A curated, machine-validated database of reusable Web3 vulnerability classes for security researchers and automated audit workflows.

CLI tool

Example: vulnerability types for tokenized lending vaults:

bun run db search \
  --domain lending \
  --category lending.share-accounting \
  --capability vault.tokenized-shares \
  --format json \
  | jq '.records[1] | {
      id,
      title,
      category: .routing.primaryCategory,
      status: .reviewStatus
    }'

{
  "id": "lending.conversion-pair-rounds-toward-the-caller",
  "title": "A vault's asset and share conversions round toward the caller, so a round trip returns more than it cost",
  "category": "lending.share-accounting",
  "status": "draft"
}

Render a result as Markdown:

bun run db show lending.empty-vault-share-inflation --format markdown

## Preconditions

A lending vault issues fungible shares against pooled assets, computes conversions from the current asset and share totals,
and can reach a zero or very small share supply. Assets can enter the vault without minting proportional shares,
such as through a direct transfer, accrued yield, debt repayment, or another donation-like path.
...

TypeScript integration

Use the same query engine programmatically with the committed catalog and category registry:

import catalog from "./catalog.json";
import categoryRegistry from "./config/categories.json";
import { queryCatalog } from "@aviggiano/web3-vulnerability-database/query";

const result = queryCatalog(
  catalog,
  {
    domains: ["lending"],
    categories: ["lending.share-accounting"],
    capabilities: ["vault.tokenized-shares"],
  },
  { categories: categoryRegistry.categories },
);

for (const record of result.records) {
  console.log(record.id, record.title, record.sha256);
}

Corpus

These views are generated from validated class records and the protocol-type registry.

Vulnerability taxonomy forest showing category namespaces, categories, and class routing

Alphabetical protocol-type registry showing core, extended, and deferred curation tiers

The taxonomy forest places each class at its one primary category. P counts primary class assignments, S counts secondary category routes, and C counts categories in a namespace. The protocol directory presents protocol types as peers: C, E, and D mean core, extended, and deferred. Protocol types organize evidence curation; they do not determine whether a vulnerability class applies to a target.

See the data model for the distinction between classification and applicability, the protocol-type registry for tier semantics, and the accessible chart data for exact counts and IDs. The database contract defines the catalog and digest guarantees.

Documentation

The documentation follows Diátaxis and separates four kinds of reader need:

  • Tutorials teach the workflow through a complete example.
  • How-to guides solve specific authoring and ingestion tasks.
  • Reference defines commands, schemas, registries, and artifacts.
  • Explanation describes the model and its design choices.

Development

Class records live at classes/<domain>/<slug>.yml. To extend the corpus, use the class-authoring guide. To gather and classify new public evidence, use the ingestion guide.

Run the complete local gate set before opening a pull request:

bun run check
bun test
bun run schema:check
bun run docs:check
bun run db generate --check
bun run db validate
bun run check:auditvault
bun run check:pinned

Solodit ingestion reads SOLODIT_API_KEY only for probe and fetch. Raw source bodies, API responses, and normalized working data stay in the ignored .work/ directory. See the data-model explanation for the evidence, applicability, provenance, and licensing boundaries.

Repository-authored code, schemas, documentation, and curated class text are licensed under the MIT License. Linked source material remains under its respective terms.