Commit the August 2026 Protofire report

[thedavidmeister]

Closes #133.

Commits the Protofire report attached to #133 as audit/protofire/rain.string.79b2f4fd3fbd0e21b8e757d94abd361178cefa62.aug-2026.pdf, beside the January report and in its layout. No README change: the report and git are the record.

What the report says

Cumulative (v3.0, August 2026): the two January reviews at 0b1ca08a and f7ff702a, plus a third on 27 August 2026 at 79b2f4fd, which is main today. Scope is ErrParse.sol, LibConformString.sol, LibParseChar.sol, LibParseCMask.sol, LibParseDecimal.sol. Three medium findings, all found at 0b1ca08a, nothing low or informational:

• M01 conformStringToMask / charFromMask loop forever on a zero mask. main reverts EmptyStringMask on mask == 0 in both.
• M02 unsafeDecimalStringToInt reverse loop underflows when start == 0. main handles start == 0 before the loops.
• M03 the reroll can never land in the mask when mask and candidate range are disjoint. main derives the reroll modulus from the mask's own bit length, so every candidate range reaches a set bit.

The report's "Fixed at" hashes (3641d652, 18b9c91b, 40b602de, c09ae695) are January commits that are not on main by hash; the changes reached main under other hashes. The guards above are what main carries at 79b2f4fd.

QA

• nix develop -c reuse lint: "compliant with version 3.3 of the REUSE Specification"; REUSE.toml already covers audit/**/.
• git rev-parse origin/main is 79b2f4fd, the audited commit; git diff --stat 79b2f4fd..origin/main -- src/ is empty.
• Each guard named above is read from origin/main (src/lib/mut/LibConformString.sol, src/lib/parse/LibParseDecimal.sol, src/error/ErrConform.sol).
• Discriminating tests: n/a, a document; no code the suite runs changes.
• Mutations applied: n/a, no source touched.
• Oracle: the report's Reviews table, scope and per-finding Status lines (text extracted with pdftotext), and git for the commit and the guards.
• Category check: Audit report: attach the PDF here, then commit it under audit/ #133 asks that the attached PDF be committed under audit/. Done, nothing else.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EyWWorieTJV9FmMm2JM6Ua

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• audit/protofire/rain.string.79b2f4fd3fbd0e21b8e757d94abd361178cefa62.aug-2026.pdf is excluded by !**/*.pdf

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 2de06143-3f60-4085-9d1c-1e62668b9a14

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}