Trail of Bits’ dimensional-analysis skill now checks the math a comment calls correct
Trail of Bits’ dimensional-analysis skill now checks the math a code comment calls correct
Trail of Bits merged version 3.1.0 of its dimensional-analysis skill, which hunts unit and decimal bugs in code like Solidity contracts. Its validator now traces the math even where a comment says the conversion is correct. If you audit DeFi code with it, a stale comment can no longer wave a bad formula through.
A comment saying the math is right no longer exempts it
Version 3.0.3 told the validator to skip conversions that carried an explanatory comment, and edge cases the docs said were handled. Both exemptions are gone. A contract whose header calls it dimensionally sound now gets its dimensions traced like any other.
A test run cleared a contract by quoting its own comment
“a run cleared the contract by quoting it, voiding the precision measurement”
A dimensional bug that a nearby comment denies is the bug most likely to survive review.
During testing, a contract carried a tag calling it dimensionally correct, and a run cleared the whole contract by quoting that tag instead of checking its arithmetic. Comments go stale, and a unit bug hiding under a reassuring comment is the one a reviewer is most likely to miss.
Unsure findings still get reported, at low severity
When the validator is unsure, it must still report the finding, downgraded and labelled needs review. A missed unit bug reaches the client, while a low note costs a reviewer a moment. Critical and high are kept for bugs whose dimensions it has traced.
Overflow and reentrancy stay out of the unit report
Findings now cover unit mismatches, scaling errors and bad conversions only. Overflow, reentrancy, access control, denial of service and unchecked return values get one closing line at most, so general audit notes don't bury the unit bugs.
Asking about decimals now starts the skill
The old description waited for a request to annotate units or run a dimensional analysis. Now a request to review code for decimal mismatches, WAD and RAY scale errors, or the wrong token's decimals starts it too.
Callers and the code they call are now checked together
One validator sees both files, instead of one validator per file.
Bug detection used to start one validator per file. Now files are batched by call graph, so a single validator reads both sides of a call. A unit mismatch between two contracts is the kind most often missed when each side is checked alone.
A new test protocol hides five unit bugs, three of them across files
StakingRewards.sol is correct on purpose. A CRITICAL or HIGH finding there fails the test.
The plugin now ships a test protocol, a cross-margin borrowing protocol with five planted bugs. Here a borrow index with 27 decimals goes through an 18-decimal helper, and only another file shows the index's scale. A correct staking contract sits beside it to catch false alarms.
Claude Sonnet passed the old test without the plugin
The previous test put every bug in one contract, each with a giveaway nearby. Claude Sonnet found all five without the plugin, so the test couldn't tell the plugin apart from the bare model. The new one passes only with all five found and zero critical or high alarms on the correct contract.
dimensional-analysis 3.1.0 runs in Codex as well as Claude Code
Needs a writable target and native agent dispatch. No published score on the new test yet.
The same workflow now runs in Codex as well as Claude Code, with five subagents that scan, discover units, annotate, propagate and validate. It needs a writable target and native agent dispatch. Version 3.1.0 ships the new test without a published score on it. The change is pull request 371 in the Trail of Bits skills repository.
