solidity-pr-review

name	solidity-pr-review
description	Review Solidity contracts, tests, and deployment scripts for security, code structure, and maintainability. Use when asked to review PRs, audit changes, enforce Solidity best practices, or validate contract-level correctness and test quality in this repository.

Solidity PR Review

Use this workflow to review contract changes with a security-first lens.

Review scope

Inspect these areas first:

1. policy-engine/contracts/src
2. vault/contracts/src
3. chainlink-cre-car-value-insurance/contracts/src
4. chainlink-cre-car-price-oracle/contracts/src
5. matching tests in each contracts/test folder
6. matching deploy scripts in each contracts/script folder

Process

1. Read changed files and identify behavior changes, not only style changes.
2. Check invariants and state-machine transitions (purchase, claim, payout, expiry, ownership transfer).
3. Check external calls, authorization, and value movement.
4. Check event emission and argument correctness.
5. Check test quality (happy path + revert paths + edge cases).
6. Return findings ordered by severity with file and line references.

Minimum security checks

Always verify:

1. Access control on admin and payout functions.
2. Reentrancy/call-order risks around value transfers.
3. Timestamp usage (block.timestamp) and expiry boundaries.
4. Integer math and decimal domain mismatches (e8 vs e6 vs wei).
5. Proper handling of zero-address and zero-value cases.
6. Correct custom errors and revert reasons for integration-facing failures.

Repository-specific rules

Treat these as hard requirements unless the user explicitly approves a protocol change:

1. Keep policy identity as tokenId == policyId.
2. Preserve locked events:
3. PolicyPurchased(uint256,address,bytes32,uint128,uint256,uint64)
4. PolicyClaimed(uint256,address,uint256,uint128,uint64)
5. Optional PremiumPaid(uint256,uint256)
6. Preserve feed hashing rule: keccak256(bytes(feedKeyString)).
7. Preserve oracle report decimal format: priceUsdE8.
8. Preserve settlement token assumptions: USDC-style 6 decimals in interfaces.

Security checklist

1. Restrict admin methods with role checks (onlyOwner, onlyManager, etc.).
2. Ensure claimed and similar flags update before external value transfer calls.
3. Prevent claims on non-existent, expired, or already-claimed policies.
4. Validate transfer return values for ERC-20 interactions.
5. Keep unit domains explicit (priceUsdE8, coverageUSDC, wei).
6. Reject stale or invalid oracle data where logic depends on freshness.
7. Emit integration-critical events consistently and in locked field order.

Output contract

Return:

1. Findings with severity and precise file references.
2. Missing tests and exact test cases to add.
3. Safe to merge? as yes, no, or yes-with-followups.