outputs":1,"selector":"0x2dad97d4","signature":"repayWithATokens(address,uint256,uint256)","mutability":"nonpayable"},{"flags":[],"inputs":1,"outputs":1,"selector":"0xdc7c0bff","signature":"repayWithATokens(bytes32)","mutability":"nonpayable"},{"flags":["permit"],"inputs":3,"outputs":1,"selector":"0x94b576de","signature":"repayWithPermit(bytes32,bytes32,bytes32)","mutability":"nonpayable"},{"flags":["permit"],"inputs":8,"outputs":1,"selector":"0xee3e210b","signature":"repayWithPermit(address,uint256,uint256,address,uint256,uint8,bytes32,bytes32)","mutability":"nonpayable"},{"flags":["no-return","sentinel-params"],"inputs":4,"outputs":0,"selector":"0x617ba037","signature":"supply(address,uint256,address,uint16)","mutability":"nonpayable"},{"flags":["no-return"],"inputs":1,"outputs":0,"selector":"0xf7a73840","signature":"supply(bytes32)","mutability":"nonpayable"},{"flags":["permit","no-return","sentinel-params"],"inputs":8,"outputs":0,"selector":"0x02c205f0","signature":"supplyWithPermit(address,uint256,address,uint16,uint256,uint8,bytes32,bytes32)","mutability":"nonpayable"},{"flags":["permit","no-return"],"inputs":3,"outputs":0,"selector":"0x680dd47c","signature":"supplyWithPermit(bytes32,bytes32,bytes32)","mutability":"nonpayable"},{"flags":[],"inputs":3,"outputs":1,"selector":"0x69328dec","signature":"withdraw(address,uint256,address)","mutability":"nonpayable"},{"flags":[],"inputs":1,"outputs":1,"selector":"0x8e19899e","signature":"withdraw(bytes32)","mutability":"nonpayable"}],"stateChanging":48,"totalFunctions":83}],"battery":{"cases":50,"agents":[{"id":"careful","title":"Careful","behaviour":"Approves exactly the amount, simulates before sending, bounds output at the quote minus 0.5%, sets a 20-minute deadline, verifies the result on chain and revokes leftover allowance."},{"id":"naive","title":"Naive","behaviour":"Approves the maximum, accepts any output, sets a far-future deadline, never simulates, trusts the transaction status."},{"id":"max-approve","title":"Max-approve","behaviour":"Careful in everything except approving the maximum and never revoking: isolates the approval surface."},{"id":"slippage-insensitive","title":"Slippage-insensitive","behaviour":"Careful in everything except accepting any output: isolates slippage exposure."},{"id":"reentrancy-probe","title":"Re-entrancy probe","behaviour":"Careful, with the transaction's call tree analysed for calls from protocol contracts back into the agent's wallet. It does not deploy attacker contracts."},{"id":"sandwich-prone","title":"Sandwich-prone","behaviour":"Bound-less, no simulation, far deadline; run after an attacker moved the pool price, then unwound by the attacker to measure extractable value."}],"mevMoveBps":100},"caveats":["This is a measurement of how scripted agents behave on a fork of the chain at one block, not a security audit and not a guarantee. It says nothing about contract bugs outside the tested flows.","The agents are deterministic scripts, not language models. Language-model agents can behave differently; an optional LLM follow-up is queued separately when requested and is not part of this score.","Everything ran on a local Anvil fork. No transaction was sent to any real network, and no real funds were used; balances on the fork are set by writing token storage.","The price-move test pushes the pool price by same-direction swaps of the agent's own trade shape until a target move is reached. It is not a mempool or builder simulation: private order flow, bundles and priority fees are not modelled.","The re-entrancy probe analyses the call tree of the agent's transaction for calls from protocol contracts into the agent's wallet. It does not deploy attacker contracts, so absence of a finding is not proof of safety.","Flows are generated from the ABI by recognising common interface shapes. Flows that could not be generated are listed under coverage and excluded from the score; a low coverage caps the grade.","ABIs come from Sourcify or Blockscout at the time of the run, not at the fork block; a registry change after the run changes the ABI hash in a re-run (the report records it).","Fork state depends on the chosen block. Reproduction needs an archive-capable RPC for that block; liquidity, rates and contract upgrades after the block are not reflected.","The Agent Readiness Score is a fixed weighting of six components (see the methodology). It orders protocols by agent-facing interface quality under this battery; it is not a risk rating of the protocol."],"metrics":{"mev":[],"flows":[{"id":"supply-usdc","kind":"deposit","title":"Deposit 1000 USDC on Pool","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":2,"gasCareful":"268224"},{"id":"withdraw-usdc","kind":"withdraw","title":"Withdraw 500 USDC on Pool","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":1,"gasCareful":"177235"},{"id":"supply-weth","kind":"deposit","title":"Deposit 1 WETH on Pool","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":2,"gasCareful":"235023"},{"id":"borrow-usdc","kind":"borrow","title":"Borrow 500 USDC on Pool","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":1,"gasCareful":"293958"},{"id":"repay-usdc","kind":"repay","title":"Repay 250 USDC on Pool","byAgent":{"naive":"success","careful":"success","max-approve":"success","sandwich-prone":"success","reentrancy-probe":"success","slippage-insensitive":"success"},"careful":"success","txCareful":2,"gasCareful":"212853"}],"agents":[{"id":"careful","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"1187293","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"},{"id":"naive","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"1199253","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"unlimited"},{"id":"max-approve","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"1199253","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"unlimited"},{"id":"slippage-insensitive","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"1187233","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"},{"id":"reentrancy-probe","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"1187293","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"},{"id":"sandwich-prone","flows":5,"refused":0,"success":5,"txTotal":8,"gasTotal":"1187293","reverted":0,"checkFailed":0,"fundsAtRisk":null,"unsupported":0,"worstLossBps":null,"approvalResidual":"none"}],"probes":[{"probe":"zero-amount","title":"zero-amount","caseId":"supply-usdc.prober.zero-amount","flowId":"supply-usdc","revert":"unknown error 0x2c5211c6 (not in the published ABI)","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"supply-usdc.prober.dust-amount","flowId":"supply-usdc","revert":"unknown error 0x2c5211c6 (not in the published ABI)","verdict":"rejected"},{"probe":"no-approval","title":"no-approval","caseId":"supply-usdc.prober.no-approval","flowId":"supply-usdc","revert":"Error(\"ERC20: transfer amount exceeds allowance\")","verdict":"rejected"},{"probe":"overspend","title":"overspend","caseId":"supply-usdc.prober.overspend","flowId":"supply-usdc","revert":"Error(\"ERC20: transfer amount exceeds balance\")","verdict":"rejected"},{"probe":"non-contract-token","title":"non-contract-token","caseId":"supply-usdc.prober.non-contract-token","flowId":"supply-usdc","revert":"(empty revert)","verdict":"rejected"},{"probe":"zero-amount","title":"zero-amount","caseId":"withdraw-usdc.prober.zero-amount","flowId":"withdraw-usdc","revert":"unknown error 0x2c5211c6 (not in the published ABI)","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"withdraw-usdc.prober.dust-amount","flowId":"withdraw-usdc","revert":null,"verdict":"accepted"},{"probe":"zero-recipient","title":"zero-recipient","caseId":"withdraw-usdc.prober.zero-recipient","flowId":"withdraw-usdc","revert":"Error(\"ERC20: transfer to the zero address\")","verdict":"rejected"},{"probe":"zero-amount","title":"zero-amount","caseId":"supply-weth.prober.zero-amount","flowId":"supply-weth","revert":"unknown error 0x2c5211c6 (not in the published ABI)","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"supply-weth.prober.dust-amount","flowId":"supply-weth","revert":"unknown error 0x2c5211c6 (not in the published ABI)","verdict":"rejected"},{"probe":"no-approval","title":"no-approval","caseId":"supply-weth.prober.no-approval","flowId":"supply-weth","revert":"(empty revert)","verdict":"rejected"},{"probe":"overspend","title":"overspend","caseId":"supply-weth.prober.overspend","flowId":"supply-weth","revert":"(empty revert)","verdict":"rejected"},{"probe":"non-contract-token","title":"non-contract-token","caseId":"supply-weth.prober.non-contract-token","flowId":"supply-weth","revert":"(empty revert)","verdict":"rejected"},{"probe":"zero-amount","title":"zero-amount","caseId":"borrow-usdc.prober.zero-amount","flowId":"borrow-usdc","revert":"unknown error 0x2c5211c6 (not in the published ABI)","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"borrow-usdc.prober.dust-amount","flowId":"borrow-usdc","revert":null,"verdict":"accepted"},{"probe":"zero-amount","title":"zero-amount","caseId":"repay-usdc.prober.zero-amount","flowId":"repay-usdc","revert":"unknown error 0x2c5211c6 (not in the published ABI)","verdict":"rejected"},{"probe":"dust-amount","title":"dust-amount","caseId":"repay-usdc.prober.dust-amount","flowId":"repay-usdc","revert":"unknown error 0x2075cc10 (not in the published ABI)","verdict":"rejected"},{"probe":"no-approval","title":"no-approval","caseId":"repay-usdc.prober.no-approval","flowId":"repay-usdc","revert":"Error(\"ERC20: transfer amount exceeds allowance\")","verdict":"rejected"},{"probe":"overspend","title":"overspend","caseId":"repay-usdc.prober.overspend","flowId":"repay-usdc","revert":null,"verdict":"accepted"},{"probe":"non-contract-token","title":"non-contract-token","caseId":"repay-usdc.prober.non-contract-token","flowId":"repay-usdc","revert":"(empty revert)","verdict":"rejected"}],"reverts":{"total":10,"byKind":{"empty":3,"unknown_selector":7},"examples":["unknown error 0x2c5211c6 (not in the published ABI)","(empty revert)"],"external":7,"meanLegibility":0.14},"coverage":{"ratio":1,"skipped":[],"executed":5,"requested":5},"approvals":[{"flowId":"supply-usdc","spender":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5","naiveResidual":"115792089237316195423570985008687907853269984665640564039457584007912129639935","carefulResidual":"0","spenderUpgradeable":true},{"flowId":"supply-weth","spender":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5","naiveResidual":"115792089237316195423570985008687907853269984665640564039457584007913129639935","carefulResidual":"0","spenderUpgradeable":true},{"flowId":"repay-usdc","spender":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5","naiveResidual":"115792089237316195423570985008687907853269984665640564039457584007912879639935","carefulResidual":"0","spenderUpgradeable":true}],"callbacks":[{"flowId":"supply-usdc","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":7,"contractsTouched":12},{"flowId":"withdraw-usdc","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":7,"contractsTouched":13},{"flowId":"supply-weth","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":6,"contractsTouched":11},{"flowId":"borrow-usdc","toAgent":0,"withValue":0,"callbackLoops":1,"delegateCalls":11,"contractsTouched":20},{"flowId":"repay-usdc","toAgent":0,"withValue":0,"callbackLoops":0,"delegateCalls":7,"contractsTouched":11}]},"version":"karatum.protocol-readiness.v1","findings":[{"id":"dynamic:error-opacity","fix":"Use named custom errors with parameters (`error InsufficientAllowance(uint256 have, uint256 need)`) and include them in the verified ABI; avoid numeric string codes.","rule":"error-opacity","title":"Reverts are hard for an agent to act on","where":null,"detail":"10 reverts were observed across the battery; mean legibility 0.14 (1 = named custom error with parameters; 7 more reverts raised by token contracts are not counted). 10 were empty, panics or errors missing from the published ABI; the rest were short string codes. Examples: unknown error 0x2c5211c6 (not in the published ABI); (empty revert).","source":"dynamic","evidence":["supply-usdc.prober.zero-amount","supply-usdc.prober.dust-amount","supply-usdc.prober.no-approval"],"severity":"high"},{"id":"static:overload-ambiguity:packed:Pool","fix":"Give the packed variants distinct names (or ship them in a separate periphery contract/ABI) so default tool generation never exposes them.","rule":"overload-ambiguity","title":"6 functions also exist as opaque packed `bytes32` overloads","where":"Pool.borrow, liquidationCall, repay, repayWithATokens, supply, withdraw","detail":"Pool exposes borrow, liquidationCall, repay, repayWithATokens, supply, withdraw twice each: a readable variant and a packed variant whose arguments are bit-packed by an off-chain encoder (borrow(address,uint256,uint256,uint16,address) / borrow(bytes32); liquidationCall(address,address,address,uint256,bool) / liquidationCall(bytes32,bytes32); repay(bytes32) / repay(address,uint256,uint256,address); repayWithATokens(address,uint256,uint256) / repayWithATokens(bytes32) and 2 more). A tool generator that exposes ABI functions by name collides, and an agent that picks the packed variant mis-encodes silently.","source":"static","evidence":[],"severity":"medium"},{"id":"static:duplicate-entrypoints:Pool","fix":"Remove the deprecated alias from the published ABI or mark it clearly (`@deprecated`) so tool generators skip it.","rule":"duplicate-entrypoints","title":"Two names for the same action: deposit and supply","where":"Pool.deposit, supply","detail":"Pool exposes both `deposit` and `supply` with identical parameters. An agent (or a tool generator) can pick either; one of them is usually the deprecated alias.","source":"static","evidence":[],"severity":"low"},{"id":"static:overload-ambiguity:Pool","fix":"Give overloads distinct names, or document which one agents should use.","rule":"overload-ambiguity","title":"2 functions have overloads","where":"Pool.repayWithPermit, supplyWithPermit","detail":"Pool: repayWithPermit(bytes32,bytes32,bytes32) / repayWithPermit(address,uint256,uint256,address,uint256,uint8,bytes32,bytes32); supplyWithPermit(address,uint256,address,uint16,uint256,uint8,bytes32,bytes32) / supplyWithPermit(bytes32,bytes32,bytes32). An agent (or a tool generator keyed by name) can pick the wrong variant.","source":"static","evidence":[],"severity":"low"},{"id":"static:permit-surface:Pool","fix":"Document the exact EIP-712 domain and message an agent should sign, bind the permit to the protocol's own spender and an exact amount, and keep a non-signature (approve) path documented as the default.","rule":"permit-surface","title":"4 function(s) accept a signature","where":"Pool.repayWithPermit, repayWithPermit, supplyWithPermit, supplyWithPermit","detail":"repayWithPermit, repayWithPermit, supplyWithPermit, supplyWithPermit take a signature that grants spending rights. An agent that signs EIP-712 typed data it did not construct can be tricked into authorising a drain; the protocol cannot tell the two apart on chain.","source":"static","evidence":[],"severity":"low"},{"id":"static:sentinel-params:Pool","fix":"Document the neutral value in the NatSpec and the SDK, validate unexpected values with a named error, or offer an overload without the parameter.","rule":"sentinel-params","title":"6 function(s) take parameters that must stay at a sentinel value","where":"Pool.borrow, deposit, flashLoan, flashLoanSimple, supply, supplyWithPermit","detail":"borrow, deposit, flashLoan, flashLoanSimple, supply, supplyWithPermit take `referralCode`: in the common case these must be 0 or empty, and a non-sentinel value silently changes behaviour (a price limit that partially fills, a referral id, a callback into the caller) instead of reverting.","source":"static","evidence":[],"severity":"low"},{"id":"static:no-return:Pool","fix":"Return the amounts actually moved (for example `returns (uint256 assets, uint256 shares)`).","rule":"no-return","title":"11 function(s) return nothing","where":"Pool.borrow, borrow, deposit, flashLoan, flashLoanSimple, liquidationCall and 5 more","detail":"borrow, borrow, deposit, flashLoan, flashLoanSimple, liquidationCall and 5 more return no values, so an agent cannot read what happened from the call result and must parse events or re-read state.","source":"static","evidence":[],"severity":"info"},{"id":"static:upgradeable:Pool","fix":"Pin the implementation address (or its code hash) in the agent's configuration and re-check it before each session; subscribe to upgrade events.","rule":"upgradeable","title":"Behind an upgradeable proxy","where":"Pool","detail":"Pool is a EIP1967Proxy whose logic lives at 0xA4AbC5FcBA6D0d7E3D144d6dbF6cb6128599dFdB. The implementation can be replaced by the proxy admin, so an agent's tested behaviour is a property of this implementation only.","source":"static","evidence":[],"severity":"info"}],"protocol":{"name":"Aave v3 (Base Pool)","chain":"Base","chainId":8453,"docsUrl":"https://aave.com/docs/resources/addresses"},"caseIndex":[{"agent":"careful","probe":null,"caseId":"supply-usdc.careful.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0xfa2c7e1cf3da70a968ad1228ce81c90ba16e94b4ffb5b7997c5c54fcc2ce53ae","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"supply-usdc.naive.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0xd449bb5d17916938cb4d107103703f317113c69d67dfc654751668a1c77ed499","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"supply-usdc.max-approve.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0x601528aca8750c4d5f7a17577dfa40586db06a119824c39d75b77526dd4bd3b8","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"supply-usdc.slippage-insensitive.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0xd05b5434f5f0d43039b60cca68bc6503e0c6743eace5c93f5e4508aa30fae8e7","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"supply-usdc.reentrancy-probe.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0xe75e78a33e94f797c0d9bb5bea76d44124c56e4975367d34191343fcac11544c","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"supply-usdc.sandwich-prone.baseline","flowId":"supply-usdc","outcome":"success","verdict":"n/a","caseHash":"0xd8b0c5223b683e21778d437d6892cc4ffd7c6b8070555dd040ebcb83d8db328d","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"supply-usdc.prober.zero-amount","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x55fa3ac3a24e13888260267888a2c3288b72c964ded1580189d1a457d6c136db","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"supply-usdc.prober.dust-amount","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0xf027dc9e4b503c06b3147bc95a0663c13b0e0476c547ff722095a4412a3daa8e","condition":"probe"},{"agent":"prober","probe":"no-approval","caseId":"supply-usdc.prober.no-approval","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0xc685366e664535231858ae299b00dbc4d662a4ef6a1f1739f6dddd256ed9c428","condition":"probe"},{"agent":"prober","probe":"overspend","caseId":"supply-usdc.prober.overspend","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x4d2588a8ef4217cef17d7d7eaab32d65cc86a9101804c5fccc1ed57e34fcd719","condition":"probe"},{"agent":"prober","probe":"non-contract-token","caseId":"supply-usdc.prober.non-contract-token","flowId":"supply-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0xbc9c7778af6b8bb962d4db986e3f638ba70813d5fe51467073e57fb7eddd81bc","condition":"probe"},{"agent":"careful","probe":null,"caseId":"withdraw-usdc.careful.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0xa73f5fb2f51049b45335f7fb32f74973a0323a6686e7b849f8eeee772768cee9","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"withdraw-usdc.naive.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x4d77dfc07c0e4e677ce49d01a18dda94d279ff9689a94beb5745453e033c323c","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"withdraw-usdc.max-approve.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x181c49da74bba980cbee80b6ced810947b9e44fac99c020911c4ba555f3c32bf","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"withdraw-usdc.slippage-insensitive.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x1f638cce9c629e91fd581c51fb0e4cfb9cff465cd3766ce99071144cb4770792","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"withdraw-usdc.reentrancy-probe.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0x77bc74a29a8f08039c617f53f82610ea95ef502aa31933f48ae448a38445a48d","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"withdraw-usdc.sandwich-prone.baseline","flowId":"withdraw-usdc","outcome":"success","verdict":"n/a","caseHash":"0xd713e900ab82d25808292f78ace7c3230c93629c856418896c942fadba08bea5","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"withdraw-usdc.prober.zero-amount","flowId":"withdraw-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x4f3826ec96c30927a09313532ec51deade814084672d5a8a1a15df3b18c34356","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"withdraw-usdc.prober.dust-amount","flowId":"withdraw-usdc","outcome":"check_failed","verdict":"accepted","caseHash":"0x61dafb904d8c54ac733e6e1a369ddfd2cba1481790549280693d436b80bcec85","condition":"probe"},{"agent":"prober","probe":"zero-recipient","caseId":"withdraw-usdc.prober.zero-recipient","flowId":"withdraw-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0xc05a9bbc1eede7e6931fab880f82fd7725c5d272b151b7178e598ba1597ac1b2","condition":"probe"},{"agent":"careful","probe":null,"caseId":"supply-weth.careful.baseline","flowId":"supply-weth","outcome":"success","verdict":"n/a","caseHash":"0x6764c0d1bcc2e78e1975bb28b6f06e414758ad2cd35079301be14e19ef005191","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"supply-weth.naive.baseline","flowId":"supply-weth","outcome":"success","verdict":"n/a","caseHash":"0xfe8b6ed1ac9eee87f5a1e0b1c0f78c489ef563a2766b687fd93083cd1b22a054","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"supply-weth.max-approve.baseline","flowId":"supply-weth","outcome":"success","verdict":"n/a","caseHash":"0xd2f5f0d7c4dccf920c57c18b604bf88c769abe786a26388d6680afe156ab333a","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"supply-weth.slippage-insensitive.baseline","flowId":"supply-weth","outcome":"success","verdict":"n/a","caseHash":"0xbfc120b27d7738b363856b5790dad79cbdc1ca7ffd93f6a60a5cc2331c085f87","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"supply-weth.reentrancy-probe.baseline","flowId":"supply-weth","outcome":"success","verdict":"n/a","caseHash":"0xab25780096b44cb711b6ade0eaabd1d178be9db4981ec6ffc494063dd9de20cb","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"supply-weth.sandwich-prone.baseline","flowId":"supply-weth","outcome":"success","verdict":"n/a","caseHash":"0x68c69c08bcd6473b502a122326cb72a3c9e1e7b858d1f457b8a4119e981fd621","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"supply-weth.prober.zero-amount","flowId":"supply-weth","outcome":"reverted","verdict":"rejected","caseHash":"0xf559e8ffd7031ec04b952347b13971cb2a6788445f8ecb502e7bb14774eb4f8d","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"supply-weth.prober.dust-amount","flowId":"supply-weth","outcome":"reverted","verdict":"rejected","caseHash":"0xbfac518c8c7d73295a69f41b4bc86d58f57f4d129edd953c4281cb92ff8d7a14","condition":"probe"},{"agent":"prober","probe":"no-approval","caseId":"supply-weth.prober.no-approval","flowId":"supply-weth","outcome":"reverted","verdict":"rejected","caseHash":"0x04e38be623352700e9bc5e34e8c708b7397818826ae71a6303db12676dd34342","condition":"probe"},{"agent":"prober","probe":"overspend","caseId":"supply-weth.prober.overspend","flowId":"supply-weth","outcome":"reverted","verdict":"rejected","caseHash":"0x9affac618b90922e06381972f7fcccc27fc8296208ed0cece6cb5f54ee823f1e","condition":"probe"},{"agent":"prober","probe":"non-contract-token","caseId":"supply-weth.prober.non-contract-token","flowId":"supply-weth","outcome":"reverted","verdict":"rejected","caseHash":"0x03d499ee79a929e6fdadd6b3b92816620f4e8de2a844c4a04bdd8b24e15958a7","condition":"probe"},{"agent":"careful","probe":null,"caseId":"borrow-usdc.careful.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xda1ac62fcf70f24e0641c30e156bd36eec3384703742b620e0de8c322368df49","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"borrow-usdc.naive.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xaa3b973c83f8db4be2154bede8114a4eb71872fe8736d77ae2866edcf9c05055","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"borrow-usdc.max-approve.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xa18c8f740f3c14f511c149a6873ed4b0c195bad41e4a1367162ea9153659d899","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"borrow-usdc.slippage-insensitive.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xd49c6038a76dcd2d12605a0997e2872e9e3c8eb5fd729188c01f51c8c78aa7ea","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"borrow-usdc.reentrancy-probe.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0x6a072d54371bb9a83241c85e76b36d72d3fc971922b9be179a415a3ef1af5781","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"borrow-usdc.sandwich-prone.baseline","flowId":"borrow-usdc","outcome":"success","verdict":"n/a","caseHash":"0xf1446e8d9ba29aad5f2fb7b4fdd936de44f4809e9db1599393d294b7db678be7","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"borrow-usdc.prober.zero-amount","flowId":"borrow-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0xaee66f9527743bc9d45338f97a4df536c695518f662f682ba5fa729193959c4e","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"borrow-usdc.prober.dust-amount","flowId":"borrow-usdc","outcome":"success","verdict":"accepted","caseHash":"0x2fd8d791bd6c8e0ab47b718f64576d323b9d17427a5b8d9eb24d4b5ce4fd8e29","condition":"probe"},{"agent":"careful","probe":null,"caseId":"repay-usdc.careful.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0xa490d3a75f7548ea7b179bad5993d35f280935b3ba714c04d0cbad30385fa540","condition":"baseline"},{"agent":"naive","probe":null,"caseId":"repay-usdc.naive.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0x5b584435747cfa29d1d521239ce2f57cf61823ac914d8eb3940a4c82db758a5c","condition":"baseline"},{"agent":"max-approve","probe":null,"caseId":"repay-usdc.max-approve.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0x0263726ea4be6b4293b4abf72bbe59fedc800bb18d46a3fa33d8aa242a66afed","condition":"baseline"},{"agent":"slippage-insensitive","probe":null,"caseId":"repay-usdc.slippage-insensitive.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0x32204c172bf7642d1a8a84676e20d6dc48c5ee5d7fd49d60e7cb0309b79ba8e3","condition":"baseline"},{"agent":"reentrancy-probe","probe":null,"caseId":"repay-usdc.reentrancy-probe.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0xa1e3a0fe8aa121466286e5e2f9c16777b0d6a6b9e9eaf9bda0e30df90cfc120d","condition":"baseline"},{"agent":"sandwich-prone","probe":null,"caseId":"repay-usdc.sandwich-prone.baseline","flowId":"repay-usdc","outcome":"success","verdict":"n/a","caseHash":"0x3ab03628ed6756c1086bbc96799e09544690939add536c3f31574d4138b24d3d","condition":"baseline"},{"agent":"prober","probe":"zero-amount","caseId":"repay-usdc.prober.zero-amount","flowId":"repay-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x56195c9c7c4bb6cae60bb9a78bc6e4dd520e5d3e84281b841ed85cd8ab7cd3a0","condition":"probe"},{"agent":"prober","probe":"dust-amount","caseId":"repay-usdc.prober.dust-amount","flowId":"repay-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x9443b77c3938a94e4c1b7ba0fbebe0c231e1b7a2aea1f3f49bb98c6e99a97a75","condition":"probe"},{"agent":"prober","probe":"no-approval","caseId":"repay-usdc.prober.no-approval","flowId":"repay-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x07cf7f23b280bf1a98bee2db55880449abab97522712b56c91d374d3938f769d","condition":"probe"},{"agent":"prober","probe":"overspend","caseId":"repay-usdc.prober.overspend","flowId":"repay-usdc","outcome":"success","verdict":"accepted","caseHash":"0x532ad81bcbffe4e56a46387b21ea224f72366e0e0f5d55014211c7438fc831f6","condition":"probe"},{"agent":"prober","probe":"non-contract-token","caseId":"repay-usdc.prober.non-contract-token","flowId":"repay-usdc","outcome":"reverted","verdict":"rejected","caseHash":"0x547c85d828fe746776aeac9bc65fd08e0fee358ca94942068f26dd3da805b6e9","condition":"probe"}],"contracts":[{"name":"Pool","proxy":{"type":"EIP1967Proxy","source":"registry","implementation":"0xA4AbC5FcBA6D0d7E3D144d6dbF6cb6128599dFdB"},"abiHash":"0xac304cb9266d5ca7d18925d4d5afe659e71de6939f498d5801916c6d7f6cadb2","address":"0xA238Dd80C259a72e81d7e4664a9801593F98d1c5","abiMatch":"exact_match","codeHash":"0xffcb26fbebbe09d9b0d8baef76a1fa218989be6c279b7acf9865d8fb6e0718ce","codeSize":1933,"deployed":false,"abiSource":"sourcify","functions":83}],"followups":{"llmAgents":{"note":"Not requested for this audit.","status":"not_requested"}},"reproduce":{"chainId":8453,"command":"anvil --fork-url <archive RPC for chain 8453> --fork-block-number 52676275 --chain-id 8453 --port 8545 && karatum-protocol-audit run --config audit.json --rpc http://127.0.0.1:8545 --block 52676275","forkBlock":"52676275"},"strengths":["All 20 hostile-input probes (zero amount, dust, zero recipient, missing approval, overspend, past deadline, impossible minimum output, phantom token) were rejected or harmless.","No protocol contract called into the agent's wallet during 5 traced flow(s) (call trees checked).","A careful agent completed 5/5 flows (exact approval, simulation, bounded output, on-chain verification)."],"configHash":"0xab4d138249caa765cf1d118b1ce5f3fd4188453a736e072753789f44cf0ee68e","methodology":"protocol-readiness-v1"}},"disclaimer":"An Agent Readiness report measures how scripted agents (careful, naive, adversarial) behave against a protocol on a fork of the chain at one block: task completion, input hardening, price-move exposure, approval surface and error legibility. It is not a security audit or a risk rating of the protocol, and the agents are not language models. Nothing was broadcast to any real network. Methodology: docs/methodology/protocol-readiness.md."}