bug-bounty-intelligence-mcp 1.1.0 → 1.2.0

package/BENCHMARK.md

@@ -167,7 +167,7 @@ scan_contract({ repo_url: "https://github.com/3FLabs/grunt", protocol_type: "LEN
 
 ## About Bug Bounty Intelligence
 
-Pattern-aware from a corpus of 56,657 submitted Sherlock findings across 212 measured contests, acceptance-rate numbers (used by `list_vulnerability_patterns`) are limited to the 7,388 findings across 35 contests that could be exact-reconciled against contest outcomes (3,694 accepted), see METHODOLOGY.md. Uses the Al-Mizaan v3 framework, a 7-gate validation chain (Code, Reachability, Threat-Model, Invariant, Protocol-Intent, Impact, Proof), to filter signals into confirmed findings.
+Pattern-aware from a corpus of 56,657 submitted Sherlock findings across 212 measured contests plus the Code4rena contests crawled alongside them, acceptance-rate numbers (used by `list_vulnerability_patterns`) are limited to the 9,200 findings across 38 contests (35 Sherlock, 3 Code4rena) that could be exact-reconciled against contest outcomes (4,011 accepted), see METHODOLOGY.md. Uses the Al-Mizaan v3 framework, a 7-gate validation chain (Code, Reachability, Threat-Model, Invariant, Protocol-Intent, Impact, Proof), to filter signals into confirmed findings.
 
 **Cost:** $5 USDC on Base (eip155:8453) via x402.  
 **Install:** `npx -y bug-bounty-intelligence-mcp@latest`  

package/METHODOLOGY.md

@@ -10,6 +10,9 @@ are computed, what they don't claim, and how to reproduce them from public data.
 
 ## Data source
 
+Two platforms, two different public data shapes, two different reconciliation rules (same
+zero-tolerance standard on both). Sherlock first, Code4rena below.
+
 Sherlock runs public GitHub repos for judging each audit contest
 (`sherlock-audit/<contest>-judging`), where security researchers ("Watsons") open one GitHub
 issue per submitted finding. 218 of these judging repos were crawled; a real issue count could be
@@ -54,6 +57,31 @@ also how the reconciliation check itself works (see Reproducing this, below). Re
 same reconciliation rule this way, with no local cache in the loop, is what produced the 35/7,388/
 3,694 figures above.
 
+## Code4rena: a different shape, a much smaller yield
+
+Code4rena's `code-423n4/<contest>-findings` repos do not have Sherlock's accepted/invalid folder
+convention. Contests from 2021-2023 instead use per-researcher folders
+(`<researcher>/<researcher>-submission.md`) with no accept/reject marker in the file tree at
+all. Contests from roughly late 2024 onward move the judging data off GitHub entirely; the repo
+is reduced to a README pointing sponsors at code4rena.com (verified on
+`2024-12-unruggable-findings`: the repo contains only that README).
+
+What the 2023-era contests do have is GitHub issues with labels, including `satisfactory`,
+`unsatisfactory`, and `partial-NN` (a duplicate that earned partial credit). We tested this
+against five real contests spanning 2021 to 2024: the two 2021-2022 contests sampled had zero
+issues carrying any of these labels (a different, unidentified labelling convention was in use),
+while three contests from October 2023 reconciled exactly once `satisfactory`/`partial-NN`
+(accepted), `unsatisfactory`/`withdrawn-by-warden` (rejected), and
+`qa`/`gas optimization`/`analysis`-only issues (excluded, same treatment as Sherlock's
+`low_info`) were counted against the real issue total.
+
+Applying the same zero-tolerance rule (accepted + rejected + excluded must equal the real
+total, with zero unexplained residual) to all 372 crawled Code4rena judging repos: **3 reconcile
+exactly** (1,812 findings, 317 accepted), all three from October 2023. The other 369 either have
+no GitHub-issue judging data at all, or have labels that don't account for every issue. This is
+a small, honest addition on top of Sherlock, not padding — most of Code4rena's history is
+excluded for the same reason most of Sherlock's is: it does not reconcile.
+
 ## What the resulting numbers mean
 
 For each pattern (keyword-matched against finding titles/bodies — e.g. "reentrancy",
@@ -71,9 +99,12 @@ number of distinct vulnerabilities found.
 - The keyword-based pattern tagging is a simple substring matcher (see `detectPatterns()` in the
   crawler scripts), not a semantic classifier — a manual audit found roughly 65% tagging
   precision on a sample. Pattern labels are directional, not exact classifications.
-- The 35-contest sample is still small relative to the full Sherlock history. Some pattern rows
-  have thin n (e.g. `idor`, n=18) — treat low-n rows as lower-confidence than high-n rows (e.g.
-  `trusted-actor`, n=1,814).
+- The 38-contest sample (35 Sherlock, 3 Code4rena) is still small relative to either platform's
+  full history. Some pattern rows have thin n (e.g. `idor`, n=35) — treat low-n rows as
+  lower-confidence than high-n rows (e.g. `trusted-actor`, n=2,127).
+- Code4rena's three contests are a narrow, single-month slice (all October 2023), not a
+  representative sample of Code4rena's history. Treat the combined numbers as Sherlock-dominated
+  (7,388 of 9,200 findings), with Code4rena adding a small, real, but not yet broad correction.
 
 ## Reproducing this
 
@@ -105,5 +136,6 @@ not use that contest's data.
 An earlier draft of this tool advertised acceptance percentages computed from the full,
 unverified raw corpus. Independent review caught that those specific percentages were
 unreliable. We would rather ship a smaller number we can prove than a bigger one we can't. That
-is still true today: the raw corpus is 56,657 findings, the reconciled, trustworthy number
-published here is 7,388.
+is still true today: the raw Sherlock corpus alone is 56,657 findings, the reconciled,
+trustworthy number published here (Sherlock plus the three Code4rena contests that also
+reconcile) is 9,200.

package/README.md

@@ -86,13 +86,13 @@ Reading the production scan code on 24 October 2026 showed that earlier text on
 
 Official source: this repository and the payment address in the payment section below are the only official ones for Bug Bounty Intelligence. If a listing, a reply or a website gives a different payment address, it is not ours. Check the address against the one below before you pay.
 
-**Drawn from a corpus of 56,657 submitted findings across 212 measured Sherlock audit competitions.**
+**Drawn from a corpus of 56,657 submitted Sherlock findings across 212 measured audit competitions, plus Code4rena.**
 **Cost: $5 USDC on Base (eip155:8453) via x402 for the full scan, $1 USDC for the quick scan.**
 **Free tool: `list_vulnerability_patterns`, no payment needed.**
 
 `list_vulnerability_patterns`' acceptance-rate numbers are computed only from the subset where
-results could be exactly reconciled against Sherlock's own published outcomes: 7,388 findings
-across 35 contests. We'd rather show fewer, verified numbers than a bigger set we can't stand
+results could be exactly reconciled against the platform's own published outcomes: 9,200 findings
+across 38 contests (35 Sherlock, 3 Code4rena). We'd rather show fewer, verified numbers than a bigger set we can't stand
 behind. See [METHODOLOGY.md](METHODOLOGY.md) for exactly why, and how to reproduce it.
 
 ## Free dataset: no server, no MCP, no payment

package/index.mjs

@@ -21,27 +21,30 @@ import {
 } from '@modelcontextprotocol/sdk/types.js'
 const API_URL = 'https://x402.tokenizen.nl'
 
-// Embedded pattern library — Sherlock audit-competition findings, updated 2026-11-12.
-// Methodology: only contests where Sherlock's own judging-repo result structure could be
-// exactly reconciled (accepted + invalid === total submissions) are included, 35 contests,
-// 7,388 findings. A much larger raw corpus exists (56,657 submissions across 212 measured
-// contests), but acceptance could not be verified for the rest without risking a wrong number,
-// so those are excluded rather than estimated. See METHODOLOGY.md for the full methodology note,
-// including the 2026-11-12 re-verification that replaced an unreliable local cache.
+// Embedded pattern library — Sherlock + Code4rena audit-competition findings, updated 2026-11-12.
+// Methodology: only contests where the judging repo's own result structure could be exactly
+// reconciled (accepted + invalid === total submissions) are included — 35 Sherlock contests
+// (7,388 findings) plus 3 Code4rena contests (1,812 findings) that happen to reconcile under
+// the same zero-tolerance rule, 38 contests, 9,200 findings total. Code4rena contributes far
+// less than Sherlock because most of its history does not use a consistently-applied
+// satisfactory/unsatisfactory label (verified by sampling, not assumed), so those contests are
+// excluded rather than estimated, exactly like the excluded Sherlock contests. See
+// METHODOLOGY.md for the full methodology note, including the 2026-11-12 re-verification that
+// replaced an unreliable local cache.
 const PATTERN_LIBRARY = {
-  'flash-loan':         { acceptance_rate: '0.69', total: 185,  accepted: 127, examples_accepted: ['duc - Borrower can reduce the interest of shortly loans', 'ShadowForce - Bypass the VAULT_ACCOUNT_MIN_TIME check in VaultAccountAction.sol when exiting the vau', 'mstpr-brainbot - Compound exchange rate can be manipulated to withdraw more underlying tokens from N'] },
-  'liquidation':        { acceptance_rate: '0.66', total: 869,  accepted: 576, examples_accepted: ['w42d3n - The protocol is not protected against Signature malleability', 'gryphon - Buyer may not be able to liquidate the loan', 'peanuts - NFTs are not stored in the appropriate contracts'] },
-  'fee-miscalculation': { acceptance_rate: '0.55', total: 540,  accepted: 297, examples_accepted: ['7siech - Total loss of funds when using certain popular ERC20 tokens', 'iglyx - MigratePrimeCash\'s _calculateInterestRateCurves calculates new kinkRate1 and kinkRate2 incor', 'xiaoming90 - Prime vaults do not consider secondary debt when assessing vault fees'] },
-  'dos-griefing':       { acceptance_rate: '0.54', total: 680,  accepted: 365, examples_accepted: ['w42d3n - The protocol is not protected against Signature malleability', 'duc - Borrower can reduce the interest of shortly loans', '0xd1r4cde17a - lender gets minInterestsToRepay / loan.nbOfPositions'] },
-  'staleness':          { acceptance_rate: '0.54', total: 1090, accepted: 586, examples_accepted: ['w42d3n - The protocol is not protected against Signature malleability', 'peanuts - Some NFTs like CryptoKitty and CryptoFighter can be paused, which block repaying/liquidati', 'csanuragjain - Liquidation occur at incorrect time'] },
-  'oracle-manipulation':{ acceptance_rate: '0.54', total: 911,  accepted: 488, examples_accepted: ['iglyx - TokenHandler\'s _redeemMoneyMarketIfRequired can fail valid withdrawal requests', 'xiaoming90 - Underlying delta is calculated on internal token balance', 'xiaoming90 - Rebalance stops working when more holdings are added'] },
-  'trusted-actor':      { acceptance_rate: '0.52', total: 1814, accepted: 935, examples_accepted: ['gryphon - Buyer may not be able to liquidate the loan', 'peanuts - Some NFTs like CryptoKitty and CryptoFighter can be paused, which block repaying/liquidati', 'Go-langer - Init function left open for anyone to call and initialize the protocol.'] },
-  'idor':               { acceptance_rate: '0.50', total: 18,   accepted: 9,   examples_accepted: ['0Kage - A borrower with multiple loans of which one is liquidated can withdraw much more than his sh', '0xbepresent - Claimable amount could be sent to the approved address instead the provision/position', 'GimelSec - ClaimFacet.sendShareOfSaleAsSupplier() calculates unfair shares, the money should compe'] },
-  'overflow':           { acceptance_rate: '0.48', total: 346,  accepted: 165, examples_accepted: ['peanuts - Some NFTs like CryptoKitty and CryptoFighter can be paused, which block repaying/liquidati', 'Robert - checkedTransfer In claim() and claimAsBorrower() Functions Can Permanently Lock Tokens', 'Inspex - Denial-of-Service in the liquidation flow results in the collateral NTF will be stuck in th'] },
-  'mev-slippage':       { acceptance_rate: '0.48', total: 368,  accepted: 178, examples_accepted: ['xiaoming90 - Liquidation discount does not take slippage into consideration', 'xiaoming90 - Inadequate slippage control', 'ShadowForce - Bypass the VAULT_ACCOUNT_MIN_TIME check in VaultAccountAction.sol when exiting the vau'] },
-  'access-control':     { acceptance_rate: '0.46', total: 538,  accepted: 249, examples_accepted: ['Go-langer - Init function left open for anyone to call and initialize the protocol.', 'Englave - Signature Replay Attack on OfferArgs', 'xiaoming90 - It may be possible to liquidate on behalf of another account'] },
-  'reentrancy':         { acceptance_rate: '0.40', total: 279,  accepted: 111, examples_accepted: ['SPYBOY - A malicious signer can exploite reentrancy while Borrowing', 'glcanvas - Possible reentrancy which allows to write incorrect supplyPositionIndex', 'Robert - A Loan\'s supplyPositionIndex Can Be Duplicated Through Re-entrancy'] },
-  'rounding':           { acceptance_rate: '0.40', total: 485,  accepted: 192, examples_accepted: ['usmannk - Borrowers may steal funds from lenders', 'jekapi - Borrower can lock lender assets if offer has large LTV', 'iglyx - MigratePrimeCash\'s _calculateInterestRateCurves calculates new kinkRate1 and kinkRate2 incor'] },
+  'flash-loan':         { acceptance_rate: '0.66', total: 193,  accepted: 127,  examples_accepted: ['duc - Borrower can reduce the interest of shortly loans', 'ShadowForce - Bypass the VAULT_ACCOUNT_MIN_TIME check in VaultAccountAction.sol when exiting the vau', 'mstpr-brainbot - Compound exchange rate can be manipulated to withdraw more underlying tokens from N'] },
+  'liquidation':        { acceptance_rate: '0.66', total: 877,  accepted: 576,  examples_accepted: ['w42d3n - The protocol is not protected against Signature malleability', 'gryphon - Buyer may not be able to liquidate the loan', 'peanuts - NFTs are not stored in the appropriate contracts'] },
+  'fee-miscalculation': { acceptance_rate: '0.54', total: 583,  accepted: 313,  examples_accepted: ['7siech - Total loss of funds when using certain popular ERC20 tokens', 'iglyx - MigratePrimeCash\'s _calculateInterestRateCurves calculates new kinkRate1 and kinkRate2 incor', 'xiaoming90 - Prime vaults do not consider secondary debt when assessing vault fees'] },
+  'oracle-manipulation':{ acceptance_rate: '0.53', total: 949,  accepted: 502,  examples_accepted: ['iglyx - TokenHandler\'s _redeemMoneyMarketIfRequired can fail valid withdrawal requests', 'xiaoming90 - Underlying delta is calculated on internal token balance', 'xiaoming90 - Rebalance stops working when more holdings are added'] },
+  'staleness':          { acceptance_rate: '0.51', total: 1315, accepted: 675,  examples_accepted: ['w42d3n - The protocol is not protected against Signature malleability', 'peanuts - Some NFTs like CryptoKitty and CryptoFighter can be paused, which block repaying/liquidati', 'csanuragjain - Liquidation occur at incorrect time'] },
+  'mev-slippage':       { acceptance_rate: '0.47', total: 379,  accepted: 179,  examples_accepted: ['xiaoming90 - Liquidation discount does not take slippage into consideration', 'xiaoming90 - Inadequate slippage control', 'ShadowForce - Bypass the VAULT_ACCOUNT_MIN_TIME check in VaultAccountAction.sol when exiting the vau'] },
+  'trusted-actor':      { acceptance_rate: '0.47', total: 2127, accepted: 1000, examples_accepted: ['gryphon - Buyer may not be able to liquidate the loan', 'peanuts - Some NFTs like CryptoKitty and CryptoFighter can be paused, which block repaying/liquidati', 'Go-langer - Init function left open for anyone to call and initialize the protocol.'] },
+  'dos-griefing':       { acceptance_rate: '0.47', total: 816,  accepted: 383,  examples_accepted: ['w42d3n - The protocol is not protected against Signature malleability', 'duc - Borrower can reduce the interest of shortly loans', '0xd1r4cde17a - lender gets minInterestsToRepay / loan.nbOfPositions'] },
+  'overflow':           { acceptance_rate: '0.43', total: 385,  accepted: 167,  examples_accepted: ['peanuts - Some NFTs like CryptoKitty and CryptoFighter can be paused, which block repaying/liquidati', 'Robert - checkedTransfer In claim() and claimAsBorrower() Functions Can Permanently Lock Tokens', 'Inspex - Denial-of-Service in the liquidation flow results in the collateral NTF will be stuck in th'] },
+  'access-control':     { acceptance_rate: '0.42', total: 846,  accepted: 356,  examples_accepted: ['Go-langer - Init function left open for anyone to call and initialize the protocol.', 'Englave - Signature Replay Attack on OfferArgs', 'xiaoming90 - It may be possible to liquidate on behalf of another account'] },
+  'rounding':           { acceptance_rate: '0.39', total: 532,  accepted: 205,  examples_accepted: ['usmannk - Borrowers may steal funds from lenders', 'jekapi - Borrower can lock lender assets if offer has large LTV', 'iglyx - MigratePrimeCash\'s _calculateInterestRateCurves calculates new kinkRate1 and kinkRate2 incor'] },
+  'reentrancy':         { acceptance_rate: '0.34', total: 332,  accepted: 114,  examples_accepted: ['SPYBOY - A malicious signer can exploite reentrancy while Borrowing', 'glcanvas - Possible reentrancy which allows to write incorrect supplyPositionIndex', 'Robert - A Loan\'s supplyPositionIndex Can Be Duplicated Through Re-entrancy'] },
+  'idor':               { acceptance_rate: '0.26', total: 35,   accepted: 9,    examples_accepted: ['0Kage - A borrower with multiple loans of which one is liquidated can withdraw much more than his sh', '0xbepresent - Claimable amount could be sent to the approved address instead the provision/position', 'GimelSec - ClaimFacet.sendShareOfSaleAsSupplier() calculates unfair shares, the money should compe'] },
 }
 
 // ── helpers ──────────────────────────────────────────────────────────────────
@@ -98,7 +101,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         'Submit a public GitHub repository for an automated Solidity analysis. The result is a list of AI-generated hypotheses to review by hand. It is not an audit and not a list of confirmed bugs.',
         'The scan reads the files most likely to move funds first, in at most six parts. Tests, mocks, scripts, interfaces and vendored dependencies are left out. The report states what share of the in-scope code was actually read, and a report can say that no hypotheses came out of the part that was read.',
         'Check the repository first, for free: GET https://x402.tokenizen.nl/api/bug-intel/precheck?repo=owner/name says whether the scan counts any Solidity in it and roughly how much of it will be read.',
-        'How often the scan finds known issues on closed audit contests, including the misses, is published in the README of the repository (github.com/holistis/bug-bounty-intelligence-mcp). The prompt uses acceptance-rate hints from the 7,388 findings that could be exact-reconciled against contest outcomes, see METHODOLOGY.md.',
+        'How often the scan finds known issues on closed audit contests, including the misses, is published in the README of the repository (github.com/holistis/bug-bounty-intelligence-mcp). The prompt uses acceptance-rate hints from the 9,200 findings that could be exact-reconciled against contest outcomes, see METHODOLOGY.md.',
         'Cost: $5 USDC on Base (eip155:8453) via x402. Reports usually arrive within the hour. If the scan fails or the report does not help, write to info@holistischadviseur.nl for a new attempt or a refund, see the terms.',
         'Returns a job_id. Use get_scan_report to poll for results.',
         'If payment_required is true, pay $5 USDC to the payTo address on Base, then retry scan_contract with the same repo_url.',
@@ -138,8 +141,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     {
       name: 'list_vulnerability_patterns',
       description: [
-        'Returns historical vulnerability patterns and acceptance rates from Sherlock audit-competition findings.',
-        'Numbers are limited to contests where results could be exactly reconciled against Sherlock\'s own published outcomes (7,388 findings across 35 contests), no estimated or unverifiable figures.',
+        'Returns historical vulnerability patterns and acceptance rates from Sherlock and Code4rena audit-competition findings.',
+        'Numbers are limited to contests where results could be exactly reconciled against the platform\'s own published outcomes (9,200 findings across 38 contests: 35 Sherlock, 3 Code4rena), no estimated or unverifiable figures.',
         'Useful for understanding what types of bugs are most likely to be valid in a given protocol type.',
         'This tool is FREE — no payment required.',
       ].join(' '),
@@ -265,7 +268,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
       }
     }
 
-    const lines = [`Vulnerability patterns for ${protocol_type} protocols (from Sherlock audit findings, exact-reconciled contests only):`, '']
+    const lines = [`Vulnerability patterns for ${protocol_type} protocols (from Sherlock and Code4rena audit findings, exact-reconciled contests only):`, '']
     for (const p of patterns) {
       const pct = Math.round(parseFloat(p.acceptance_rate) * 100)
       lines.push(`${p.pattern.padEnd(24)} ${pct}% accepted (${p.total_cases} cases)`)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bug-bounty-intelligence-mcp",
-  "version": "1.1.0",
-  "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 56,657 Sherlock submissions, verified acceptance rates from 7,388 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json), no server required.",
+  "version": "1.2.0",
+  "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 56,657 Sherlock submissions plus Code4rena, verified acceptance rates from 9,200 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json), no server required.",
   "type": "module",
   "main": "index.mjs",
   "bin": {

package/vulnerability-acceptance-rates.json

@@ -1,91 +1,92 @@
 {
   "$schema_note": "Free, standalone dataset, no server, no API key, no payment. Embed directly in your own tool.",
-  "source": "Sherlock audit-competition judging repos (public GitHub)",
+  "source": "Sherlock and Code4rena audit-competition judging repos (public GitHub)",
   "license": "CC0, public domain, use freely with or without attribution",
   "methodology_url": "https://github.com/holistis/bug-bounty-intelligence-mcp/blob/main/METHODOLOGY.md",
   "last_updated": "2026-11-12T00:00:00.000Z",
-  "contests_included": 35,
-  "total_findings": 7388,
-  "total_accepted": 3694,
-  "note": "Only contests where accepted+invalid counts reconcile exactly against Sherlock's own published results are included. 2026-11-12: re-derived from scratch after the 2026-07-21 run was found to rest on an unreliable local issue-count cache (some contests undercounted by an order of magnitude); every count here comes fresh from GitHub's search API and git-tree data, not from a local cache. 'duplicated' is not tracked in this version, see methodology_url. See methodology_url for full scope, limitations, and reproduction steps.",
+  "contests_included": 38,
+  "contests_included_by_platform": { "sherlock": 35, "code4rena": 3 },
+  "total_findings": 9200,
+  "total_accepted": 4011,
+  "note": "Only contests where accepted+invalid counts reconcile exactly against the platform's own published results are included (zero tolerance, same rule for both platforms). Code4rena contributes far less than Sherlock because most of its history does not consistently apply a satisfactory/unsatisfactory label the way its October 2023 contests do; those contests are excluded rather than estimated. 'duplicated' is not tracked in this version. See methodology_url for full scope, limitations, and reproduction steps.",
   "patterns": {
     "flash-loan": {
-      "acceptance_rate": 0.69,
+      "acceptance_rate": 0.66,
       "accepted": 127,
-      "rejected": 58,
-      "total": 185
+      "rejected": 66,
+      "total": 193
     },
     "liquidation": {
       "acceptance_rate": 0.66,
       "accepted": 576,
-      "rejected": 293,
-      "total": 869
+      "rejected": 301,
+      "total": 877
     },
     "fee-miscalculation": {
-      "acceptance_rate": 0.55,
-      "accepted": 297,
-      "rejected": 243,
-      "total": 540
-    },
-    "dos-griefing": {
       "acceptance_rate": 0.54,
-      "accepted": 365,
-      "rejected": 315,
-      "total": 680
+      "accepted": 313,
+      "rejected": 270,
+      "total": 583
+    },
+    "oracle-manipulation": {
+      "acceptance_rate": 0.53,
+      "accepted": 502,
+      "rejected": 447,
+      "total": 949
     },
     "staleness": {
-      "acceptance_rate": 0.54,
-      "accepted": 586,
-      "rejected": 504,
-      "total": 1090
+      "acceptance_rate": 0.51,
+      "accepted": 675,
+      "rejected": 640,
+      "total": 1315
     },
-    "oracle-manipulation": {
-      "acceptance_rate": 0.54,
-      "accepted": 488,
-      "rejected": 423,
-      "total": 911
+    "mev-slippage": {
+      "acceptance_rate": 0.47,
+      "accepted": 179,
+      "rejected": 200,
+      "total": 379
     },
     "trusted-actor": {
-      "acceptance_rate": 0.52,
-      "accepted": 935,
-      "rejected": 879,
-      "total": 1814
+      "acceptance_rate": 0.47,
+      "accepted": 1000,
+      "rejected": 1127,
+      "total": 2127
     },
-    "idor": {
-      "acceptance_rate": 0.5,
-      "accepted": 9,
-      "rejected": 9,
-      "total": 18
+    "dos-griefing": {
+      "acceptance_rate": 0.47,
+      "accepted": 383,
+      "rejected": 433,
+      "total": 816
     },
     "overflow": {
-      "acceptance_rate": 0.48,
-      "accepted": 165,
-      "rejected": 181,
-      "total": 346
-    },
-    "mev-slippage": {
-      "acceptance_rate": 0.48,
-      "accepted": 178,
-      "rejected": 190,
-      "total": 368
+      "acceptance_rate": 0.43,
+      "accepted": 167,
+      "rejected": 218,
+      "total": 385
     },
     "access-control": {
-      "acceptance_rate": 0.46,
-      "accepted": 249,
-      "rejected": 289,
-      "total": 538
+      "acceptance_rate": 0.42,
+      "accepted": 356,
+      "rejected": 490,
+      "total": 846
+    },
+    "rounding": {
+      "acceptance_rate": 0.39,
+      "accepted": 205,
+      "rejected": 327,
+      "total": 532
     },
     "reentrancy": {
-      "acceptance_rate": 0.4,
-      "accepted": 111,
-      "rejected": 168,
-      "total": 279
+      "acceptance_rate": 0.34,
+      "accepted": 114,
+      "rejected": 218,
+      "total": 332
     },
-    "rounding": {
-      "acceptance_rate": 0.4,
-      "accepted": 192,
-      "rejected": 293,
-      "total": 485
+    "idor": {
+      "acceptance_rate": 0.26,
+      "accepted": 9,
+      "rejected": 26,
+      "total": 35
     }
   }
 }