The BugCrawl colony
Every Solidity source file in BugCrawl, layered by what depends on what. Source files and deployed instances are different things: 47 files compile into 28 deployable contracts, and a deployment only includes the modules it needs.
- Source files
- 47
- Deployed on RH Testnet
- 0
- Source-verified by explorer
- 0
- Manifest
- No deployment
BugCrawl isn't deployed on Robinhood Chain Testnet yet. See the deployment guide.
Architecture, surface to bedrock
- Deployable contract
- Abstract base
- Interface
- Internal library
- Shared types
Surface
src/periphery
What apps touch first: the read-only lens, typed parameters and the registry of verification providers.
- BugCrawlLensRead-only aggregator for the web app: one call returns an entry together with its latest source-verification result, freshness, open request and active attestation count.Not deployed on this network
- ConfigurationRegistryTyped protocol parameters (e.g. "verification.maxAge") with optional bounds that the admin sets once per key, so a later value cannot leave its sane range.Not deployed on this network
- IntegrationRegistryExternal services BugCrawl relies on, chiefly verification providers (e.g. a Blockscout instance). Every on-chain verification record cites a provider id from here.Not deployed on this network
Colony
src/ecosystem
Projects, contributors, auditors, bug reports, disclosures and bounty listings. People-facing records.
- AuditorDirectorySecurity reviewers that curators have approved to publish attestations.Not deployed on this network
- BugBountyRegistryListing of bug-bounty programmes run by projects: scope, terms and declared reward ceiling.Optional module, not deployed here
- BugReportRegistryPublic, non-sensitive bug reports against directory entries and their triage outcome.Optional module, not deployed here
- ContributorRegistryPublic list of addresses that work on a project ("colony members"), each with a role tag.Optional module, not deployed here
- ProjectRegistrySelf-service projects ("colonies") that group related contracts under one owner.Not deployed on this network
- ReputationRegistryNon-transferable activity points earned by auditors and bug reporters (e.g. +severity when a reported bug is confirmed fixed).Not deployed on this network
- SecurityDisclosureRegistryProjects publish how to report vulnerabilities; researchers timestamp private reports with a commitment and reveal them after the project ships a fix.Optional module, not deployed here
Burrows
src/verification
Requests, results, evidence, expiry, revocation, appeals and auditor attestations, each in its own contract.
- AttestationRegistrySecurity-review attestations signed (by transaction) by curator-approved auditors.Not deployed on this network
- VerificationAppealsEntry controllers can contest a Failed or Revoked result. A curator either upholds the appeal (which opens a fresh verification request) or rejects it with a public note.Not deployed on this network
- VerificationCoordinatorThe single door through which the off-chain verification service reports explorer results. One call appends the record, attaches its evidence and closes the open request.Not deployed on this network
- VerificationEvidenceStoreContent digests and locations of the evidence behind each verification record (standard-JSON input, explorer response, compiler output).Not deployed on this network
- VerificationExpiryManagerDecides whether a positive verification is still "fresh". Upgradeable proxies can change implementation after a check, so results age out and must be re-checked.Not deployed on this network
- VerificationRecordStoreAppend-only history of source-verification results per directory entry.Not deployed on this network
- VerificationRequestManagerQueue asking the verification service to (re)check a directory entry against its explorer.Not deployed on this network
- VerificationRevocationManagerLets curators withdraw a positive verification with a public reason, e.g. when a proxy is upgraded to unverified code or the explorer later reports a mismatch.Not deployed on this network
Nest
src/core
The directory itself: networks, entries, metadata, relationships, manifests, versions and the module address book.
- BugCrawlCoreThe "nest": an address book mapping module names to their live deployments, so clients only need one address to discover the whole system.Not deployed on this network
- ContractDirectoryThe catalogue ("trail index") of contracts BugCrawl tracks, across any supported EVM chain.Not deployed on this network
- ContractMetadataRegistryPublic links and descriptive fields for directory entries (website, repository, docs, ...).Not deployed on this network
- ContractRelationshipRegistryDirected links between directory entries ("trails"), e.g. proxy -> implementation, module -> dependency, factory -> child.Not deployed on this network
- DeploymentRegistryAnchors the hash of each BugCrawl deployment manifest on-chain, so the JSON manifest published in the repository can be checked against what the registrar recorded.Not deployed on this network
- NetworkRegistryNetworks whose contracts BugCrawl catalogues, with their explorer base URLs.Not deployed on this network
- VersionRegistryProtocol release history with strictly increasing semantic versions.Not deployed on this network
Root layer
src/access
One role registry, an emergency pause, a timelock and the shared module base everything else stands on.
- AccessHubSingle role registry for every BugCrawl module.Not deployed on this network
- AdminTimelockDelays privileged changes so the community can see them coming. Intended to become the AccessHub default admin once the deployment is stable.Not deployed on this network
- BugCrawlRolesCanonical role identifiers. Kept in one place so modules, scripts and the web app agree.Compiled into other contracts
- ModuleBaseCommon plumbing for BugCrawl modules: role checks against AccessHub and pause checks against PauseGuard.Compiled into other contracts
- PauseGuardEmergency pause controller. Pausers can stop one module or the whole protocol quickly; only the admin can resume, so a compromised pauser cannot flip modules back on.Not deployed on this network
Bedrock
src/interfaces + libraries
Interfaces and internal libraries. Compiled into other contracts, never deployed on their own.
- IAccessHubRead interface for the central role registry every BugCrawl module consults.Compiled into other contracts
- IAuditorDirectoryRead interface for curator-approved security reviewers.Compiled into other contracts
- IConfigurationRegistryRead interface for typed protocol parameters.Compiled into other contracts
- IContractDirectoryRead interface for the catalogue of contracts known to BugCrawl.Compiled into other contracts
- IEvidenceStoreWrite interface for verification evidence references.Compiled into other contracts
- IIntegrationRegistryRead interface for registered verification providers / integrations.Compiled into other contracts
- INetworkRegistryRead interface for supported networks.Compiled into other contracts
- IPauseGuardRead interface for the emergency pause controller.Compiled into other contracts
- IProjectRegistryRead interface for projects that group related contracts.Compiled into other contracts
- IReputationRegistryWrite interface used by modules that award or deduct activity-based reputation points.Compiled into other contracts
- IVerificationRecordStoreAppend-only history of source-verification results.Compiled into other contracts
- IVerificationRequestManagerQueue of reconciliation requests for directory entries.Compiled into other contracts
- AddressChecksSmall validation helpers shared by modules that accept addresses and strings.Compiled into other contracts
- BugCrawlTypesShared enums and structs used across BugCrawl modules.Compiled into other contracts
- EvidenceHashLibDeterministic digests for off-chain evidence so anyone can recompute and compare them.Compiled into other contracts
- PaginationLibBounds arithmetic for paginated view functions so they never revert on out-of-range pages.Compiled into other contracts
- VerificationStatusLibState machine for source-verification statuses.Compiled into other contracts
Platform contracts appear in the directory as BugCrawl modules. Their source-verification status is independent of any security assessment. Browse Robinhood Chain Testnet on Blockscout(opens in a new tab)