[spalen0]

Why

Two Strategist Safe alerts were checked against outside reviews and on-chain state:

• Nonce 3372 (Grove auction floors, gist). The report:
  • said setMinimumAuctionPrice left the auction's pricing untouched; it sets Auction.minimumPrice;
  • described a 284k GROVE lot; the auction still held 698,582 GROVE unsold, so the lot was ~983k;
  • couldn't say where the 879.76 USDS of profit came from.
• Nonce 3373 (DebtAllocator rebalance, gist). The amounts were right, but the report had no vault context. It missed that yvWETH-2's looper exposure goes from 70.71 to 294.67 WETH (4.7% → 19.7%), and that what ordinary withdrawals can reach falls from 571.30 to 301.30 WETH (38.2% → 20.1%), because the looper is outside the default withdraw queue and has no DebtAllocator config.

Both gists were corrected by hand, pinned to their alert blocks, and keep their original LOW tag to match the Telegram alerts. Both transactions have since executed. 3372's actual lots (1,176,467 and 162,021 GROVE) match the model: the leftover plus rewards claimed by execution time.

What changed

Evidence the LLM sees

• Source context (utils/source_context.py):
  • Short function bodies (≤30 lines) are shown after the natspec. The prompt says the body wins when the two disagree, and that natspec describing what other code enforces is unverified unless that code is shown.
  • The overload is picked from the decoded signature, and contexts are deduplicated per signature. When the overload is ambiguous, no body is shown.
  • Fixed a natspec regex that let one comment block swallow every function declared before the target.
• Simulation (ai_explainer.py):
  • Each event names the contract that emitted it, and emitters are labelled and linked.
  • Transfer events that restate the listed token transfers are dropped.
• Observed vs forecast: the Protocol Context preamble and the system prompt now separate values read on-chain (verified) from the adapters' forecasts (amounts moved, lots, after-batch liquidity, exposure, ratios). Where the simulation differs, the simulation wins.

Yearn Auction adapter (new, yearn_auction_context.py)

Runs for strategies that have auction() and for direct Auction calls.

• What it reports:
  • pricing;
  • per-lot state: live, or unsold from an expired lot;
  • strategy-held and claimable rewards, and minAmountToSell;
  • idle want, stated without guessing where it came from;
  • floor vs DeFiLlama market price;
  • for each kick: the lot, its proceeds at the floor and at market, and the time to reach the floor.
• Trust rules: a strategy setter counts as an auction setter only when its verified body forwards the argument, and a report() only "kicks" when the verified harvest shows it.
• Batch replay: every call across all auctions replays in transaction order, and each strategy's balances and thresholds are shared across its auctions (setAuction A → B → A). It also covers:
  • lot liveness under the running settings (a lower floor can revive a decayed lot; setters revert while a lot is live);
  • disable / enable, sweeps, and the minAmountToSell gate;
  • out-of-range setter values described as reverting;
  • disable(address,uint256) read correctly.

Yearn V3 adapter (yearn_v3_context.py, yearn_v3_batch.py)

• DebtAllocator.update_debt(vault, strategy, target) is read as the vault's own call, with the allocator's maxDebtUpdateLoss.

• Nested vaults: every vault is walked in one global batch order, and flows are applied to the inner vault too:

  • deposits land in idle, or go through auto_allocate within the vault's deposit limits;
  • redemptions are served from idle, then the default queue in order.

  A parent's redemption limit is refreshed from the inner vault's liquidity, keeping owner-specific restrictions. When a deposit makes that limit unknowable, the model stops forecasting from that point instead of guessing.

• New lines:

  • exit liquidity before → after;
  • look-through exposure, with the held vault's off-queue holdings as an explicit bucket;
  • DebtAllocator config vs the debt ratio after the batch;
  • a flag for deposits into strategies outside the default queue.

• The prompt rates a sharp exit-liquidity cut, or funds that only a manual update_debt can reach, at least MEDIUM.

Smaller prompts

Facts shared across calls are stated once per batch: V3 and auction mechanics, the report() transfer note, and role explanations. Rendered sizes, before → after:

Adapter	Fixture	Before → after
Permission grants	10-removal batch	prompt 9,164 → 2,501; report 17,304 → 3,468
Pendle upgrades	two-entry fixture	7,119 → 3,820 (each call keeps its own line and initialization payload)
Infinifi farms	per-pair row; 3 pairs	999 → 555; 2,999 → 2,313
Yearn strategies	2× report()	1,780 → 1,213 (settings shown only when the calls touch them)

Telemetry

• Each LLM call records input, cached input, cache writes, output and latency (LLMUsage). The explainer keeps one StageUsage per stage (summary, critique-N = pass / revised / empty, detail) and logs one line per alert.
• resolve_protocol_context skips an adapter that fails while rendering, as it already did for one that fails while resolving.

Verification

• Pinned eval: each batch was run against an anvil fork at its alert block, with Tenderly at that block and historical prices, using Venice deepseek-v4-flash, the factory default. Results:
  • 3373 is correct and rated MEDIUM in every run;
  • 3372 is rated LOW in 3 of 4 samples, the same as the baseline, after fixing a loss-framed sentence that had pushed it to 3 of 4 MEDIUM.
• Cost: about $0.003 and 48s per alert; the detail stage takes 69% of the latency, and every critique passed in round 1.
• Live checks: adapter output on nonce 3372 matched the Tenderly AuctionKicked lot within 0.04%, and on 3373 the yvWETH-1 queue walk matched the simulation (OG WETH 659.20 → 389.20 → 659.20).
• Tests: two external review rounds' findings (11, then 4, then 2) are fixed, each with a regression test that fails on the previous code. uv run pytest tests/ passes; the 4 TestSafeApiQuota tests fail only locally, when a real SAFE_API_KEY is in .env, and the same on main. prek run --all-files passes.

Not in this PR

• Larger eval set: a broader set of pinned historical cases (high-risk and missing-data), scored for factual errors and missed risks separately from the risk tag.
• Prompt experiments: conditional system-prompt blocks, and aligning stage prompts so the shared context caches across stages. Both should be measured on that set.

🤖 Generated with Claude Code