Review what a proof of concept actually demonstrates

What the check reads

The default-on document-stage advisory warning covers active KnownIssues meeting min_severity, medium by default, across severity, code_severity or bounty_severity. It also covers externally reported or submission-intended issues regardless of grade. It requires poc_quality and checks the applicable recorded answers. Web3-only rules and reasoned not-applicable entries are handled according to project context and rule eligibility.

An illustrative case

Illustrative case: a request bypasses validation only when the test calls an internal helper after the public guard. That shows a downstream behavior, not necessarily a reachable attack. Exercise the public entry point with the modeled actor and include a safe control request. Record both observed outcomes and narrow the finding if the stronger attack cannot be established.

Resolve the finding

1. Identify whether severity or external-report intent placed the issue in scope.
2. Review the applicable checklist against the actual PoC, including reachability, control behavior, deployment relevance and honest impact.
3. Repair missing evidence before marking answers true. Record justified exceptions only where permitted and rerun the check.

proof audit --check poc_quality_checked

Keep the conclusion bounded

The checker reads booleans and justifications; it does not independently run or evaluate the PoC. Lowering severity does not remove an externally reported issue from scope. A clear checklist remains a review record, with the execution output and impact argument still required to assess the finding.

Continue with one real issue

Known issue poc quality effective · Submission validated

Bring one finding, its requirement and the current evidence to scope a walkthrough of what your reviewer can establish and what still needs work.