# Open10 Auditor

A free, read-only, reproducible auditor for OPEN10-style projects.

## Properties

- Python standard library only.
- No wallet, signer, API key, private-key input, or transaction method.
- Offline by default.
- Optional RPC mode performs only `eth_chainId` and `eth_getCode` reads.
- Produces `audit-report.json` and `audit-report.md`.
- Records every input file, byte count, SHA-256, tool version, check, limitation, and report hash.
- Exit code `0` means no failed checks; exit code `1` means at least one check failed.

## Run

```bash
python3 auditor/open10_auditor.py audit \
  --project . \
  --output /tmp/open10-audit \
  --run-tests
```

Read-only deployed-code inspection:

```bash
python3 auditor/open10_auditor.py audit \
  --project . \
  --output /tmp/open10-audit-mainnet \
  --rpc-url https://mainnet.base.org \
  --chain-id 8453 \
  --address 0xYourToken \
  --address 0xYourRegistry
```

Do not pass private keys or signer configuration. The auditor does not accept them.

## Reproduction contract

Independent auditors should run from the same source commit or artifact bundle and compare:

1. `input_manifest_sha256`;
2. project path-independent file entries;
3. tool versions;
4. check results;
5. `report_sha256`.

A report is not a security certification. Static checks and bytecode presence are evidence, not proof of semantic correctness. Independent source review remains required.