kaspa-redteam v0.15.0  pool.json  (library v0.9.1, covenant target)
 7 attacks run   6 survived   22 skipped   2 FINDINGS   0.0s

  OUT-04  FOUND     Keep what the fixed payouts leave over           2 of 4 attempts accepted
  FEE-01  survived  Route value to the miner fee                     4 attempts rejected
  IN-01   survived  Two covenant coins, one shared set of outputs    8 attempts rejected
  IN-02   survived  Attacker's coin at input 0, covenant moved behind it 4 attempts rejected
  OUT-01  survived  Correct value, attacker's script                 16 attempts rejected
  OUT-02  survived  Correct script, reduced value                    4 attempts rejected
  OUT-03  survived  Valid output 0, skim a later output              8 attempts rejected
  BOR-01  skipped   A stranger borrows the coin it holds and bricks it no coin the covenant holds was bricked by a borrow (where a borrow only moves it, see BOR-02)
  BOR-02  skipped   A stranger borrows the coin it holds             no explored spend lets a stranger borrow a coin the covenant holds (see BOR-01)
  BOR-03  skipped   A borrow takes the coin                          no token program with a borrowed receive among the explored paths
  BOR-04  skipped   A borrow adds nothing                            no token program with a borrowed receive among the explored paths
  BOR-05  skipped   A borrow takes the coin's KAS                    no token program with a borrowed receive among the explored paths
  BOR-06  skipped   A borrow without the borrow key                  no token program with a borrowed receive among the explored paths
  BOR-07  skipped   A borrow rewrites the borrow settings            no token program with a borrowed receive among the explored paths
  FAM-01  skipped   Mint more than allowed                           no explored spend creates coins of another program (give the project's files together)
  FAM-02  skipped   Mint to the attacker                             no explored spend creates coins of another program (give the project's files together)
  FAM-03  skipped   Mint one coin twice                              no explored spend creates coins of another program (give the project's files together)
  FAM-04  skipped   Coin of the right program, wrong family          no explored spend creates coins of another program (give the project's files together)
  FAM-05  skipped   Authority does not continue                      no explored spend creates coins of another program (give the project's files together)
  FAM-06  skipped   Replay the same proof on the next state          no explored spend creates coins of another program (give the project's files together)
  FAM-07  skipped   Start the family a second time                   no explored spend creates coins of another program (give the project's files together)
  FAM-08  skipped   Hand out the minting power                       no explored spend creates coins of another program (give the project's files together)
  FAM-09  skipped   Take tokens without paying                       no explored spend creates coins of another program (give the project's files together)
  FAM-10  skipped   Sweep coins sent to the covenant                 no explored spend creates coins of another program (give the project's files together)
  ORC-04  skipped   Reading signed by the attacker's own key         no explored path this attack applies to
  SEC-01  skipped   Front-run a revealed secret or reading           no explored path this attack applies to
  SIG-01  skipped   Spend a signed path with an invalid signature    no explored path this attack applies to
  SIG-02  skipped   Sign with the attacker's own key                 no explored path this attack applies to
  ST-01   skipped   Rewrite the recorded owner of the next state     no explored permissionless path carries a key in its next state

[MED]  OUT-04 Keep what the fixed payouts leave over
  Path `pool-v1-kas-to-tok-deposit (imported)`: the path fixes its payouts but not what is left of the coin. Here the coin held 573822.92521987 KAS and the payouts total 573822.88489987 KAS, so anyone kept 0.04012 KAS by adding an output of their own. A coin that always holds exactly the payouts plus the fee loses nothing.
  In practice: The coin holds more than the fixed payouts: an overpayment, a top-up, a deposit made before the final amounts were known. Whoever spends it adds an output and keeps the excess.
  Repro: /private/tmp/claude-501/-Users-seafalshannaq-Desktop-KCC20-Launchpad/f43fdbcb-a31e-494d-8281-46cb9ada79b6/scratchpad/verify-pack/.findings/pool/OUT-04.json   replay: kaspa-redteam replay /private/tmp/claude-501/-Users-seafalshannaq-Desktop-KCC20-Launchpad/f43fdbcb-a31e-494d-8281-46cb9ada79b6/scratchpad/verify-pack/.findings/pool/OUT-04.json
  Fix pattern: require(tx.inputs[this.activeInputIndex].value <= a + b + c + maxFee);  // or pin a change output back to the depositor

[MED]  OUT-04 Keep what the fixed payouts leave over
  Path `pool-v1-kas-to-tok (imported)`: the path fixes its payouts but not what is left of the coin. Here the coin held 573824.32521987 KAS and the payouts total 573824.28500587 KAS, so anyone kept 0.040014 KAS by adding an output of their own. A coin that always holds exactly the payouts plus the fee loses nothing.
  In practice: The coin holds more than the fixed payouts: an overpayment, a top-up, a deposit made before the final amounts were known. Whoever spends it adds an output and keeps the excess.
  Repro: /private/tmp/claude-501/-Users-seafalshannaq-Desktop-KCC20-Launchpad/f43fdbcb-a31e-494d-8281-46cb9ada79b6/scratchpad/verify-pack/.findings/pool/OUT-04-2.json   replay: kaspa-redteam replay /private/tmp/claude-501/-Users-seafalshannaq-Desktop-KCC20-Launchpad/f43fdbcb-a31e-494d-8281-46cb9ada79b6/scratchpad/verify-pack/.findings/pool/OUT-04-2.json
  Fix pattern: require(tx.inputs[this.activeInputIndex].value <= a + b + c + maxFee);  // or pin a change output back to the depositor

Spend map (who can spend each path, as found by search)
  pool-v1-kas-to-tok-deposit (imported) anyone, no signature; from 3 inputs worth 573822.92521987 KAS pays 573782.92521987 KAS to script aa201ac5bb1d2280.., 20 KAS to script aa203a8ac97e0fc6.., 5 KAS to script aa20ac9b8e75cbd7.., 2 KAS to script aa20d5798fa98014.., 12.95968 KAS to attacker [imported]
  pool-v1-kas-to-tok (imported) anyone, no signature; from 3 inputs worth 573824.32521987 KAS pays 573789.32521987 KAS to script aa2052fdcb592ff3.., 20 KAS to script aa2032d042e16ed6.., 5 KAS to script aa209f1c675d1b0d.., 9.959786 KAS to attacker [imported]
  pool-v1-tok-to-kas (imported) anyone, no signature; from 3 inputs worth 573814.32521987 KAS pays 20 KAS to script aa20fe7a56035064.., 573764.49521987 KAS to script aa20ff0bb1366a7a.., 29.782096 KAS to script 20774ae7f858a941.. [imported]
  remove-liquidity (imported) anyone, no signature; from 4 inputs worth 573799.32521987 KAS pays 10 KAS to script aa20b2d8e247f00d.., 20 KAS to script aa200be51558aed5.., 4.5 KAS to script aa202b72ffdb69c1.., 573545.80521987 KAS to script aa207daa8e6bae6c.., 218.962852 KAS to script 20774ae7f858a941.. [imported]

note: 4 baseline transaction(s) imported and attacked as given
note: judge: rusty-kaspa consensus validator 2.1.0 in process (mempool relay policy not applied)
