DeepThreat Guard

This is what it looks like in your PRs

⊙ Open feat: add new lending pool logic #247

✕ Some checks were not successful

3 checks — 1 failing, 2 passing

DeepThreat Guard — Security Scan 2 Critical findings, 1 High

CRITICAL contracts/LendingPool.sol:142

Reentrancy vulnerability in withdraw() — external call before state update.

DeepThreat suggested change

-         msg.sender.call{value: amount}("");
-         balances[msg.sender] = 0;
+         balances[msg.sender] = 0;
+         msg.sender.call{value: amount}("");

CRITICAL contracts/LendingPool.sol:89

Unchecked return value on token transfer allows silent failure.

DeepThreat suggested change

- token.transfer(msg.sender, amount);

+ require(token.transfer(msg.sender, amount), "Transfer failed");

HIGH contracts/Oracle.sol:34

Price oracle manipulable via flash loan in a single block.

DeepThreat suggested change

-         return pair.price0CumulativeLast();
+         // Require multi-block TWAP
+         require(block.timestamp - lastUpdate >= MIN_DELAY, "Too frequent");
+         return currentTWAP;

✓

buildSuccessful in 42s

✓

testAll 156 tests passing

✕ Merging is blocked

Required status check "DeepThreat Guard" has failed. Fix the findings above to unblock.

Same bug. Different outcome.

Without Guard

$50M drained after deploy

Mon 9:14 AM

PR #247 opened

New lending pool logic. Reentrancy bug in withdraw().

Mon 9:31 AM

Tests pass ✓

All 156 unit tests green. Bug not covered.

Mon 10:02 AM

Peer review approved

"LGTM" — reviewer misses the vulnerability.

Mon 10:15 AM

Merged & deployed to mainnet

Contract goes live with the reentrancy bug.

Mon 11:42 AM

Exploit executed

Attacker drains $50M through recursive withdraw calls.

Mon 12:30 PM

Incident response

Team scrambles. Funds unrecoverable. Protocol trust destroyed.

With Guard

Blocked before merge

Mon 9:14 AM

PR #247 opened

New lending pool logic. Same code, same bug.

Mon 9:15 AM

DeepThreat Guard runs

Automatic scan triggered as required check.

Mon 9:16 AM

2 Critical, 1 High found

Reentrancy in withdraw() flagged. Merge blocked. Fix suggested inline.

Mon 9:45 AM

Developer applies fix

Moves state update before external call. Pushes new commit.

Mon 9:46 AM

Guard passes ✓

No critical or high findings. Merge unblocked.

Mon 10:02 AM

Safe deploy to mainnet

$50M protected. Business as usual.

Everything you need. Nothing you don't.

⚡

One-Click Install

Install the GitHub App. Pick your repos. Done. No config files, no CLI setup, no YAML.

🔒

Required Check

Runs on every PR as a required status check. No developer can skip it, no manager can override it.

🚫

Blocks Merges

Critical or high severity findings? The PR stays open until they're fixed. No exceptions.

💬

Inline Comments

Findings posted as review comments on the exact lines of code. With suggested fixes.

⚙️

Configurable Thresholds

Block on critical only? Critical + high? Set severity thresholds per repo or per org.

🔗

Multi-Language

Solidity, Vyper, and Move. All the smart contract languages that matter, covered.

Your Pipeline, Hardened

This is what it looks like in your PRs

Same bug. Different outcome.

Without Guard

With Guard

Everything you need. Nothing you don't.

One-Click Install

Required Check

Blocks Merges

Inline Comments

Configurable Thresholds

Multi-Language

Don't be the next headline.