<a id="ch-01"></a>

## Chapter 1 — Advanced research integrity and methods

<!-- open-cyber-academy:lesson-figures:start ch-01 -->
### Lesson map

Lesson 01 published. Map, example, EX001.

```mermaid
flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The case"]
  N2["1.2 Coding findings"]
  N3["Lab — Coder agreement"]
  N4["1.3 Reading agreement"]
  N5["1.4 Integrity and disclosure"]
  N6["1.5 Validity from the start"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]
```

### Logical drawing

```mermaid
flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The case"]
  N2["1.2 Coding findings"]
  N3["Lab — Coder agreement"]
  N4["1.3 Reading agreement"]
  N5["1.4 Integrity and disclosure"]
  N6["1.5 Validity from the start"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
```

```text
[Learning outcomes]
    |
    v
[1.1 The case]
    |
    v
[1.2 Coding findings]
    |
    v
[Lab — Coder agreement]
    |
    v
[1.3 Reading agreement]
    |
    v
[1.4 Integrity and disclosure]
    |
    v
[1.5 Validity from the start]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]
```
<!-- open-cyber-academy:lesson-figures:end ch-01 -->


### Learning outcomes

You will (1) frame a doctoral question about smart-contract review quality; (2) build a reliable coding scheme for review findings; (3) set ethical rules for handling vulnerability data.

### 1.1 The case

Lucía Ferreyra is a doctoral candidate at the fictional Kestrel Institute of Technology, supervised by Prof. Henrik Aalto. Her lead partner is the fictional Harbourline Credit Union Consortium, which runs a permissioned Ethereum-compatible ledger for settlement between member credit unions, and two fictional open-source teams that build token and escrow contracts. Every contract, finding and figure in this book is synthetic. Her question is whether reviewing contracts against a structured checklist derived from public standards leaves fewer high-severity issues undetected than the usual unstructured expert review.

### 1.2 Coding findings

A study of review quality needs a way to label findings that two people apply identically. Lucía codes each finding into four categories drawn from the SWC registry and the OWASP Smart Contract Top 10: access control, external calls including re-entrancy, arithmetic and rounding, and other. Each category has a written definition, two positive examples, two near misses and a decision rule for overlaps, such as coding a missing permission check on an upgrade function as access control even when it involves an external call.

### Lab — Coder agreement

```python
"""Cohen's kappa for two coders labelling synthetic review findings (read-only)."""
from collections import Counter
CATS = ["access", "external-call", "arithmetic", "other"]
# 40 synthetic findings: (coder A label, coder B label)
PAIRS = ([("access", "access")] * 11 + [("external-call", "external-call")] * 9 +
         [("arithmetic", "arithmetic")] * 8 + [("other", "other")] * 7 +
         [("access", "other")] * 2 + [("external-call", "other")] * 2 + [("arithmetic", "access")])

def kappa(pairs):
    n = len(pairs)
    po = sum(a == b for a, b in pairs) / n
    ca, cb = Counter(a for a, _ in pairs), Counter(b for _, b in pairs)
    pe = sum(ca[c] * cb[c] for c in CATS) / n ** 2
    return po, pe, (po - pe) / (1 - pe)

def main():
    po, pe, k = kappa(PAIRS)
    print(f"items {len(PAIRS)}, agreed {sum(a == b for a, b in PAIRS)}")
    print(f"observed {po:.3f}, chance {pe:.3f}, kappa {k:.3f}")
    for (a, b), n in sorted(Counter(p for p in PAIRS if p[0] != p[1]).items()):
        print(f"disagree {a} -> {b}: {n}")

if __name__ == "__main__":
    main()
```

Run with `python3 lab_kappa.py`. Verified output:

```text
items 40, agreed 35
observed 0.875, chance 0.253, kappa 0.833
disagree access -> other: 2
disagree arithmetic -> access: 1
disagree external-call -> other: 2
```

### 1.3 Reading agreement

Two trained coders independently label forty synthetic findings and agree on thirty-five, an observed agreement of 0.875. Expected chance agreement from the category frequencies is 0.253, giving Cohen's kappa of 0.833, which Landis and Koch (1977) would call almost perfect, though Lucía treats such labels as rough guidance. Four of the five disagreements send a finding to other: two access and two external-call findings. That pattern shows the other category is absorbing borderline cases, so she tightens its definition before real coding begins.

### 1.4 Integrity and disclosure

Vulnerability data is dangerous: a description of an unfixed weakness in a deployed contract could help someone steal funds. Lucía's data agreement says that partners share findings only after fixes are deployed or the contract is retired, that all contract names and addresses are replaced with pseudonyms, and that no publication will include code or steps that would let a reader reproduce an attack. Findings are stored on an encrypted institute server with access logged. The ethics board approves the plan, including a rule for reporting any unfixed issue found during the study.

### 1.5 Validity from the start

Lucía separates three validity questions. Construct validity asks whether her four categories capture what practitioners mean by review quality, so she checks the codebook with two partner auditors. Internal validity asks whether any difference between procedures comes from the procedure rather than from reviewer skill or contract difficulty, which motivates random assignment and blinded checking later. External validity asks whether findings from a permissioned ledger and two open-source teams generalise to public decentralised finance, which she will discuss honestly rather than assume.

### Worked example

Lucía writes the research question, the four-category codebook and the disclosure agreement, then runs the forty-item agreement exercise. Kappa of 0.833 and a clear pattern of findings drifting into other lead to a tighter definition before real coding.

> **Synthetic case.** Lucía Ferreyra, Henrik Aalto, Kestrel Institute of Technology, Harbourline Credit Union Consortium and all contracts, findings and figures are synthetic; the SWC registry, OWASP Smart Contract Top 10 and Landis and Koch (1977) are real sources.

### Errors and limits

Kappa summarises agreement but hides where disagreement lies; inspect disagreements, and remember that high agreement does not prove the categories are the right ones.

### Exercises

- **EX001 — Research question.** State Lucía's research question. *Rubric:* 3 = whether checklist review leaves fewer high-severity issues than unstructured review;; 2 = checklist vs usual;; 1 = tools;; 0 = none.
- **EX002 — Category sources.** Which public sources shape the four categories? *Rubric:* 3 = SWC registry and OWASP Smart Contract Top 10;; 2 = SWC;; 1 = CVE;; 0 = none.
- **EX003 — Kappa value.** What kappa did the coders reach? *Rubric:* 3 = 0.833 from 35 of 40 agreed;; 2 = 0.83;; 1 = 0.875;; 0 = none.
- **EX004 — Disagreement pattern.** What pattern did the disagreements show? *Rubric:* 3 = four of five went to other;; 2 = other absorbs;; 1 = vague;; 0 = none.
- **EX005 — Disclosure rule.** When may partners share findings? *Rubric:* 3 = after fixes deployed or contract retired;; 2 = after fix;; 1 = anytime;; 0 = none.
- **EX006 — Publication limit.** What may never appear in publications? *Rubric:* 3 = code or steps that reproduce an attack;; 2 = attack steps;; 1 = names;; 0 = none.
- **EX007 — External validity.** What external validity concern does Lucía note? *Rubric:* 3 = permissioned ledger may not generalise to public DeFi;; 2 = generalisation;; 1 = vague;; 0 = none.

### Synthesis

A defensible study of review quality starts with a precise codebook, measured coder agreement and strict disclosure rules for vulnerability data.

### Continue studying — chapter 01 of 08

[← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02)

## Worked answers

<a id="answer-ex001"></a>
**EX001.** Whether structured checklist review leaves fewer high-severity issues undetected than usual unstructured expert review.

<a id="answer-ex002"></a>
**EX002.** The SWC registry and the OWASP Smart Contract Top 10.

<a id="answer-ex003"></a>
**EX003.** Kappa 0.833, with 35 of 40 findings agreed.

<a id="answer-ex004"></a>
**EX004.** Four of five disagreements sent findings to the other category.

<a id="answer-ex005"></a>
**EX005.** Only after fixes are deployed or the contract is retired.

<a id="answer-ex006"></a>
**EX006.** Code or steps that would let a reader reproduce an attack.

<a id="answer-ex007"></a>
**EX007.** Results from a permissioned ledger and two teams may not generalise to public decentralised finance.