The BugCrawl colony
Every Solidity source file in BugCrawl, layered by what depends on what. Source files and deployed instances are different things: 47 files compile into 28 deployable contracts, and a deployment only includes the modules it needs.
- Source files
- 47
- Deployed on Robinhood
- 27
- Source-verified
- 27
- Manifest
- 0xa43f5754…5485b7full profile, deployed yesterday
Architecture, surface to bedrock
- Deployable contract
- Abstract base
- Interface
- Internal library
- Shared types
Surface
src/periphery
What apps touch first: the read-only lens, typed parameters and the registry of verification providers.
- BugCrawlLensRead-only aggregator for the web app: one call returns an entry together with its latest source-verification result, freshness, open request and active attestation count.Source verified
- ConfigurationRegistryTyped protocol parameters (e.g. "verification.maxAge") with optional bounds that the admin sets once per key, so a later value cannot leave its sane range.Source verified
- IntegrationRegistryExternal services BugCrawl relies on, chiefly verification providers (e.g. a Blockscout instance). Every on-chain verification record cites a provider id from here.Source verified
Colony
src/ecosystem
Projects, contributors, auditors, bug reports, disclosures and bounty listings. People-facing records.
- AuditorDirectorySecurity reviewers that curators have approved to publish attestations.Source verified
- BugBountyRegistryListing of bug-bounty programmes run by projects: scope, terms and declared reward ceiling.Source verified
- BugReportRegistryPublic, non-sensitive bug reports against directory entries and their triage outcome.Source verified
- ContributorRegistryPublic list of addresses that work on a project ("colony members"), each with a role tag.Source verified
- ProjectRegistrySelf-service projects ("colonies") that group related contracts under one owner.Source verified
- ReputationRegistryNon-transferable activity points earned by auditors and bug reporters (e.g. +severity when a reported bug is confirmed fixed).Source verified
- SecurityDisclosureRegistryProjects publish how to report vulnerabilities; researchers timestamp private reports with a commitment and reveal them after the project ships a fix.Source verified
Burrows
src/verification
Requests, results, evidence, expiry, revocation, appeals and auditor attestations, each in its own contract.
- AttestationRegistrySecurity-review attestations signed (by transaction) by curator-approved auditors.Source verified
- VerificationAppealsEntry controllers can contest a Failed or Revoked result. A curator either upholds the appeal (which opens a fresh verification request) or rejects it with a public note.Source verified
- VerificationCoordinatorThe single door through which the off-chain verification service reports explorer results. One call appends the record, attaches its evidence and closes the open request.Source verified
- VerificationEvidenceStoreContent digests and locations of the evidence behind each verification record (standard-JSON input, explorer response, compiler output).Source verified
- VerificationExpiryManagerDecides whether a positive verification is still "fresh". Upgradeable proxies can change implementation after a check, so results age out and must be re-checked.Source verified
- VerificationRecordStoreAppend-only history of source-verification results per directory entry.Source verified
- VerificationRequestManagerQueue asking the verification service to (re)check a directory entry against its explorer.Source verified
- VerificationRevocationManagerLets curators withdraw a positive verification with a public reason, e.g. when a proxy is upgraded to unverified code or the explorer later reports a mismatch.Source verified
Nest
src/core
The directory itself: networks, entries, metadata, relationships, manifests, versions and the module address book.
- BugCrawlCoreThe "nest": an address book mapping module names to their live deployments, so clients only need one address to discover the whole system.Source verified
- ContractDirectoryThe catalogue ("trail index") of contracts BugCrawl tracks, across any supported EVM chain.Source verified
- ContractMetadataRegistryPublic links and descriptive fields for directory entries (website, repository, docs, ...).Source verified
- ContractRelationshipRegistryDirected links between directory entries ("trails"), e.g. proxy -> implementation, module -> dependency, factory -> child.Source verified
- DeploymentRegistryAnchors the hash of each BugCrawl deployment manifest on-chain, so the JSON manifest published in the repository can be checked against what the registrar recorded.Source verified
- NetworkRegistryNetworks whose contracts BugCrawl catalogues, with their explorer base URLs.Source verified
- VersionRegistryProtocol release history with strictly increasing semantic versions.Source verified
Root layer
src/access
One role registry, an emergency pause, a timelock and the shared module base everything else stands on.
- AccessHubSingle role registry for every BugCrawl module.Source verified
- AdminTimelockDelays privileged changes so the community can see them coming. Intended to become the AccessHub default admin once the deployment is stable.Deployed at admin handover
- BugCrawlRolesCanonical role identifiers. Kept in one place so modules, scripts and the web app agree.Source verifiedinside 21 contracts
- ModuleBaseCommon plumbing for BugCrawl modules: role checks against AccessHub and pause checks against PauseGuard.Source verifiedinside 22 contracts
- PauseGuardEmergency pause controller. Pausers can stop one module or the whole protocol quickly; only the admin can resume, so a compromised pauser cannot flip modules back on.Source verified
Bedrock
src/interfaces + libraries
Interfaces and internal libraries. Never deployed on their own: their code is compiled into, and verified with, every contract that imports them.
- IAccessHubRead interface for the central role registry every BugCrawl module consults.Source verifiedinside 26 contracts
- IAuditorDirectoryRead interface for curator-approved security reviewers.Source verifiedinside 2 contracts
- IConfigurationRegistryRead interface for typed protocol parameters.Source verifiedinside 2 contracts
- IContractDirectoryRead interface for the catalogue of contracts known to BugCrawl.Source verifiedinside 10 contracts
- IEvidenceStoreWrite interface for verification evidence references.Source verifiedinside 2 contracts
- IIntegrationRegistryRead interface for registered verification providers / integrations.Source verifiedinside 2 contracts
- INetworkRegistryRead interface for supported networks.Source verifiedinside 2 contracts
- IPauseGuardRead interface for the emergency pause controller.Source verifiedinside 23 contracts
- IProjectRegistryRead interface for projects that group related contracts.Source verifiedinside 5 contracts
- IReputationRegistryWrite interface used by modules that award or deduct activity-based reputation points.Source verifiedinside 3 contracts
- IVerificationRecordStoreAppend-only history of source-verification results.Source verifiedinside 6 contracts
- IVerificationRequestManagerQueue of reconciliation requests for directory entries.Source verifiedinside 4 contracts
- AddressChecksSmall validation helpers shared by modules that accept addresses and strings.Source verifiedinside 19 contracts
- BugCrawlTypesShared enums and structs used across BugCrawl modules.Source verifiedinside 12 contracts
- EvidenceHashLibDeterministic digests for off-chain evidence so anyone can recompute and compare them.Source verifiedinside 1 contract
- PaginationLibBounds arithmetic for paginated view functions so they never revert on out-of-range pages.Source verifiedinside 2 contracts
- VerificationStatusLibState machine for source-verification statuses.Source verifiedinside 3 contracts
Platform contracts appear in the directory as BugCrawl modules. Their source-verification status is independent of any security assessment. Browse Robinhood Chain on Blockscout(opens in a new tab)