Skip to content

Commit 4dbe74f

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
chore(reports): chunked panic-attack sweep — replaces 180s-timeout single-run
Single full-repo `panic-attack assail .` had timed out at 180s. This run splits the tree into 14 per-subdir chunks (src/rust, src/interfaces, src/julia, src/abi, src/zig, src/zig_ffi, src/idris, src/ada, src/ui, src/rescript, crates/echidna-{core,mcp,wire}, crates/typed_wasm). Each chunk completes in well under 30s; combined wall time ~60s. Findings: 44 total weak points, 41 of which are the structural / file-level / legitimate-FFI classes flagged by existing memory rules (`feedback_panic_attack_unsafe_blocks_meaning.md`, `feedback_panic_attack_panic_path_file_level.md`, `feedback_panic_attack_proofdrift_parameter_pattern.md`). 3 genuinely actionable — tracked in SUMMARY.md, deferred: - SupplyChain in crates/echidna-mcp/Cargo.toml - PanicPath in src/rust/provers/z3.rs - InsecureProtocol in src/rust/provers/uppaal.rs src/chapel returned "Could not detect language" — panic-attack has no Chapel detector. Track separately if Chapel hardening becomes a goal. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1 parent 98ea3b5 commit 4dbe74f

15 files changed

Lines changed: 3788 additions & 0 deletions

‎reports/panic-attack-chunks/SUMMARY.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Echidna Chunked panic-attack Sweep — 2026-04-25
2+
3+
Single full-repo `panic-attack assail .` had timed out at 180s.
4+
This sweep splits the tree into 14 per-subdir chunks, each completing
5+
in < 30s for a combined wall time well under the prior single-run cap.
6+
7+
## Per-chunk totals (severity counts)
8+
9+
| Chunk | Critical | High | Medium | Total |
10+
| ------------------------------ | -------: | ---: | -----: | ----: |
11+
| `src/rust` | 26 | 6 | 2 | 34 |
12+
| `src/interfaces` | 0 | 6 | 0 | 6 |
13+
| `src/zig` | 0 | 1 | 0 | 1 |
14+
| `src/zig_ffi` | 0 | 1 | 0 | 1 |
15+
| `src/abi` | 1 | 0 | 0 | 1 |
16+
| `crates/echidna-mcp` | 0 | 1 | 0 | 1 |
17+
| `crates/echidna-core` | 0 | 0 | 0 | 0 |
18+
| `crates/echidna-wire` | 0 | 0 | 0 | 0 |
19+
| `crates/typed_wasm` | 0 | 0 | 0 | 0 |
20+
| `src/julia` | 0 | 0 | 0 | 0 |
21+
| `src/idris` | 0 | 0 | 0 | 0 |
22+
| `src/ada` | 0 | 0 | 0 | 0 |
23+
| `src/rescript` | 0 | 0 | 0 | 0 |
24+
| `src/ui` | 0 | 0 | 0 | 0 |
25+
| `src/chapel` | – | – | – | – |
26+
| **Total** | **27** | **15** | **2** | **44** |
27+
28+
Note: `src/chapel` returned "Could not detect language" — panic-attack
29+
has no Chapel detector. Track separately.
30+
31+
## Classification (per `feedback_panic_attack_*` memory rules)
32+
33+
### Structural / expected (do not chase counts)
34+
35+
- **26× Critical UnboundedAllocation in `src/rust/provers/*.rs`** —
36+
one per prover backend, file-level aggregation of `Vec::new()` /
37+
`String` allocations across 600+ LoC parsers. This is the
38+
PanicPath-is-file-level pattern: one finding per file, not one per
39+
site. The 26 backends with the highest Vec/parse density flag here.
40+
Investigation required per backend before any structural rewrite —
41+
most allocations are in error-message construction or proof-script
42+
parsing, both bounded in practice by `ProverConfig::timeout`.
43+
44+
- **6× High UnsafeCode in `src/interfaces/*/ffi_wrapper.rs`** — two
45+
per FFI wrapper × three interfaces (rest, grpc, graphql). All
46+
calls into the Zig FFI shim's `extern "C"` surface plus `CStr::from_ptr`.
47+
These cannot be eliminated without dropping the FFI boundary; per
48+
`feedback_panic_attack_unsafe_blocks_meaning.md` this is the
49+
legitimate-FFI-try/catch class, not the banned partial-cast class.
50+
51+
- **2× High UnsafeFFI in zig bridges** (`chapel_bridge.zig`,
52+
`ffi/axiom_spark_bridge.zig`) — required for cross-language FFI.
53+
54+
- **1× Critical ProofDrift in `src/abi/echidnaabi.ipkg`** — flagged
55+
per `feedback_panic_attack_proofdrift_parameter_pattern.md`. The
56+
`.ipkg` is an Idris2 package manifest; the rule's "free Parameter
57+
unless inside designated Section Carriers" pattern doesn't quite
58+
fit a config file. Worth re-reading the rule's scope; likely a
59+
detector false-positive on `.ipkg` files.
60+
61+
- **2× High UnsafeCode in `src/rust/proof_search.rs`** — Chapel FFI
62+
boundary; behind `--features chapel` cargo feature. Same class as
63+
the interface FFI wrappers.
64+
65+
- **3× High UnsafeCode + 1× High ResourceLeak in `src/rust/ffi/`** —
66+
same FFI-boundary class.
67+
68+
### Actionable today (low cost, structural fixes)
69+
70+
- **1× High SupplyChain `crates/echidna-mcp/Cargo.toml`** — needs
71+
inspection. May be an unpinned dep version or a permissive feature
72+
set.
73+
74+
- **1× Medium PanicPath `src/rust/provers/z3.rs`** — single panic site
75+
in a hot prover. Easy to convert to anyhow::Result.
76+
77+
- **1× Medium InsecureProtocol `src/rust/provers/uppaal.rs`** —
78+
probably an `http://` URL in a comment or test fixture; quick
79+
audit.
80+
81+
## Conclusion
82+
83+
Chunked sweep replaces the 180s timeout with 14 fast per-subdir runs.
84+
Of 44 findings: ~41 are structural / FFI / file-level aggregation
85+
classes that the memory rules say not to chase by count, and 3 are
86+
genuinely actionable in a follow-up (1 SupplyChain, 1 PanicPath,
87+
1 InsecureProtocol). No new criticals discovered — all in the
88+
expected places (FFI surfaces and prover wrappers).
89+
90+
Reports retained at `reports/panic-attack-chunks/*.json`.

‎reports/panic-attack-chunks/crates-echidna-core.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"program_path": "crates/echidna-core",
3+
"language": "rust",
4+
"frameworks": [],
5+
"weak_points": [],
6+
"statistics": {
7+
"total_lines": 825,
8+
"unsafe_blocks": 0,
9+
"panic_sites": 0,
10+
"unwrap_calls": 0,
11+
"allocation_sites": 10,
12+
"io_operations": 0,
13+
"threading_constructs": 0
14+
},
15+
"file_statistics": [
16+
{
17+
"file_path": "src/types.rs",
18+
"lines": 478,
19+
"unsafe_blocks": 0,
20+
"panic_sites": 0,
21+
"unwrap_calls": 0,
22+
"allocation_sites": 10,
23+
"io_operations": 0,
24+
"threading_constructs": 0
25+
}
26+
],
27+
"recommended_attacks": [
28+
"cpu"
29+
],
30+
"dependency_graph": {
31+
"edges": []
32+
},
33+
"taint_matrix": {
34+
"rows": []
35+
}
36+
}

‎reports/panic-attack-chunks/crates-echidna-mcp.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"program_path": "crates/echidna-mcp",
3+
"language": "rust",
4+
"frameworks": [
5+
"Networking"
6+
],
7+
"weak_points": [
8+
{
9+
"category": "SupplyChain",
10+
"location": "Cargo.toml",
11+
"file": "Cargo.toml",
12+
"severity": "High",
13+
"description": "Cargo.lock is absent — dependency versions are not locked for a library/binary crate",
14+
"recommended_attack": []
15+
}
16+
],
17+
"statistics": {
18+
"total_lines": 308,
19+
"unsafe_blocks": 0,
20+
"panic_sites": 0,
21+
"unwrap_calls": 0,
22+
"allocation_sites": 6,
23+
"io_operations": 1,
24+
"threading_constructs": 0
25+
},
26+
"file_statistics": [
27+
{
28+
"file_path": "src/main.rs",
29+
"lines": 308,
30+
"unsafe_blocks": 0,
31+
"panic_sites": 0,
32+
"unwrap_calls": 0,
33+
"allocation_sites": 6,
34+
"io_operations": 1,
35+
"threading_constructs": 0
36+
}
37+
],
38+
"recommended_attacks": [
39+
"cpu"
40+
],
41+
"dependency_graph": {
42+
"edges": [
43+
{
44+
"from": "src/main.rs",
45+
"to": "Networking",
46+
"relation": "framework",
47+
"weight": 1.0
48+
}
49+
]
50+
},
51+
"taint_matrix": {
52+
"rows": []
53+
}
54+
}

‎reports/panic-attack-chunks/crates-echidna-wire.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"program_path": "crates/echidna-wire",
3+
"language": "rust",
4+
"frameworks": [],
5+
"weak_points": [],
6+
"statistics": {
7+
"total_lines": 109,
8+
"unsafe_blocks": 0,
9+
"panic_sites": 0,
10+
"unwrap_calls": 1,
11+
"allocation_sites": 0,
12+
"io_operations": 0,
13+
"threading_constructs": 0
14+
},
15+
"file_statistics": [
16+
{
17+
"file_path": "build.rs",
18+
"lines": 12,
19+
"unsafe_blocks": 0,
20+
"panic_sites": 0,
21+
"unwrap_calls": 1,
22+
"allocation_sites": 0,
23+
"io_operations": 0,
24+
"threading_constructs": 0
25+
}
26+
],
27+
"recommended_attacks": [
28+
"cpu"
29+
],
30+
"dependency_graph": {
31+
"edges": []
32+
},
33+
"taint_matrix": {
34+
"rows": []
35+
}
36+
}

‎reports/panic-attack-chunks/crates-typed-wasm.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"program_path": "crates/typed_wasm",
3+
"language": "rust",
4+
"frameworks": [],
5+
"weak_points": [],
6+
"statistics": {
7+
"total_lines": 1030,
8+
"unsafe_blocks": 0,
9+
"panic_sites": 0,
10+
"unwrap_calls": 2,
11+
"allocation_sites": 10,
12+
"io_operations": 0,
13+
"threading_constructs": 0
14+
},
15+
"file_statistics": [
16+
{
17+
"file_path": "src/lib.rs",
18+
"lines": 1030,
19+
"unsafe_blocks": 0,
20+
"panic_sites": 0,
21+
"unwrap_calls": 2,
22+
"allocation_sites": 10,
23+
"io_operations": 0,
24+
"threading_constructs": 0
25+
}
26+
],
27+
"recommended_attacks": [
28+
"cpu"
29+
],
30+
"dependency_graph": {
31+
"edges": []
32+
},
33+
"taint_matrix": {
34+
"rows": []
35+
}
36+
}

0 commit comments

Comments
 (0)