severity-classification

Smart contract vulnerability severity is classified by evaluating the intersection of potential impact and exploitation likelihood. This rubric defines Critical, High, Medium, Low, and Informational levels to standardize security audit reporting and risk assessment.

A Critical severity finding typically involves direct fund loss, such as a direct fund drain, whereas a High severity finding involves conditional or indirect asset loss. Severity levels are defined by specific criteria illustrating the exact impact and likelihood of the vulnerability.

This vulnerability classification aligns with common industry standards used by the blockchain security community, including Code4rena, Sherlock, and Immunefi. It facilitates consistent security audit reporting by mirroring established framework criteria.

To determine if a reentrancy vulnerability is a Medium or Critical issue, evaluate the specific impact and likelihood. A Critical issue involves a direct fund drain, while a Medium issue involves conditional fund loss, guiding remediation efforts accurately.

You need a severity classification rubric for security audit reporting after identifying vulnerabilities, such as through automated scans. It provides a standardized framework to determine risk levels and ensures professional, consistent reporting for remediation.