other
Error
- Location
review_engine.py:146- Finding
Risk Scoring Logic Reports More Dangerous Contracts as Safer
- Content
View full analysis
int: """Calculate overall risk score (0-100, lower is better).""" if not findings: return 10 # Low risk if no issues found weights = { RiskLevel.CRITICAL: 25, RiskLevel.HIGH: 15, RiskLevel.MEDIUM: 8, RiskLevel.LOW: 3 } total_penalty = sum(weights[f.risk_level] for f in findings) penalty = min(total_penalty, 90) return 10 + penalty ``` ```python # contract_reviewer.py:61-70 # Determine risk level label (lower score means higher risk) if risk_score >= 80: risk_label = "LOW" elif risk_score >= 60: risk_label = "MEDIUM" elif risk_score >= 40: risk_label = "HIGH" else: risk_label = "CRITICAL" ``` ```python # batch_reviewer.py:190-199 def _score_to_level(self, score: int) -> str: """Convert risk score to level label""" if score >= 80: return "LOW" elif score >= 60: return "MEDIUM" elif score >= 40: return "HIGH" else: return "CRITICAL" ``` ### Technical Analysis Each finding adds a positive penalty to the score. Consequently, more findings and more severe findings produce a higher score. The two output formatters, however, interpret higher scores as lower risk. For example, four critical findings add 100 points before capping, producing a score of `100`. Both formatters classify that result as `LOW`. Conversely, a contract with no findings receives a score of `10`, which is classified as `CRITICAL`. This is an integrity failure in a security-sensitive decision-support function. Although it does not directly grant system access, it reverses the central safety conclusion delivered t ...[truncated 789 chars]- Remediation
View remediation