Detailed Instructions

Begin by creating a comprehensive audit scope document. This must include the specific smart contract files, their commit hashes (e.g., a1b2c3d), and the protocol's core functions like lending, fractionalization, and auctions. Define the trust model, identifying which actors are considered trusted (e.g., governance) and untrusted (e.g., users, external oracles). List the key assets to protect: user NFTs, protocol-owned liquidity, and governance tokens.

• Sub-step 1: Map all contract interactions and external dependencies, such as Chainlink VRF for randomness or Uniswap for pricing.
• Sub-step 2: Document the privileged roles (e.g., DEFAULT_ADMIN_ROLE, PAUSER_ROLE) and their intended capabilities.
• Sub-step 3: Identify potential attack vectors specific to NFT-Fi, including flash loan attacks on NFT collateral valuation, reentrancy during batch operations, and oracle manipulation.

Tip: Use a tool like slither-print inheritance-graph to visualize contract relationships and identify complex inheritance patterns that may hide vulnerabilities.

Detailed Instructions

Leverage static analysis tools to scan the codebase without execution. Run Slither (slither . --exclude-informational) to detect issues like incorrect ERC20 interfaces or unprotected upgrade functions. Use MythX or Mythril for deeper symbolic execution. Concurrently, perform dynamic analysis by writing Foundry fuzz tests that target critical state transitions, such as the liquidation of an undercollateralized NFT position.

• Sub-step 1: Configure Slither to generate a detectors report, focusing on high-severity findings like arbitrary-send or reentrancy-no-eth.
• Sub-step 2: Write Foundry invariant tests (forge test --invariant) to assert that an NFT's collateral value always exceeds its loan value.
• Sub-step 3: Use Echidna or Harvey for property-based testing, specifying that totalShares always equals the sum of all user shares in a fractionalization vault.

solidityCopy
// Example Foundry fuzz test for a lending function
function testFuzz_borrowDoesNotExceedCollateralValue(uint256 borrowAmount) public {
    // Assumes NFT collateral value is 10 ETH
    vm.assume(borrowAmount <= 10 ether);
    uint256 loanId = nftLending.borrow(borrowAmount);
    assert(nftLending.collateralRatio(loanId) >= 1e18); // Must be >= 100%
}

Tip: Integrate these tools into a CI/CD pipeline with forge snapshot to monitor for gas regressions and breaking changes.

Detailed Instructions

This phase involves deep, manual inspection of the contract logic. Focus on the protocol's economic safety. Verify all mathematical operations for overflow/underflow and precision loss, especially in functions calculating interest (ray math) or distribution percentages. Scrutinize access control modifiers on every state-changing function. Trace the flow of value (ETH/ERC20) and NFT ownership (safeTransferFrom) through all possible paths.

• Sub-step 1: Review the liquidation engine logic. Ensure the calculation for an NFT's fair market value uses a time-weighted average price (TWAP) or a robust oracle, not a single spot price susceptible to manipulation.
• Sub-step 2: Audit fee accrual and distribution mechanisms. Confirm fees cannot be diluted or stolen and are accounted for before any state updates.
• Sub-step 3: Analyze upgradeability patterns (e.g., Transparent vs. UUPS). Verify that the initialize function can only be called once and that storage layout collisions are prevented in future versions.

Tip: Create a spreadsheet to track every require, assert, and revert statement, noting the condition and which user roles can trigger it.

Detailed Instructions

Compile all issues into a structured audit report. Categorize findings by severity: Critical (e.g., loss of funds), High (e.g., broken core functionality), Medium (e.g., economic inefficiencies), and Low (e.g., code quality). For each finding, provide a technical description, the affected code location (file and line number), and a proof-of-concept (PoC) exploit script.

• Sub-step 1: For a critical reentrancy bug, provide a Foundry test demonstrating how an attacker can drain a vault by re-entering during an NFT transfer callback.
• Sub-step 2: For a high-severity oracle manipulation finding, detail the exact transaction sequence and cost required to skew the price of a Blue-Chip NFT collection.
• Sub-step 3: Recommend specific code changes. Instead of "use checks-effects-interactions," provide the exact diff, such as moving _safeTransferETH to the end of the function.

solidityCopy
// Example remediation for a missing access control finding
// BAD: function setFeeRate(uint256 newRate) public {
// GOOD: function setFeeRate(uint256 newRate) public onlyRole(GOVERNOR_ROLE) {

Tip: Use the DASP Top 10 or SWC Registry to classify vulnerabilities, ensuring your terminology aligns with industry standards for clear communication with developers.