feat: Integrate with Foundry test suite to correlate findings with test coverage

[Nanle-code]

Overview

Foundry is the dominant smart contract development framework. ChainProof can provide significantly more value by correlating its static findings with existing Foundry tests — identifying which findings already have test coverage, which are untested, and generating test stubs for unexercised vulnerability patterns.

Proposed Integration

Phase 1: Test Coverage Correlation

1. Run forge coverage --report lcov to generate LCOV data
2. Parse LCOV to determine which lines are covered
3. For each ChainProof finding, check if the flagged line is covered
4. Add testCoverage: boolean to Finding — if true, a test exercises this code path

Phase 2: Test Stub Generation

For findings with no test coverage, generate a Foundry test stub:

// Auto-generated by ChainProof — test stub for CP-107 at Vault.sol:42
contract VaultReentrancyTest is Test {
    Vault vault;
    AttackContract attacker;

    function setUp() public {
        vault = new Vault();
        attacker = new AttackContract(address(vault));
    }

    function test_reentrancy_withdraw_line42() public {
        // TODO: fund vault and attacker, then call attacker.attack()
        vm.expectRevert();
        attacker.attack();
    }
}

Phase 3: Invariant Test Hints

For CP-101 (overflow) findings, suggest property-based invariant test functions using Foundry's vm.assume and assertLe patterns.

CLI Flags

chainproof scan contracts/ --foundry --coverage-report lcov.info
chainproof scan contracts/ --generate-tests test/chainproof/

Acceptance Criteria

• LCOV parser in packages/core/src/integrations/lcov.ts
• testCoverage: boolean field on Finding
• Coverage correlation shown in Markdown report and terminal table
• Test stub generator for CP-107, CP-101, CP-115, CP-116
• --foundry CLI flag that auto-detects and runs forge coverage
• --generate-tests CLI flag
• Generated test files compile with Foundry without modification

[Guddy0101]

Hello Maintainer !!!!!
This issue is something i can resolve, Please do assign it to me so i can fix it, Thank you.

[Babigdk]

Proposal: Foundry Integration for ChainProof (Coverage + Test Generation)

I’d like to implement the Foundry integration to correlate ChainProof findings with existing tests and generate missing test coverage.

Scope of Work:

• Add LCOV parser (lcov.ts) to read forge coverage output
• Map coverage data to findings and add testCoverage: boolean
• Implement correlation logic between findings and covered lines
• Extend CLI with --foundry (auto-runs coverage)
• Add --coverage-report support
• Generate Foundry test stubs for uncovered findings (CP-107, CP-101, CP-115, CP-116)
• Add --generate-tests output to test/chainproof/
• Support basic invariant test hints using vm.assume / assertLe patterns
• Ensure generated tests compile cleanly in Foundry

Deliverables:

• LCOV integration + coverage mapping
• Enhanced findings with coverage metadata
• Test stub generator for vulnerable patterns
• CLI flags: --foundry, --coverage-report, --generate-tests
• Working generated Foundry test suite compatible with forge test

[ZuLu0890]

I would like to work on this issue

[Codekill33]

Hello, i can work on this issue. I'll implement Foundry integration for ChainProof by adding LCOV-based test coverage correlation, test stub generation for uncovered findings, Foundry CLI flags, and coverage reporting to help developers identify untested vulnerabilities and generate security-focused tests automatically.
Please assign me to this issue. Thank you
ETA ~ 6 hours

[Chucks1093]

Hello, my name is Sebastian and I am a full stack engineer with experience building developer tools and working across application and backend systems.

This issue stood out to me because I like the idea of making security findings more actionable instead of only reporting them.

For this task, my plan is to break the work into phases.

First, implement the LCOV parser and connect coverage data to findings so each finding can show whether the affected code path already has test coverage.

Second, add support for generating Foundry test templates for uncovered findings and make sure generated tests compile without extra changes.

Third, work on the CLI flow and reporting so the experience feels natural when using the tool.

I have been contributing to open source recently and I enjoy working on tooling that improves developer workflows.

Would love to take this up and contribute.

[grantfox-oss]

🦊 GrantFox — @Chucks1093 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #12)
2. Your PR will be reviewed by the StellarChainproof maintainers

Good luck! Track your progress on GrantFox.