Structural analysis: 7 HIGH-severity issues found

[Cranot]

We ran a full 9-pass structural analysis pipeline on the ERC-8183 specification using Prism Oracle and found 10 issues (7 HIGH, 3 MEDIUM).

HIGH-severity

1. setBudget() authorization mismatch — Spec says client OR provider, implementation restricts to provider only
2. Missing expectedBudget field — No front-running protection for budget negotiation
3. _msgSender() not used despite ERC-2771 mention — Meta-transactions broken
4. Hook reentrancy via afterAction — No reentrancy guards on hook execution
5. Hook whitelist lacks removal mechanism — Unbounded gas accumulation
6. Budget negotiation deadlock — No timeout, interaction locks permanently
7. Evaluator fee incentive distortion — Pays per-evaluation regardless of quality

MEDIUM-severity

8. Missing event emissions for state transitions
9. No maximum evaluator count (unbounded gas)
10. Hardcoded USD denomination assumption

Conservation Law

Decision Centralization × Temporal Efficiency = Constant — more evaluators produce better decisions but lock capital longer.

Full report (2,595 lines): https://github.com/Cranot/prism-oracle/blob/master/examples/erc8183-full-pipeline.md

Built for Synthesis Hackathon 2026 — Prism Oracle