pinoc 0.3.5

A CLI tool for setting up pinocchio program project
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

use crate::check::contract::{Backend, Category, Confidence, Finding, Lint, Severity};
use crate::check::facts::{Handler, Validation};

/// An account named like a known singleton (`config`/`settings`) read as trusted
/// state without checking its key, letting an attacker substitute a look-alike.
pub struct Acc003Confusion;

impl Lint for Acc003Confusion {
    fn code(&self) -> &'static str {
        "ACC003-P"
    }
    fn id(&self) -> &'static str {
        "account-confusion"
    }
    fn category(&self) -> Category {
        Category::Acc
    }
    fn backend(&self) -> Backend {
        Backend::Syn
    }
    fn default_severity(&self) -> Severity {
        Severity::Warn
    }
    fn default_confidence(&self) -> Confidence {
        Confidence::Heuristic
    }

    fn run_handlers(&self, handlers: &[Handler]) -> Vec<Finding> {
        let mut out = Vec::new();
        for handler in handlers {
            for b in &handler.bindings {
                if !is_identity_name(&b.name) {
                    continue;
                }
                if b.delegated
                    || !b.reads_data()
                    || b.validations.contains(&Validation::KeyCompared)
                {
                    continue;
                }
                let Some(site) = &b.read_site else {
                    continue;
                };
                out.push(Finding {
                    code: self.code(),
                    id: self.id(),
                    confidence: self.default_confidence(),
                    severity: self.default_severity(),
                    span: site.to_span(),
                    evidence: format!(
                        "account `{}` is read as a known singleton but its key is never checked against the expected address; an attacker can pass a look-alike account",
                        b.name
                    ),
                    fix: Some(format!(
                        "compare `{}.key()` to the expected address (or the derived PDA) before reading it",
                        b.name
                    )),
                });
            }
        }
        out
    }
}

fn is_identity_name(name: &str) -> bool {
    name == "config"
        || name == "settings"
        || name.ends_with("_config")
        || name.ends_with("_settings")
}