I almost reported a critical bug that didn't exist. One constant saved me.

Short summary

A smart-contract auditor nearly reported a critical overflow bug that didn't exist because they assumed RAY was 1e27 instead of the actual 1e18. With real constants, overflow would require 2.3 quadrillion years without a state update. The post argues that the real bottleneck in automated auditing is false-positive noise, not finding issues, and shares concrete false-positive classes to eliminate from pattern-matching detectors.

• •Always verify actual constant values before writing up a bug claim — assumptions create false positives
• •A scanner that can't stay silent on OpenZeppelin's 248 reviewed files has no business flagging your code
• •Common false-positive classes: virtual-shares +1 in ERC-4626, permissionless emergencyWithdraw, and assembly-based auth

Generated with AI, which can make mistakes.