Connect a change to its affected invariants and authority.
LET’S PICTURE IT
A small edit to a master key rule can matter more than a large formatting change.
SEE IT FOR YOURSELF
A valid counter call, step by stepStep 1 / 4
This example begins with count zero and a request to call increment(). No real contract is deployed.
This example begins with count zero and a request to call increment(). No real contract is deployed.Execution follows the code’s input and permission rules. A website button is not the access-control mechanism.The function reads zero, calculates zero plus one, and writes one to persistent storage.The accepted state contains count one. Later reads can inspect it. Events are emitted only if the code implements them.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Identify the behavior change
Write a concrete before-and-after example. A diff’s line count does not measure how much authority or accounting behavior changed.
Trace affected paths
Review callers, shared state, callbacks, upgrades and failure handling that rely on the changed behavior. Local function reasoning may miss cross-component effects.
Evaluate the tests
Look for a regression test that would fail on the old bug and checks the intended property. A test copied from implementation steps can preserve the same mistaken assumption.
Report actionable findings
State the trigger, consequence and relevant code location. Keep uncertainty and required assumptions explicit so the author can reproduce the concern.