Render a Trustpilot-style security pre-flight card for a smart contract, summarising static-analysis findings (Slither, Aderyn, Mythril, ...).
Design intent (informed by the dapp-gen UX research brief):
The component is stateless like every primitive in this lib -- the
caller owns the Findings record and the Stubbed flag
(set to Yes when no analysis has run, e.g. an Etherscan-only fetch
where no NatSpec or sources are available).
Web3.Ui.SecurityCard.view []
{ findings =
Web3.Ui.SecurityCard.findings
{ critical = 0
, high = 2
, medium = 5
, low = 11
, info = 8
}
, topFindings =
[ { severity = High
, title = "Centralization risk -- onlyOwner can mint"
, tool = "slither"
}
, { severity = High
, title = "Reentrancy in withdraw()"
, tool = "slither"
}
, { severity = Medium
, title = "Missing zero-address check in setOracle"
, tool = "aderyn"
}
]
, toolVersions = [ ( "slither", "0.10.4" ), ( "aderyn", "0.5.1" ) ]
, stubbed = NotStubbed
, reportUrl = Just "/dapp/1/0x.../report"
, onRequestAudit = Just RequestAudit
}CSS classes follow BEM: web3-security-card, web3-security-card__head,
web3-security-card__counts, web3-security-card__count,
web3-security-card__count--critical / --high / --medium / --low / --info,
web3-security-card__findings, web3-security-card__finding,
web3-security-card__finding-severity, web3-security-card__finding-title,
web3-security-card__finding-tool, web3-security-card__tools,
web3-security-card__actions, web3-security-card__disclaimer.
Configuration for view.
Per-severity counts.
Construct a Findings value.
One specific finding from a tool.
Severity stops.
Whether real analysis ran or the card is rendering the "not-available" state. Etherscan-only fetches don't carry the metadata needed for analysis, and during early development the analyser may be stubbed.
Render the card.