benedictbrady/prop-amm

• Repository: https://github.com/benedictbrady/prop-amm
• Commit: 47dd714c50c57e9da8f433f71ecc5b7c8a1c7c9a
• Generated: 2026-11-13T23:47:20+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

• Explicitly attributed share (lower bound): 100.0%
• Unattributed share in AI-consistent velocity bursts: 0.0%
• Estimated AI-generated share: 100.0%

Current source lines last changed by AI-attributed commits: 4,196 of 4,196.

Too few lines in one group to compare finding densities.

• Stylometry index: 0.95 per 1,000 lines (narrated steps 4, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.

Evidence

• Claude Code: trailer 'Co-Authored-By: Claude' (47dd714c50c5)
• step-by-step narration comment: // Step 1: Initialize pool (client/src/i)
• step-by-step narration comment: // Step 2: Create/Get vault ATAs (client/src/i)
• step-by-step narration comment: // Step 3: Set vaults (client/src/i)
• step-by-step narration comment: // Step 4: Update Oracle with piecewise curves (PRICES ONLY) (client/src/i)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.07, no CI test run detected; 23% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing.

• Functions: 130; mean complexity 3.4, 90th percentile 9; 4 complex and 3 long functions
• Duplicated lines: 7.6% of 2,998 compared
• Tests: 278 test lines for 4,196 source lines (ratio 0.07); CI test commands: none detected; 100% of recent source commits also change tests
• Docs missing or thin: license, contributing, changelog

Most complex functions:

• process_swap in programs/prop-amm/src/instructions/swap.rs: complexity 37, 172 lines
• process_withdraw in programs/prop-amm/src/instructions/withdraw.rs: complexity 27, 108 lines
• process_deposit in programs/prop-amm/src/instructions/deposit.rs: complexity 25, 93 lines
• message in programs/prop-amm/src/error.rs: complexity 19, 23 lines
• main in client/src/init-piecewise-pool.ts: complexity 4, 110 lines

Security

Security posture is weak: 37 known vulnerabilities in 28 dependencies. Weakest area: posture.

• Known vulnerabilities: 37 in 28 packages (critical 0, high 5, medium 9, low 6)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

• Source lines: 4,196; test lines: 278