The BugCrawl colony
Every Solidity source file in BugCrawl, layered by what depends on what. Source files and deployed instances are different things: 47 files compile into 28 deployable contracts, and a deployment only includes the modules it needs.
- Source files
- 47
- Deployed on this network
- 0
- Source-verified by explorer
- 0
- Manifest
- No deployment
Architecture, surface to bedrock
- Deployable contract
- Abstract base
- Interface
- Internal library
- Shared types
Surface
src/periphery
What apps touch first: the read-only lens, typed parameters and the registry of verification providers.
- BugCrawlLensRead-only aggregator for the web app: one call returns an entry together with its latest source-verification result, freshness, open request and active attestation count.Pick a network to see its deployment
- ConfigurationRegistryTyped protocol parameters (e.g. "verification.maxAge") with optional bounds that the admin sets once per key, so a later value cannot leave its sane range.Pick a network to see its deployment
- IntegrationRegistryExternal services BugCrawl relies on, chiefly verification providers (e.g. a Blockscout instance). Every on-chain verification record cites a provider id from here.Pick a network to see its deployment
Colony
src/ecosystem
Projects, contributors, auditors, bug reports, disclosures and bounty listings. People-facing records.
- AuditorDirectorySecurity reviewers that curators have approved to publish attestations.Pick a network to see its deployment
- BugBountyRegistryListing of bug-bounty programmes run by projects: scope, terms and declared reward ceiling.Pick a network to see its deployment
- BugReportRegistryPublic, non-sensitive bug reports against directory entries and their triage outcome.Pick a network to see its deployment
- ContributorRegistryPublic list of addresses that work on a project ("colony members"), each with a role tag.Pick a network to see its deployment
- ProjectRegistrySelf-service projects ("colonies") that group related contracts under one owner.Pick a network to see its deployment
- ReputationRegistryNon-transferable activity points earned by auditors and bug reporters (e.g. +severity when a reported bug is confirmed fixed).Pick a network to see its deployment
- SecurityDisclosureRegistryProjects publish how to report vulnerabilities; researchers timestamp private reports with a commitment and reveal them after the project ships a fix.Pick a network to see its deployment
Burrows
src/verification
Requests, results, evidence, expiry, revocation, appeals and auditor attestations, each in its own contract.
- AttestationRegistrySecurity-review attestations signed (by transaction) by curator-approved auditors.Pick a network to see its deployment
- VerificationAppealsEntry controllers can contest a Failed or Revoked result. A curator either upholds the appeal (which opens a fresh verification request) or rejects it with a public note.Pick a network to see its deployment
- VerificationCoordinatorThe single door through which the off-chain verification service reports explorer results. One call appends the record, attaches its evidence and closes the open request.Pick a network to see its deployment
- VerificationEvidenceStoreContent digests and locations of the evidence behind each verification record (standard-JSON input, explorer response, compiler output).Pick a network to see its deployment
- VerificationExpiryManagerDecides whether a positive verification is still "fresh". Upgradeable proxies can change implementation after a check, so results age out and must be re-checked.Pick a network to see its deployment
- VerificationRecordStoreAppend-only history of source-verification results per directory entry.Pick a network to see its deployment
- VerificationRequestManagerQueue asking the verification service to (re)check a directory entry against its explorer.Pick a network to see its deployment
- VerificationRevocationManagerLets curators withdraw a positive verification with a public reason, e.g. when a proxy is upgraded to unverified code or the explorer later reports a mismatch.Pick a network to see its deployment
Nest
src/core
The directory itself: networks, entries, metadata, relationships, manifests, versions and the module address book.
- BugCrawlCoreThe "nest": an address book mapping module names to their live deployments, so clients only need one address to discover the whole system.Pick a network to see its deployment
- ContractDirectoryThe catalogue ("trail index") of contracts BugCrawl tracks, across any supported EVM chain.Pick a network to see its deployment
- ContractMetadataRegistryPublic links and descriptive fields for directory entries (website, repository, docs, ...).Pick a network to see its deployment
- ContractRelationshipRegistryDirected links between directory entries ("trails"), e.g. proxy -> implementation, module -> dependency, factory -> child.Pick a network to see its deployment
- DeploymentRegistryAnchors the hash of each BugCrawl deployment manifest on-chain, so the JSON manifest published in the repository can be checked against what the registrar recorded.Pick a network to see its deployment
- NetworkRegistryNetworks whose contracts BugCrawl catalogues, with their explorer base URLs.Pick a network to see its deployment
- VersionRegistryProtocol release history with strictly increasing semantic versions.Pick a network to see its deployment
Root layer
src/access
One role registry, an emergency pause, a timelock and the shared module base everything else stands on.
- AccessHubSingle role registry for every BugCrawl module.Pick a network to see its deployment
- AdminTimelockDelays privileged changes so the community can see them coming. Intended to become the AccessHub default admin once the deployment is stable.Pick a network to see its deployment
- BugCrawlRolesCanonical role identifiers. Kept in one place so modules, scripts and the web app agree.Compiled into other contracts
- ModuleBaseCommon plumbing for BugCrawl modules: role checks against AccessHub and pause checks against PauseGuard.Compiled into other contracts
- PauseGuardEmergency pause controller. Pausers can stop one module or the whole protocol quickly; only the admin can resume, so a compromised pauser cannot flip modules back on.Pick a network to see its deployment
Bedrock
src/interfaces + libraries
Interfaces and internal libraries. Compiled into other contracts, never deployed on their own.
- IAccessHubRead interface for the central role registry every BugCrawl module consults.Compiled into other contracts
- IAuditorDirectoryRead interface for curator-approved security reviewers.Compiled into other contracts
- IConfigurationRegistryRead interface for typed protocol parameters.Compiled into other contracts
- IContractDirectoryRead interface for the catalogue of contracts known to BugCrawl.Compiled into other contracts
- IEvidenceStoreWrite interface for verification evidence references.Compiled into other contracts
- IIntegrationRegistryRead interface for registered verification providers / integrations.Compiled into other contracts
- INetworkRegistryRead interface for supported networks.Compiled into other contracts
- IPauseGuardRead interface for the emergency pause controller.Compiled into other contracts
- IProjectRegistryRead interface for projects that group related contracts.Compiled into other contracts
- IReputationRegistryWrite interface used by modules that award or deduct activity-based reputation points.Compiled into other contracts
- IVerificationRecordStoreAppend-only history of source-verification results.Compiled into other contracts
- IVerificationRequestManagerQueue of reconciliation requests for directory entries.Compiled into other contracts
- AddressChecksSmall validation helpers shared by modules that accept addresses and strings.Compiled into other contracts
- BugCrawlTypesShared enums and structs used across BugCrawl modules.Compiled into other contracts
- EvidenceHashLibDeterministic digests for off-chain evidence so anyone can recompute and compare them.Compiled into other contracts
- PaginationLibBounds arithmetic for paginated view functions so they never revert on out-of-range pages.Compiled into other contracts
- VerificationStatusLibState machine for source-verification statuses.Compiled into other contracts
Platform contracts appear in the directory as BugCrawl modules. Their source-verification status is independent of any security assessment.