feat(v4.2): Fix mojibake encoding, add 3 new gas rules (6 total), add cargo audit timeout, add pyproject.toml

Author: Maxwell Voss

gas_optimizer.py

@@ -51,6 +51,38 @@ def optimize_contract(self, contract_path: str) -> Dict[str, Any]:
                     })
                     total_gas_saved += 25
 
+            # 4. Calldata vs Memory for external functions
+            if re.search(r'function\s+\w+\s*\([^)]*\bmemory\b[^)]*\)\s*(external|public)', line):
+                self.gas_findings.append({
+                    "line": line_num,
+                    "issue": "Memory parameter in external function",
+                    "recommendation": "Use 'calldata' instead of 'memory' for external function parameters to save gas on copy operations.",
+                    "gas_saved_est": 200
+                })
+                total_gas_saved += 200
+
+            # 5. Constants that should be immutable
+            if re.search(r'(public|private|internal)\s+(address|uint256|bytes32)\s+\w+\s*=\s*', line):
+                if 'constant' not in line and 'immutable' not in line:
+                    self.gas_findings.append({
+                        "line": line_num,
+                        "issue": "State variable could be immutable",
+                        "recommendation": "If this variable is only set in the constructor, mark it as 'immutable' to save ~2100 gas per access.",
+                        "gas_saved_est": 2100
+                    })
+                    total_gas_saved += 2100
+
+            # 6. Unchecked arithmetic opportunities
+            if re.search(r'\b(i\s*\+\+|i\s*\+=\s*1)\b', line) and 'unchecked' not in line:
+                if 'for' not in line:  # Skip loop counters already caught
+                    self.gas_findings.append({
+                        "line": line_num,
+                        "issue": "Safe arithmetic without unchecked block",
+                        "recommendation": "Wrap safe increment operations in 'unchecked {}' block to save ~120 gas (Solidity >=0.8.0).",
+                        "gas_saved_est": 120
+                    })
+                    total_gas_saved += 120
+
         return {
             "status": "success",
             "findings_count": len(self.gas_findings),

pyproject.toml

@@ -0,0 +1,38 @@
+[project]
+name = "solidity-security-scanner"
+version = "2.0.0"
+description = "AI-powered smart contract security scanner for Solidity, Rust, and Solana"
+readme = "README.md"
+license = {text = "MIT"}
+requires-python = ">=3.11"
+authors = [
+    {name = "Maxwell VOSS"}
+]
+keywords = [
+    "solidity", "ethereum", "smart-contracts", "security", "blockchain",
+    "defi", "web3", "solana", "rust", "github-actions", "vulnerability-scanner",
+    "static-analysis", "slither", "foundry", "gas-optimization", "reentrancy"
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3.11",
+]
+
+[project.urls]
+Homepage = "https://github.com/mvmax-dev/solidity-security-scanner"
+Repository = "https://github.com/mvmax-dev/solidity-security-scanner"
+Issues = "https://github.com/mvmax-dev/solidity-security-scanner/issues"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = "test_*.py"
+addopts = "-v --tb=short"
+
+[tool.flake8]
+max-line-length = 127
+max-complexity = 10
+exclude = [".git", "__pycache__", "dashboard", "venv"]

solana_scanner.py

@@ -29,7 +29,8 @@ def scan(self) -> Dict[str, Any]:
                 ["cargo", "audit", "--json"],
                 cwd=self.workspace,
                 capture_output=True,
-                text=True
+                text=True,
+                timeout=120  # 2 minutes max
             )
 
             # Simple check

vulnerability_validator.py

@@ -1,12 +1,12 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
-"""Maxwell VOSS — Strict Vulnerability Validator.
+"""Maxwell VOSS - Strict Vulnerability Validator.
 
 3-Phase validation pipeline before any finding reaches the sales pipeline:
 
-  Phase A: Slither JSON — real dataflow analysis
-  Phase B: Context check — CEI pattern, access control, modifiers
-  Phase C: Confidence scoring — only findings >= 70/100 pass
+  Phase A: Slither JSON -> real dataflow analysis
+  Phase B: Context check -> CEI pattern, access control, modifiers
+  Phase C: Confidence scoring -> only findings >= 70/100 pass
 
 This module is the QUALITY GATE. A finding that fails this gate
 is NEVER sold, NEVER reported as valid, and logged as false positive.