Tool 09 · Reference · Free
Severity Explorer
Severity is impact multiplied by likelihood, not how clever the bug is. Here is exactly what each level means to us, the finding classes that land there, and the remediation each usually needs.
At a glance
Severity Explorer
Run it
The matrix behind these levels
| Impact ↓ / Likelihood → | Low | Medium | High |
|---|---|---|---|
| Catastrophic — total loss / insolvency | Medium | High | Critical |
| Severe — significant loss | Low | Medium | High |
| Moderate — bounded loss / broken accounting | Low | Low | Medium |
| Minor — no direct value at risk | Info | Low | Low |
Likelihood accounts for preconditions: capital required, privileged access needed, market conditions, and whether the attack is one transaction or a sequence someone can interrupt.
How it works
What this tool does, and what it can't.
A severity scale is only useful if it is applied the same way every time, by everyone, and written down where clients can check it. Ours is a matrix: impact on one axis, likelihood on the other, with the reasoning for each rating recorded in the report.
The discipline that keeps it honest is the proof of concept. If we cannot demonstrate a finding against a fork, we downgrade it and label it theoretical — even when it is interesting. That single rule removes most of the incentive to inflate.
Where a client disagrees with a rating, their position goes in the report next to ours rather than replacing it. A reader can then decide, which is more useful than a number both parties quietly negotiated.
A flaw that lets an unprivileged attacker directly steal or permanently freeze funds, mint unbacked value, or take control of the protocol — with no preconditions beyond what any address can do. Reentrancy draining a vault, an unrestricted mint, oracle manipulation enabling undercollateralised borrowing, a callable initializer on a proxy.
Preconditions. A Critical is exploitable by anyone, immediately. A High needs something specific — particular market conditions, a race, significant capital, or a semi-trusted actor misbehaving. The impact may be similar; the likelihood is not.
Low findings compound. A missing zero-address check or a single-step ownership transfer is harmless until the next upgrade makes it reachable, and they accumulate into the conditions where a High becomes possible. Informational findings have no security impact and exist because clean code is auditable code.
It is deliberately compatible. Our Critical maps to their Critical, and the impact-times-likelihood reasoning is the same — so a finding rated here translates cleanly into a bounty submission or a contest report without renegotiating the scale.
We do, and we show our reasoning. Clients frequently push back, which is healthy. What we will not do is quietly downgrade a finding because a client asked, or inflate one to look thorough.
Beyond automation
No tool reads your specification. We do.
The findings that drain protocols come from state assumptions, economic design and cross-contract interaction — none of which a scanner sees. Free scoping in under two working days.