Benchmark wave 7 (less-known repos): results + manual triage CSV

[omarespejel]

Benchmark Pack: Wave 7 (Less-Known Cairo Repos)

This issue contains a full manual-triage package for a benchmark wave focused on less famous Starknet/Cairo community projects.

• Scan ID: community-wave7-less-known-2026-03-09
• Date: 2026-03-09
• Repos scanned: 5
• Total findings: 4
• Failures: 0

Repositories

1. sambarnes/cairo-multisig
2. StarkLinkVRF/VRF-StarkNet
3. astraly-labs/astraly-contracts
4. CarmineOptions/konoha
5. tohrnii/flashloan-starknet

High-level results

• Findings were produced in 1/5 repos.
• All 4 findings were in CarmineOptions/konoha.
• Class distribution:
  • IMMEDIATE_UPGRADE_WITHOUT_TIMELOCK: 1
  • IRREVOCABLE_ADMIN: 2
  • CONSTRUCTOR_DEAD_PARAM: 1

Per-repo wall time

• sambarnes/cairo-multisig: 0.887s
• StarkLinkVRF/VRF-StarkNet: 0.965s
• astraly-labs/astraly-contracts: 1.053s
• CarmineOptions/konoha: 1.511s
• tohrnii/flashloan-starknet: 1.022s
• Total: 5.438s
• Average: 1.088s/repo

CSV: repo summary

repo,ref,all_cairo_files,prod_cairo_files,prod_hits
sambarnes/cairo-multisig,0b79a460acfc9bca98880400a92f5694ee0b3146,6,6,0
StarkLinkVRF/VRF-StarkNet,2693e8c0866b1c2ba8e1be2889dd931ec48ceb60,16,11,0
astraly-labs/astraly-contracts,50c8430f5add24183444fe021cd225a0cc07aed3,28,23,0
CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,33,21,4
tohrnii/flashloan-starknet,4169683c6dc22bd4151c969d749bbbfd9b9c1d22,13,10,0

CSV: findings

repo,ref,file,class_id,scope
CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/govtoken.cairo,IMMEDIATE_UPGRADE_WITHOUT_TIMELOCK,prod_scan
CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/govtoken.cairo,IRREVOCABLE_ADMIN,prod_scan
CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/token.cairo,CONSTRUCTOR_DEAD_PARAM,prod_scan
CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/voting_token.cairo,IRREVOCABLE_ADMIN,prod_scan

CSV: manual triage sheet

finding_id,repo,ref,file,class_id,scope,detector_label,manual_verdict,manual_notes
CW7-001,CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/govtoken.cairo,IMMEDIATE_UPGRADE_WITHOUT_TIMELOCK,prod_scan,tp,,
CW7-002,CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/govtoken.cairo,IRREVOCABLE_ADMIN,prod_scan,tp,,
CW7-003,CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/token.cairo,CONSTRUCTOR_DEAD_PARAM,prod_scan,tp,,
CW7-004,CarmineOptions/konoha,052e361a2c1332222ce51872a7080e448e5f68a3,src/voting_token.cairo,IRREVOCABLE_ADMIN,prod_scan,tp,,

CSV: per-repo timing

repo,seconds_wall,status,returncode,ref,all_cairo_files,prod_cairo_files,prod_hits,findings_total,failures_total
sambarnes/cairo-multisig,0.887,ok,0,0b79a460acfc9bca98880400a92f5694ee0b3146,6,6,0,0,0
StarkLinkVRF/VRF-StarkNet,0.965,ok,0,2693e8c0866b1c2ba8e1be2889dd931ec48ceb60,16,11,0,0,0
astraly-labs/astraly-contracts,1.053,ok,0,50c8430f5add24183444fe021cd225a0cc07aed3,28,23,0,0,0
CarmineOptions/konoha,1.511,ok,0,052e361a2c1332222ce51872a7080e448e5f68a3,33,21,4,4,0
tohrnii/flashloan-starknet,1.022,ok,0,4169683c6dc22bd4151c969d749bbbfd9b9c1d22,13,10,0,0,0

Requested manual-auditor action

1. Fill manual_verdict (tp / fp) and manual_notes for CW7-001..CW7-004.
2. Confirm whether IRREVOCABLE_ADMIN in konoha is true risk or expected design.
3. Confirm whether CONSTRUCTOR_DEAD_PARAM in src/token.cairo is a real dead parameter or acceptable placeholder.