How a false-positive bug report could destroy an auditor's credibility

A smart contract auditor nearly reported a critical overflow bug in a staking engine, but checking the actual constants revealed the overflow would take 2.3 × 10¹⁵ years to occur. The author emphasizes that avoiding false positives is crucial for maintaining trust, and that their scanner runs clean on all 248 OpenZeppelin source files. The lesson: verifying assumptions before reporting saves credibility and prevents wasted triage.