pub struct SecurityCheckMeta {
pub id: &'static str,
pub name: &'static str,
pub severity: &'static str,
pub description: &'static str,
pub details: &'static str,
pub remediation: &'static str,
pub category: &'static str,
pub blocks_deployment: bool,
}
pub const REENTRANCY: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-001",
name: "Reentrancy",
severity: "high",
description: "Detects reentrancy vulnerabilities where external calls can recurse into the contract",
details: "Functions that make external calls after state changes can be re-entered, allowing attackers to drain funds or manipulate state. Common in withdraw patterns without checks-effects-interactions.",
remediation: "Follow checks-effects-interactions pattern. Use ReentrancyGuard from OpenZeppelin. Always update state before making external calls.",
category: "Access Control",
blocks_deployment: true,
};
pub const ACCESS_CONTROL: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-002",
name: "Access Control",
severity: "high",
description: "Detects missing or incorrect access control modifiers",
details: "Functions that perform privileged operations without proper access control can be called by anyone. Common issues: missing onlyOwner, incorrect modifier checks, public init functions.",
remediation: "Use OpenZeppelin's Ownable or AccessControl. Ensure all privileged functions have proper modifiers. Avoid using tx.origin for authorization.",
category: "Access Control",
blocks_deployment: true,
};
pub const DELEGATECALL: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-003",
name: "Delegatecall",
severity: "high",
description: "Detects unsafe delegatecall usage that can lead to storage corruption or code execution",
details: "delegatecall executes code from another contract in the caller's context. Unsafe patterns can lead to storage collisions, unexpected state changes, or malicious code execution in proxy patterns.",
remediation: "Validate delegatecall targets. Use a whitelist of allowed implementations. Check storage layout compatibility between proxy and implementation contracts.",
category: "Access Control",
blocks_deployment: true,
};
pub const TX_ORIGIN: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-004",
name: "tx.origin Usage",
severity: "high",
description: "Detects tx.origin usage for authentication which is vulnerable to phishing",
details: "Using tx.origin for authorization allows intermediary contracts to impersonate the original caller. This can lead to phishing attacks where users lose funds.",
remediation: "Use msg.sender instead of tx.origin for authorization. tx.origin should only be used in very specific cases where you need the original external account.",
category: "Access Control",
blocks_deployment: true,
};
pub const CREATE2: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-005",
name: "CREATE2 Vulnerabilities",
severity: "high",
description: "Detects issues with CREATE2 deterministic address deployment",
details: "CREATE2 allows deterministic contract addresses but can lead to address squatting, selfdestruct-recreate attacks, and unexpected contract replacement.",
remediation: "Use CREATE2 with salt derived from deployer-specific data. Consider adding deployment timeouts. Verify expected contract code at the computed address.",
category: "Deployment",
blocks_deployment: true,
};
pub const DOS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-006",
name: "Denial of Service",
severity: "high",
description: "Detects patterns that can lead to denial of service",
details: "Loops over dynamic arrays, unbounded gas consumption, reverting on expected external calls, and reliance on specific gas amounts can all be exploited to DoS the contract.",
remediation: "Use pull-over-push patterns for payments. Avoid iterating over dynamic arrays. Design for failure. Set reasonable gas limits for external calls.",
category: "Logic",
blocks_deployment: true,
};
pub const STORAGE_COLLISION: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-007",
name: "Storage Collision",
severity: "high",
description: "Detects storage layout collisions in upgradeable contracts",
details: "In proxy patterns, changing the storage layout between implementations can cause variable collisions, corrupting contract state and potentially leading to loss of funds.",
remediation: "Maintain storage layout compatibility. Always append new variables. Use OpenZeppelin's upgradeable contracts plugin. Never reorder or delete existing state variables.",
category: "Upgradeability",
blocks_deployment: true,
};
pub const UNSAFE_ASSEMBLY: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-008",
name: "Unsafe Assembly",
severity: "high",
description: "Detects unsafe inline assembly usage",
details: "Inline assembly bypasses Solidity's safety checks. Common issues: incorrect slot calculations, unsafe memory operations, and missing overflow checks in assembly arithmetic.",
remediation: "Minimize assembly usage. Validate all assembly operations carefully. Use Solidity's built-in functions when possible. Add extensive testing around assembly blocks.",
category: "Security",
blocks_deployment: true,
};
pub const SELFDESTRUCT: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-009",
name: "Selfdestruct",
severity: "high",
description: "Detects selfdestruct usage that can destroy contract code",
details: "selfdestruct removes contract code and sends remaining ETH to a target address. In proxy patterns, selfdestruct can brick the proxy. Can also be used for CREATE2 address manipulation.",
remediation: "Avoid selfdestruct in upgradeable contracts. If necessary, use a timelock and multi-sig. Consider using SELFDESTRUCT only as a last resort with proper access control.",
category: "Security",
blocks_deployment: true,
};
pub const PROXY_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-010",
name: "Proxy Vulnerabilities",
severity: "high",
description: "Detects proxy-related security issues",
details: "Proxy contracts introduce unique vulnerabilities: uninitialized implementations, selector clashes, unsafe delegatecall targets, and storage collisions.",
remediation: "Initialize implementations to prevent selfdestruct. Use transparent or UUPS patterns correctly. Verify storage layout compatibility. Test upgrade paths thoroughly.",
category: "Upgradeability",
blocks_deployment: true,
};
pub const ORACLE_MANIPULATION: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-011",
name: "Oracle Manipulation",
severity: "high",
description: "Detects oracle price feed manipulation vulnerabilities",
details: "Using a single price oracle or a manipulable DEX price as an oracle can lead to price manipulation attacks, especially in lending, staking, and AMM protocols.",
remediation: "Use decentralized oracles like Chainlink. Implement TWAP or median pricing. Use multiple oracle sources and outlier detection. Add price deviation checks.",
category: "DeFi",
blocks_deployment: true,
};
pub const SIGNATURE_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-012",
name: "Signature Vulnerabilities",
severity: "high",
description: "Detects signature verification vulnerabilities",
details: "Common issues: missing nonces allowing replay attacks, no expiry, EIP-2612 permit frontrunning, and signature malleability in ecrecover.",
remediation: "Include nonce, deadline, and chain ID in signed data. Use EIP-712 typed signatures. Prevent signature replay across chains. Use OpenZeppelin's SignatureChecker.",
category: "Cryptography",
blocks_deployment: true,
};
pub const REPLAY_ATTACKS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-013",
name: "Replay Attacks",
severity: "high",
description: "Detects cross-chain replay attack vulnerabilities",
details: "Without chain ID and nonce tracking in signatures, the same message can be replayed on different chains or multiple times, leading to unauthorized actions.",
remediation: "Include chainId and nonce in all signed messages. Track used nonces to prevent reuse. Use EIP-712 for structured signing with domain separator.",
category: "Cross-Chain",
blocks_deployment: true,
};
pub const ERC20_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-014",
name: "ERC20 Issues",
severity: "high",
description: "Detects ERC20 implementation vulnerabilities",
details: "Common issues: missing return values, fee-on-transfer tokens, rebasing tokens, flash minting, and approval race conditions (the approve-frontrun issue).",
remediation: "Use OpenZeppelin's ERC20 implementation. Handle non-standard tokens safely. Use increaseAllowance/decreaseAllowance instead of approve. Check return values.",
category: "Standards",
blocks_deployment: true,
};
pub const BRIDGE_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-015",
name: "Bridge Vulnerabilities",
severity: "high",
description: "Detects cross-chain bridge vulnerabilities",
details: "Bridge attacks can lead to catastrophic fund loss. Common issues: validator set manipulation, message relaying flaws, insufficient confirmation thresholds, and signature verification bugs.",
remediation: "Use battle-tested bridge architectures. Implement proper validator management. Add rate limiting and circuit breakers. Use fraud proofs or validity proofs where possible.",
category: "Cross-Chain",
blocks_deployment: true,
};
pub const FLASH_LOAN_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-016",
name: "Flash Loan Issues",
severity: "high",
description: "Detects flash loan attack vector vulnerabilities",
details: "Protocols using spot prices, insufficient liquidity checks, or manipulable oracles are vulnerable to flash loan attacks that can drain protocol funds.",
remediation: "Use TWAP or manipulated-resistant oracles. Implement minimum liquidity requirements. Use time-weighted average prices. Add circuit breakers for abnormal price movements.",
category: "DeFi",
blocks_deployment: true,
};
pub const MEV_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-017",
name: "MEV Vulnerabilities",
severity: "high",
description: "Detects maximal extractable value vulnerabilities",
details: "Frontrunning, sandwich attacks, and backrunning can extract value from users. Common issues: public mempool transactions with no slippage protection, visible order details.",
remediation: "Use commit-reveal schemes. Implement slippage protection. Use private mempools or MEV protection. Batch operations atomically. Add minimum output amounts.",
category: "DeFi",
blocks_deployment: true,
};
pub const CROSS_CHAIN_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-018",
name: "Cross-Chain Issues",
severity: "high",
description: "Detects general cross-chain interoperability vulnerabilities",
details: "Cross-chain operations introduce unique risks: chain reorganization, message ordering, token representation mismatches, and bridge dependency risks.",
remediation: "Design for chain reorgs with confirmation requirements. Use canonical token representations. Ensure message atomicity. Add fallback mechanisms for bridge failures.",
category: "Cross-Chain",
blocks_deployment: true,
};
pub const DEPENDENCY_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-019",
name: "Dependency Vulnerabilities",
severity: "high",
description: "Detects vulnerable or malicious dependencies",
details: "Using outdated or compromised dependencies can introduce vulnerabilities. Common issues: pinning to vulnerable versions, no integrity checks, and supply chain attacks.",
remediation: "Pin dependency versions. Use integrity verification (e.g., SRI). Keep dependencies updated. Audit dependency changes. Use tools like Dependabot or Snyk.",
category: "Dependencies",
blocks_deployment: true,
};
pub const UNSAFE_IMPORTS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-020",
name: "Unsafe Imports",
severity: "high",
description: "Detects unsafe or suspicious imports",
details: "Importing from untrusted sources, outdated versions, or suspicious-looking contracts can introduce vulnerabilities or malicious code into the project.",
remediation: "Use trusted sources only (OpenZeppelin, Solmate, etc.). Pin to specific versions. Verify import integrity. Use forge remappings consistently.",
category: "Dependencies",
blocks_deployment: true,
};
pub const UNSAFE_INITIALIZERS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-021",
name: "Unsafe Initializers",
severity: "high",
description: "Detects uninitialized upgradeable contracts",
details: "Implementation contracts without initialized guards can be selfdestructed. Proxy contracts can have their initializer called multiple times without reinitializer guards.",
remediation: "Use OpenZeppelin's Initializable with initializer modifier. Use reinitializer for version upgrades. Call disableInitializers in the implementation constructor.",
category: "Upgradeability",
blocks_deployment: true,
};
pub const UNSAFE_UPGRADE_PATHS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-022",
name: "Unsafe Upgrade Paths",
severity: "high",
description: "Detects unsafe contract upgrade paths",
details: "Upgradeable contracts need carefully managed upgrade paths. Common issues: storage layout breaks, missing reinitializers, and upgradeability without timelocks.",
remediation: "Use a timelock for upgrades. Maintain storage layout compatibility. Test upgrade paths. Use UUPS or transparent proxy patterns correctly.",
category: "Upgradeability",
blocks_deployment: true,
};
pub const CLONE_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-H-023",
name: "Clone/ Minimal Proxy Issues",
severity: "high",
description: "Detects minimal proxy (EIP-1167) vulnerabilities",
details: "Clones share implementation storage and logic. Issues: uninitialized clones, implementation selfdestruct, and immutable variable expectations in proxied contracts.",
remediation: "Initialize each clone individually. Protect implementation from selfdestruct. Ensure clones have proper access control. Use Clones with initializer patterns.",
category: "Deployment",
blocks_deployment: true,
};
pub const GAS_PROBLEMS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-001",
name: "Gas Problems",
severity: "medium",
description: "Detects gas-inefficient patterns",
details: "Unbounded loops, redundant storage operations, repeated computations, and high-gas patterns can make contracts expensive or unusable.",
remediation: "Optimize storage usage. Use local variables. Minimize on-chain computations. Use appropriate data structures. Consider using ERC-1167 for clones.",
category: "Gas",
blocks_deployment: false,
};
pub const UNSAFE_CASTING: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-002",
name: "Unsafe Casting",
severity: "medium",
description: "Detects unsafe type casting operations",
details: "Downcasting without overflow checks can lead to truncation. address payable conversions can fail silently. bytes<T> to string casts can produce invalid UTF-8.",
remediation: "Use OpenZeppelin's SafeCast library for downcasting. Validate addresses before payable conversion. Use string(bytes) carefully. Add input validation.",
category: "Logic",
blocks_deployment: false,
};
pub const TIMESTAMP_MANIPULATION: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-003",
name: "Timestamp Manipulation",
severity: "medium",
description: "Detects reliance on block.timestamp for critical logic",
details: "block.timestamp can be manipulated by miners within a ~15-second window. Using it for critical randomness or time- sensitive logic is unsafe.",
remediation: "Use block.number for time intervals when possible. Don't use timestamp for randomness. Allow reasonable timestamp variance. Use trusted oracles for precise time.",
category: "Logic",
blocks_deployment: false,
};
pub const STORAGE_INEFFICIENCIES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-004",
name: "Storage Inefficiencies",
severity: "medium",
description: "Detects storage layout and packing inefficiencies",
details: "Poor storage layout wastes gas and can lead to slot overflow. Variables that fit in fewer slots should be packed together. Unnecessary storage variables increase costs.",
remediation: "Pack related state variables into fewer slots. Use appropriate data types (uint128, uint64, etc.). Delete unused storage. Use mappings for dynamic data.",
category: "Gas",
blocks_deployment: false,
};
pub const UNSAFE_EVENTS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-005",
name: "Unsafe Events",
severity: "medium",
description: "Detects events missing indexed parameters or emitting sensitive data",
details: "Events can leak sensitive information as they are stored on-chain permanently. Missing indexed parameters makes filtering difficult for off-chain services.",
remediation: "Index important parameters for efficient filtering. Never emit sensitive data in events. Follow the indexed parameter limit (max 3). Use EIP- standards for event signatures.",
category: "Best Practices",
blocks_deployment: false,
};
pub const POOR_VISIBILITY: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-006",
name: "Poor Visibility Definitions",
severity: "medium",
description: "Detects incorrect or unsafe visibility modifiers",
details: "Functions marked as public or external when they should be internal or private can expand the attack surface. State variables exposed publicly may be unintended.",
remediation: "Use the most restrictive visibility modifier possible. Audit all public functions. Consider using external for functions only called externally. Mark state variables as private.",
category: "Best Practices",
blocks_deployment: false,
};
pub const BAD_MODIFIERS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-007",
name: "Bad Modifiers",
severity: "medium",
description: "Detects unsafe or incorrect modifier patterns",
details: "Modifiers that perform state changes, external calls, or have incorrect guard conditions can introduce vulnerabilities. Modifier side-effects are often unexpected.",
remediation: "Keep modifiers simple and read-only. Avoid external calls in modifiers. Don't create side effects in modifiers. Use functions instead of complex modifier logic.",
category: "Best Practices",
blocks_deployment: false,
};
pub const UNSAFE_MATH: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-008",
name: "Unsafe Math Patterns",
severity: "medium",
description: "Detects math operations without proper overflow protection",
details: "While Solidity 0.8+ has built-in overflow checking, unchecked blocks and assembly math bypass these checks. Division before multiplication loses precision.",
remediation: "Use checked math by default. Only use unchecked blocks when overflow is impossible. Use FixedPointMath libraries for precision. Add input bounds.",
category: "Logic",
blocks_deployment: false,
};
pub const POOR_ACCESS_PATTERNS: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-M-009",
name: "Poor Access Patterns",
severity: "medium",
description: "Detects suboptimal access patterns that increase gas or risk",
details: "Reading and writing storage repeatedly in loops, accessing storage when memory suffices, and redundant SLOAD operations waste gas and increase execution cost.",
remediation: "Cache storage reads in memory. Batch state changes. Minimize SLOAD/SSTORE operations. Use appropriate data structures for access patterns.",
category: "Gas",
blocks_deployment: false,
};
pub const NAMING_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-L-001",
name: "Naming Issues",
severity: "low",
description: "Detects naming convention violations",
details: "Inconsistent naming (mixedCase for functions, UPPER_CASE for constants, etc.) makes code harder to read and audit. Misleading names can hide vulnerabilities.",
remediation: "Follow Solidity style guide: camelCase for functions and variables, UPPER_CASE for constants, underscore prefix for private. Use descriptive names.",
category: "Style",
blocks_deployment: false,
};
pub const CODE_DUPLICATION: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-L-002",
name: "Code Duplication",
severity: "low",
description: "Detects repeated code patterns",
details: "Duplicate code increases maintenance burden and audit surface. Changes to one copy may not be applied to all, leading to inconsistency and potential bugs.",
remediation: "Extract common logic into internal functions or libraries. Use inheritance for shared functionality. Consider using modifiers for reusable checks.",
category: "Architecture",
blocks_deployment: false,
};
pub const OPTIMIZATION_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-L-003",
name: "Optimization Suggestions",
severity: "low",
description: "Detects optimization opportunities",
details: "Using more gas than necessary due to suboptimal patterns: redundant operations, unnecessary storage, inefficient data structures, or missing compiler optimizations.",
remediation: "Enable compiler optimizer. Pack storage variables. Use calldata instead of memory for read-only parameters. Minimize external calls. Use appropriate data types.",
category: "Gas",
blocks_deployment: false,
};
pub const STYLE_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-I-001",
name: "Style Issues",
severity: "informational",
description: "Detects style guide violations",
details: "Deviations from the Solidity Style Guide: incorrect indentation, missing or extra spaces, ordering of functions (external, public, internal, private), and NatSpec comments.",
remediation: "Follow the official Solidity Style Guide. Use forge fmt for automatic formatting. Add NatSpec documentation to all functions. Use consistent layouts.",
category: "Style",
blocks_deployment: false,
};
pub const DOCUMENTATION_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
id: "FA-I-002",
name: "Missing Documentation",
severity: "informational",
description: "Detects missing or insufficient NatSpec documentation",
details: "Contracts, functions, and state variables without NatSpec comments are harder to audit and maintain. Documentation is critical for security review.",
remediation: "Add @notice, @param, @return, @dev tags to all functions. Document state variables. Add custom errors documentation. Include usage examples and security assumptions.",
category: "Documentation",
blocks_deployment: false,
};
pub const ALL_CHECKS: &[SecurityCheckMeta] = &[
REENTRANCY,
ACCESS_CONTROL,
DELEGATECALL,
TX_ORIGIN,
CREATE2,
DOS,
STORAGE_COLLISION,
UNSAFE_ASSEMBLY,
SELFDESTRUCT,
PROXY_VULNERABILITIES,
ORACLE_MANIPULATION,
SIGNATURE_VULNERABILITIES,
REPLAY_ATTACKS,
ERC20_ISSUES,
BRIDGE_VULNERABILITIES,
FLASH_LOAN_ISSUES,
MEV_ISSUES,
CROSS_CHAIN_ISSUES,
DEPENDENCY_VULNERABILITIES,
UNSAFE_IMPORTS,
UNSAFE_INITIALIZERS,
UNSAFE_UPGRADE_PATHS,
CLONE_VULNERABILITIES,
GAS_PROBLEMS,
UNSAFE_CASTING,
TIMESTAMP_MANIPULATION,
STORAGE_INEFFICIENCIES,
UNSAFE_EVENTS,
POOR_VISIBILITY,
BAD_MODIFIERS,
UNSAFE_MATH,
POOR_ACCESS_PATTERNS,
NAMING_ISSUES,
CODE_DUPLICATION,
OPTIMIZATION_ISSUES,
STYLE_ISSUES,
DOCUMENTATION_ISSUES,
];
pub const fn check_count() -> usize {
ALL_CHECKS.len()
}