Holdfast — Aderyn static analysis
====================================
Tool:     Aderyn 0.6.8 (Cyfrin)
Date:     2026-07-15 (UTC)
Commit:   a85eb33598f4d946ce524e86916fe6ae85b67f30
Contract: contracts/TimeLockVault.sol (solc 0.8.24)
Command:  aderyn --src contracts/ .

Result: 3 findings, all LOW, all cosmetic or irrelevant on Base
(see SECURITY.md). 0 high, 0 medium.
----------------------------------------------------------------------

# Aderyn Analysis Report

This report was generated by [Aderyn](https://github.com/Cyfrin/aderyn), a static analysis tool built by [Cyfrin](https://cyfrin.io), a blockchain security company. This report is not a substitute for manual audit or security review. It should not be relied upon for any purpose other than to assist in the identification of potential security vulnerabilities.
# Table of Contents

- [Summary](#summary)
  - [Files Summary](#files-summary)
  - [Files Details](#files-details)
  - [Issue Summary](#issue-summary)
- [Low Issues](#low-issues)
  - [L-1: Large Numeric Literal](#l-1-large-numeric-literal)
  - [L-2: PUSH0 Opcode](#l-2-push0-opcode)
  - [L-3: Unspecific Solidity Pragma](#l-3-unspecific-solidity-pragma)


# Summary

## Files Summary

| Key | Value |
| --- | --- |
| .sol Files | 1 |
| Total nSLOC | 75 |


## Files Details

| Filepath | nSLOC |
| --- | --- |
| contracts/TimeLockVault.sol | 75 |
| **Total** | **75** |


## Issue Summary

| Category | No. of Issues |
| --- | --- |
| High | 0 |
| Low | 3 |


# Low Issues

## L-1: Large Numeric Literal

Large literal values multiples of 10000 can be replaced with scientific notation.Use `e` notation, for example: `1e18`, instead of its full numeric value.

<details><summary>1 Found Instances</summary>


- Found in contracts/TimeLockVault.sol [Line: 178](../../../../../home/kp/projects/holdfast/contracts/TimeLockVault.sol#L178)

	```solidity
	        fee = (amount * feeBps) / 10_000;
	```

</details>



## L-2: PUSH0 Opcode

Solc compiler version 0.8.20 switches the default target EVM version to Shanghai, which means that the generated bytecode will include PUSH0 opcodes. Be sure to select the appropriate EVM version in case you intend to deploy on a chain other than mainnet like L2 chains that may not support PUSH0, otherwise deployment of your contracts will fail.

<details><summary>1 Found Instances</summary>


- Found in contracts/TimeLockVault.sol [Line: 2](../../../../../home/kp/projects/holdfast/contracts/TimeLockVault.sol#L2)

	```solidity
	pragma solidity ^0.8.24;
	```

</details>



## L-3: Unspecific Solidity Pragma

Consider using a specific version of Solidity in your contracts instead of a wide version. For example, instead of `pragma solidity ^0.8.0;`, use `pragma solidity 0.8.0;`

<details><summary>1 Found Instances</summary>


- Found in contracts/TimeLockVault.sol [Line: 2](../../../../../home/kp/projects/holdfast/contracts/TimeLockVault.sol#L2)

	```solidity
	pragma solidity ^0.8.24;
	```

</details>