docs: Olympix security-report presentation

[olympixdemo]

What this is

Three independent Olympix runs against CMTAT, collected into one reviewable page. Full write-up (with tables, collapsibles, and links to every artifact) lives in docs/olympix/report.md.

At a glance

Tool	What it measured	Headline result
BugPoCer	End-to-end exploit generation	21 true-positive findings — 2 High · 7 Medium · 12 Low
Mutation testing	Does the test suite catch bugs?	87.1% killed (81 / 93) — 10 of 12 survivors equivalent
Fuzzing (symbolic)	Adversarial path reachability	35,188 paths → 27,252 feasible, 0 exploitable path this run

High findings

1. Missing deactivation guard on forcedBurn — forcedBurn skips the validation path and can destroy a frozen holder's tokens after deactivateContract(). Runnable PoC.
2. Unchecked over-frozen balance underflow — absolute setFrozenTokens can exceed balance; over-freezing address(0) can globally brick minting.

Layout

tests/olympix/pocs/              # 8 confirmed runnable exploit tests
docs/olympix/
   ├── bugpocer/                 # BugPoCer scan report (PDF, 43pp)
   ├── mutation_testing/         # raw 93-mutant CSV
   └── fuzz_testing/             # fuzz report (PDF, 7pp)
   └── report.md                 # the combined presentation

Session IDs and reproducibility details are in the report footer.

[rya-sge]

Thank you for the PR.

1. This is expected. We don't want new tokens minted or transferred, but we allow to reduce the total supply if the issueur has forgotten to do it before deactivating the contract

2. It is already fixed for the next release (see dev branch)

[robotrobo]

Hey @rya-sge , thanks for your response. Did you also get a chance to look at the mutation test results? What did you think about those?

[rya-sge]

Hello @robotrobo ,

Thank you for your message and for running the tool on CMTAT.

Regarding mutation testing, I have found them interesting and we have added one supplementary test, see 8d3029d17e0c57db4fe192ff4ab878734544b0c5

If your company agrees, it would be great if we can put the report (the report only) with our feedback file in the security tool directory of CMTAT.

Could it be possible ?

Best!