# clarity_prescan report

files scanned: 4 — findings: 13

## HIGH
- `CLR-SECRET-IN-FILE` hostile/Mainnet.toml:5 — key/mnemonic literal in a mainnet-named config — committed secret material
- `CLR-SECRET-IN-FILE` hostile/vault.clar:0 — constant `signing-key` holds a long literal under a secret-shaped name — committed key material
- `CLR-MINT-NOAUTH` hostile/vault.clar:9 — public fn `mint` mints (ft-mint?/nft-mint?) with no caller gate — unguarded supply
- `CLR-TRANSFER-NOAUTH` hostile/vault.clar:13 — public fn `drain` moves funds that are not the caller's (contract or stored principal as sender) with no caller identity anywhere in the body
- `CLR-AS-CONTRACT` hostile/vault.clar:13 — `drain` moves contract-held funds via as-contract with no caller identity in the body — the contract balance is callable by anyone
## MEDIUM
- `CLR-SECRET-IN-FILE` hostile/Clarinet.toml:8 — key/mnemonic literal in config — devnet defaults are expected; verify this is the throwaway account, not a funded key
- `CLR-STATE-NOAUTH` hostile/vault.clar:18 — public fn `set-cfg` writes state (var-set/map-set/map-delete/map-insert) with no caller identity or gate in the body
- `CLR-DYNAMIC-CALL` hostile/vault.clar:23 — contract-call? target `target` is a caller-supplied principal arg with no trait bound — any contract can sit behind it
- `CLR-BLOCK-RAND` hostile/vault.clar:33 — miner-influenceable selection — block-derived value used as entropy or a pick; validators can nudge it
- `CLR-UNWRAP-PANIC` hostile/vault.clar:38 — 1 panic-unwraps on fallible sources (map-get? x1) — a forced abort bricks the call path; prefer unwrap!/asserts! with typed errors
## LOW
- `CLR-CALL-IGNORED` hostile/vault.clar:28 — contract-call? in statement position — the response is discarded; a failed upstream call reads as success downstream
- `CLR-DEPRECATED-HEIGHT` hostile/vault.clar:33 — 2 bare block-height read(s) at lines 33, 45 — deprecated under Clarity 3; use stacks-block-height (or burn-block-height for burnchain comparisons)
- `CLR-ASSERT-TRUE` hostile/vault.clar:42 — asserts! on a tautology — the guard cannot fail; the check it was meant to hold is missing