DicksonWu654/web3-audit-corpus

What it is

web3-audit-corpus is a dataset of public smart contract audit reports and extracted findings, published by Dickson Wu. The 2026-10-22 snapshot covers 63 publishers (the page title says 64 firms and contest platforms, 11,854 audits and 159,784 findings, which is an older count). Audit years run from 2015 to 2026, with 2026 year to date. A companion repository, DicksonWu654/web3-audit-findings, holds one Markdown file per finding plus hub pages by firm, class, language, chain and project, a nodes and edges metadata graph, and an AGENTS.md for coding agents.

What to do

The intended use is as a local reference set for an AI coding assistant during an audit. Download the assets from the latest release and verify them against CHECKSUMS.sha256. Then pick the format that fits:

• audits-markdown.zip: one file per report with metadata and available finding text. Unzip it and open the folder in Claude Code, Codex or Cursor.
• findings.jsonl.gz, findings.parquet, findings.csv.gz: one row per finding, joined to publisher, project, year, scope, language, chain and original URL. Use these for SQL, Python or spreadsheets.
• engagements.csv, reports.csv, firms.csv: audit identities, report provenance and publisher metadata.
• quality.csv and taxonomy.yaml: measured extraction and annotation agreement, with denominators, and the vulnerability definitions.

The page gives an example prompt: "Before auditing this lending protocol, find similar oracle and liquidation findings, explain the recorded fixes, and turn them into a review checklist." The agent guide covers setup, DuckDB one-liners and example prompts. To fetch only one firm or vulnerability class from the findings repository, use the sparse clone described in its README. A full shallow clone is:

git clone --depth 1 https://github.com/DicksonWu654/web3-audit-findings

Caveats

• Extraction and annotation are AI-assisted and may contain errors. The page says to check the linked original report for any finding you rely on.
• Report text is source content. The page tells users to treat quoted report text as reference material and not as instructions, which matters when an agent reads it.
• Coverage is limited to the publishers in registry/scope_tier_a.csv, and by public disclosure, access restrictions and collection gaps. Some engagements have metadata and severity counts but no released finding rows. Withheld bodies point to the original report.
• Counts mix levels. Engagements merge joint audits, while publisher participations stay separate. Reports and findings can include revisions, and selected_for_stats marks the released rows in the selected initial streams.
• Licensing: code is MIT; derived metadata and annotations are CC BY 4.0. Finding text keeps the publishers' rights (see docs/RIGHTS.md), and RIGHTS_WITHHELD.csv records withholding. Oak Security excerpts keep CC BY-ND attribution and must stay verbatim. Corrections and publisher removal requests go through a GitHub issue with the report URL, finding ID and evidence.