forge_guard/security/

checks.rs

//! Security check definitions — all vulnerability types organized by severity.

/// Metadata for a single security check.
pub struct SecurityCheckMeta {
    pub id: &'static str,
    pub name: &'static str,
    pub severity: &'static str,
    pub description: &'static str,
    pub details: &'static str,
    pub remediation: &'static str,
    pub category: &'static str,
    pub blocks_deployment: bool,
}

// ─────────────────────────────────────────────────────────────────
// HIGH severity checks
// ─────────────────────────────────────────────────────────────────

pub const REENTRANCY: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-001",
    name: "Reentrancy",
    severity: "high",
    description: "Detects reentrancy vulnerabilities where external calls can recurse into the contract",
    details: "Functions that make external calls after state changes can be re-entered, allowing attackers to drain funds or manipulate state. Common in withdraw patterns without checks-effects-interactions.",
    remediation: "Follow checks-effects-interactions pattern. Use ReentrancyGuard from OpenZeppelin. Always update state before making external calls.",
    category: "Access Control",
    blocks_deployment: true,
};

pub const ACCESS_CONTROL: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-002",
    name: "Access Control",
    severity: "high",
    description: "Detects missing or incorrect access control modifiers",
    details: "Functions that perform privileged operations without proper access control can be called by anyone. Common issues: missing onlyOwner, incorrect modifier checks, public init functions.",
    remediation: "Use OpenZeppelin's Ownable or AccessControl. Ensure all privileged functions have proper modifiers. Avoid using tx.origin for authorization.",
    category: "Access Control",
    blocks_deployment: true,
};

pub const DELEGATECALL: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-003",
    name: "Delegatecall",
    severity: "high",
    description: "Detects unsafe delegatecall usage that can lead to storage corruption or code execution",
    details: "delegatecall executes code from another contract in the caller's context. Unsafe patterns can lead to storage collisions, unexpected state changes, or malicious code execution in proxy patterns.",
    remediation: "Validate delegatecall targets. Use a whitelist of allowed implementations. Check storage layout compatibility between proxy and implementation contracts.",
    category: "Access Control",
    blocks_deployment: true,
};

pub const TX_ORIGIN: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-004",
    name: "tx.origin Usage",
    severity: "high",
    description: "Detects tx.origin usage for authentication which is vulnerable to phishing",
    details: "Using tx.origin for authorization allows intermediary contracts to impersonate the original caller. This can lead to phishing attacks where users lose funds.",
    remediation: "Use msg.sender instead of tx.origin for authorization. tx.origin should only be used in very specific cases where you need the original external account.",
    category: "Access Control",
    blocks_deployment: true,
};

pub const CREATE2: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-005",
    name: "CREATE2 Vulnerabilities",
    severity: "high",
    description: "Detects issues with CREATE2 deterministic address deployment",
    details: "CREATE2 allows deterministic contract addresses but can lead to address squatting, selfdestruct-recreate attacks, and unexpected contract replacement.",
    remediation: "Use CREATE2 with salt derived from deployer-specific data. Consider adding deployment timeouts. Verify expected contract code at the computed address.",
    category: "Deployment",
    blocks_deployment: true,
};

pub const DOS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-006",
    name: "Denial of Service",
    severity: "high",
    description: "Detects patterns that can lead to denial of service",
    details: "Loops over dynamic arrays, unbounded gas consumption, reverting on expected external calls, and reliance on specific gas amounts can all be exploited to DoS the contract.",
    remediation: "Use pull-over-push patterns for payments. Avoid iterating over dynamic arrays. Design for failure. Set reasonable gas limits for external calls.",
    category: "Logic",
    blocks_deployment: true,
};

pub const STORAGE_COLLISION: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-007",
    name: "Storage Collision",
    severity: "high",
    description: "Detects storage layout collisions in upgradeable contracts",
    details: "In proxy patterns, changing the storage layout between implementations can cause variable collisions, corrupting contract state and potentially leading to loss of funds.",
    remediation: "Maintain storage layout compatibility. Always append new variables. Use OpenZeppelin's upgradeable contracts plugin. Never reorder or delete existing state variables.",
    category: "Upgradeability",
    blocks_deployment: true,
};

pub const UNSAFE_ASSEMBLY: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-008",
    name: "Unsafe Assembly",
    severity: "high",
    description: "Detects unsafe inline assembly usage",
    details: "Inline assembly bypasses Solidity's safety checks. Common issues: incorrect slot calculations, unsafe memory operations, and missing overflow checks in assembly arithmetic.",
    remediation: "Minimize assembly usage. Validate all assembly operations carefully. Use Solidity's built-in functions when possible. Add extensive testing around assembly blocks.",
    category: "Security",
    blocks_deployment: true,
};

pub const SELFDESTRUCT: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-009",
    name: "Selfdestruct",
    severity: "high",
    description: "Detects selfdestruct usage that can destroy contract code",
    details: "selfdestruct removes contract code and sends remaining ETH to a target address. In proxy patterns, selfdestruct can brick the proxy. Can also be used for CREATE2 address manipulation.",
    remediation: "Avoid selfdestruct in upgradeable contracts. If necessary, use a timelock and multi-sig. Consider using SELFDESTRUCT only as a last resort with proper access control.",
    category: "Security",
    blocks_deployment: true,
};

pub const PROXY_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-010",
    name: "Proxy Vulnerabilities",
    severity: "high",
    description: "Detects proxy-related security issues",
    details: "Proxy contracts introduce unique vulnerabilities: uninitialized implementations, selector clashes, unsafe delegatecall targets, and storage collisions.",
    remediation: "Initialize implementations to prevent selfdestruct. Use transparent or UUPS patterns correctly. Verify storage layout compatibility. Test upgrade paths thoroughly.",
    category: "Upgradeability",
    blocks_deployment: true,
};

pub const ORACLE_MANIPULATION: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-011",
    name: "Oracle Manipulation",
    severity: "high",
    description: "Detects oracle price feed manipulation vulnerabilities",
    details: "Using a single price oracle or a manipulable DEX price as an oracle can lead to price manipulation attacks, especially in lending, staking, and AMM protocols.",
    remediation: "Use decentralized oracles like Chainlink. Implement TWAP or median pricing. Use multiple oracle sources and outlier detection. Add price deviation checks.",
    category: "DeFi",
    blocks_deployment: true,
};

pub const SIGNATURE_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-012",
    name: "Signature Vulnerabilities",
    severity: "high",
    description: "Detects signature verification vulnerabilities",
    details: "Common issues: missing nonces allowing replay attacks, no expiry, EIP-2612 permit frontrunning, and signature malleability in ecrecover.",
    remediation: "Include nonce, deadline, and chain ID in signed data. Use EIP-712 typed signatures. Prevent signature replay across chains. Use OpenZeppelin's SignatureChecker.",
    category: "Cryptography",
    blocks_deployment: true,
};

pub const REPLAY_ATTACKS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-013",
    name: "Replay Attacks",
    severity: "high",
    description: "Detects cross-chain replay attack vulnerabilities",
    details: "Without chain ID and nonce tracking in signatures, the same message can be replayed on different chains or multiple times, leading to unauthorized actions.",
    remediation: "Include chainId and nonce in all signed messages. Track used nonces to prevent reuse. Use EIP-712 for structured signing with domain separator.",
    category: "Cross-Chain",
    blocks_deployment: true,
};

pub const ERC20_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-014",
    name: "ERC20 Issues",
    severity: "high",
    description: "Detects ERC20 implementation vulnerabilities",
    details: "Common issues: missing return values, fee-on-transfer tokens, rebasing tokens, flash minting, and approval race conditions (the approve-frontrun issue).",
    remediation: "Use OpenZeppelin's ERC20 implementation. Handle non-standard tokens safely. Use increaseAllowance/decreaseAllowance instead of approve. Check return values.",
    category: "Standards",
    blocks_deployment: true,
};

pub const BRIDGE_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-015",
    name: "Bridge Vulnerabilities",
    severity: "high",
    description: "Detects cross-chain bridge vulnerabilities",
    details: "Bridge attacks can lead to catastrophic fund loss. Common issues: validator set manipulation, message relaying flaws, insufficient confirmation thresholds, and signature verification bugs.",
    remediation: "Use battle-tested bridge architectures. Implement proper validator management. Add rate limiting and circuit breakers. Use fraud proofs or validity proofs where possible.",
    category: "Cross-Chain",
    blocks_deployment: true,
};

pub const FLASH_LOAN_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-016",
    name: "Flash Loan Issues",
    severity: "high",
    description: "Detects flash loan attack vector vulnerabilities",
    details: "Protocols using spot prices, insufficient liquidity checks, or manipulable oracles are vulnerable to flash loan attacks that can drain protocol funds.",
    remediation: "Use TWAP or manipulated-resistant oracles. Implement minimum liquidity requirements. Use time-weighted average prices. Add circuit breakers for abnormal price movements.",
    category: "DeFi",
    blocks_deployment: true,
};

pub const MEV_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-017",
    name: "MEV Vulnerabilities",
    severity: "high",
    description: "Detects maximal extractable value vulnerabilities",
    details: "Frontrunning, sandwich attacks, and backrunning can extract value from users. Common issues: public mempool transactions with no slippage protection, visible order details.",
    remediation: "Use commit-reveal schemes. Implement slippage protection. Use private mempools or MEV protection. Batch operations atomically. Add minimum output amounts.",
    category: "DeFi",
    blocks_deployment: true,
};

pub const CROSS_CHAIN_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-018",
    name: "Cross-Chain Issues",
    severity: "high",
    description: "Detects general cross-chain interoperability vulnerabilities",
    details: "Cross-chain operations introduce unique risks: chain reorganization, message ordering, token representation mismatches, and bridge dependency risks.",
    remediation: "Design for chain reorgs with confirmation requirements. Use canonical token representations. Ensure message atomicity. Add fallback mechanisms for bridge failures.",
    category: "Cross-Chain",
    blocks_deployment: true,
};

pub const DEPENDENCY_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-019",
    name: "Dependency Vulnerabilities",
    severity: "high",
    description: "Detects vulnerable or malicious dependencies",
    details: "Using outdated or compromised dependencies can introduce vulnerabilities. Common issues: pinning to vulnerable versions, no integrity checks, and supply chain attacks.",
    remediation: "Pin dependency versions. Use integrity verification (e.g., SRI). Keep dependencies updated. Audit dependency changes. Use tools like Dependabot or Snyk.",
    category: "Dependencies",
    blocks_deployment: true,
};

pub const UNSAFE_IMPORTS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-020",
    name: "Unsafe Imports",
    severity: "high",
    description: "Detects unsafe or suspicious imports",
    details: "Importing from untrusted sources, outdated versions, or suspicious-looking contracts can introduce vulnerabilities or malicious code into the project.",
    remediation: "Use trusted sources only (OpenZeppelin, Solmate, etc.). Pin to specific versions. Verify import integrity. Use forge remappings consistently.",
    category: "Dependencies",
    blocks_deployment: true,
};

pub const UNSAFE_INITIALIZERS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-021",
    name: "Unsafe Initializers",
    severity: "high",
    description: "Detects uninitialized upgradeable contracts",
    details: "Implementation contracts without initialized guards can be selfdestructed. Proxy contracts can have their initializer called multiple times without reinitializer guards.",
    remediation: "Use OpenZeppelin's Initializable with initializer modifier. Use reinitializer for version upgrades. Call disableInitializers in the implementation constructor.",
    category: "Upgradeability",
    blocks_deployment: true,
};

pub const UNSAFE_UPGRADE_PATHS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-022",
    name: "Unsafe Upgrade Paths",
    severity: "high",
    description: "Detects unsafe contract upgrade paths",
    details: "Upgradeable contracts need carefully managed upgrade paths. Common issues: storage layout breaks, missing reinitializers, and upgradeability without timelocks.",
    remediation: "Use a timelock for upgrades. Maintain storage layout compatibility. Test upgrade paths. Use UUPS or transparent proxy patterns correctly.",
    category: "Upgradeability",
    blocks_deployment: true,
};

pub const CLONE_VULNERABILITIES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-H-023",
    name: "Clone/ Minimal Proxy Issues",
    severity: "high",
    description: "Detects minimal proxy (EIP-1167) vulnerabilities",
    details: "Clones share implementation storage and logic. Issues: uninitialized clones, implementation selfdestruct, and immutable variable expectations in proxied contracts.",
    remediation: "Initialize each clone individually. Protect implementation from selfdestruct. Ensure clones have proper access control. Use Clones with initializer patterns.",
    category: "Deployment",
    blocks_deployment: true,
};

// ─────────────────────────────────────────────────────────────────
// MEDIUM severity checks
// ─────────────────────────────────────────────────────────────────

pub const GAS_PROBLEMS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-001",
    name: "Gas Problems",
    severity: "medium",
    description: "Detects gas-inefficient patterns",
    details: "Unbounded loops, redundant storage operations, repeated computations, and high-gas patterns can make contracts expensive or unusable.",
    remediation: "Optimize storage usage. Use local variables. Minimize on-chain computations. Use appropriate data structures. Consider using ERC-1167 for clones.",
    category: "Gas",
    blocks_deployment: false,
};

pub const UNSAFE_CASTING: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-002",
    name: "Unsafe Casting",
    severity: "medium",
    description: "Detects unsafe type casting operations",
    details: "Downcasting without overflow checks can lead to truncation. address payable conversions can fail silently. bytes<T> to string casts can produce invalid UTF-8.",
    remediation: "Use OpenZeppelin's SafeCast library for downcasting. Validate addresses before payable conversion. Use string(bytes) carefully. Add input validation.",
    category: "Logic",
    blocks_deployment: false,
};

pub const TIMESTAMP_MANIPULATION: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-003",
    name: "Timestamp Manipulation",
    severity: "medium",
    description: "Detects reliance on block.timestamp for critical logic",
    details: "block.timestamp can be manipulated by miners within a ~15-second window. Using it for critical randomness or time- sensitive logic is unsafe.",
    remediation: "Use block.number for time intervals when possible. Don't use timestamp for randomness. Allow reasonable timestamp variance. Use trusted oracles for precise time.",
    category: "Logic",
    blocks_deployment: false,
};

pub const STORAGE_INEFFICIENCIES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-004",
    name: "Storage Inefficiencies",
    severity: "medium",
    description: "Detects storage layout and packing inefficiencies",
    details: "Poor storage layout wastes gas and can lead to slot overflow. Variables that fit in fewer slots should be packed together. Unnecessary storage variables increase costs.",
    remediation: "Pack related state variables into fewer slots. Use appropriate data types (uint128, uint64, etc.). Delete unused storage. Use mappings for dynamic data.",
    category: "Gas",
    blocks_deployment: false,
};

pub const UNSAFE_EVENTS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-005",
    name: "Unsafe Events",
    severity: "medium",
    description: "Detects events missing indexed parameters or emitting sensitive data",
    details: "Events can leak sensitive information as they are stored on-chain permanently. Missing indexed parameters makes filtering difficult for off-chain services.",
    remediation: "Index important parameters for efficient filtering. Never emit sensitive data in events. Follow the indexed parameter limit (max 3). Use EIP- standards for event signatures.",
    category: "Best Practices",
    blocks_deployment: false,
};

pub const POOR_VISIBILITY: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-006",
    name: "Poor Visibility Definitions",
    severity: "medium",
    description: "Detects incorrect or unsafe visibility modifiers",
    details: "Functions marked as public or external when they should be internal or private can expand the attack surface. State variables exposed publicly may be unintended.",
    remediation: "Use the most restrictive visibility modifier possible. Audit all public functions. Consider using external for functions only called externally. Mark state variables as private.",
    category: "Best Practices",
    blocks_deployment: false,
};

pub const BAD_MODIFIERS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-007",
    name: "Bad Modifiers",
    severity: "medium",
    description: "Detects unsafe or incorrect modifier patterns",
    details: "Modifiers that perform state changes, external calls, or have incorrect guard conditions can introduce vulnerabilities. Modifier side-effects are often unexpected.",
    remediation: "Keep modifiers simple and read-only. Avoid external calls in modifiers. Don't create side effects in modifiers. Use functions instead of complex modifier logic.",
    category: "Best Practices",
    blocks_deployment: false,
};

pub const UNSAFE_MATH: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-008",
    name: "Unsafe Math Patterns",
    severity: "medium",
    description: "Detects math operations without proper overflow protection",
    details: "While Solidity 0.8+ has built-in overflow checking, unchecked blocks and assembly math bypass these checks. Division before multiplication loses precision.",
    remediation: "Use checked math by default. Only use unchecked blocks when overflow is impossible. Use FixedPointMath libraries for precision. Add input bounds.",
    category: "Logic",
    blocks_deployment: false,
};

pub const POOR_ACCESS_PATTERNS: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-M-009",
    name: "Poor Access Patterns",
    severity: "medium",
    description: "Detects suboptimal access patterns that increase gas or risk",
    details: "Reading and writing storage repeatedly in loops, accessing storage when memory suffices, and redundant SLOAD operations waste gas and increase execution cost.",
    remediation: "Cache storage reads in memory. Batch state changes. Minimize SLOAD/SSTORE operations. Use appropriate data structures for access patterns.",
    category: "Gas",
    blocks_deployment: false,
};

// ─────────────────────────────────────────────────────────────────
// LOW severity checks
// ─────────────────────────────────────────────────────────────────

pub const NAMING_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-L-001",
    name: "Naming Issues",
    severity: "low",
    description: "Detects naming convention violations",
    details: "Inconsistent naming (mixedCase for functions, UPPER_CASE for constants, etc.) makes code harder to read and audit. Misleading names can hide vulnerabilities.",
    remediation: "Follow Solidity style guide: camelCase for functions and variables, UPPER_CASE for constants, underscore prefix for private. Use descriptive names.",
    category: "Style",
    blocks_deployment: false,
};

pub const CODE_DUPLICATION: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-L-002",
    name: "Code Duplication",
    severity: "low",
    description: "Detects repeated code patterns",
    details: "Duplicate code increases maintenance burden and audit surface. Changes to one copy may not be applied to all, leading to inconsistency and potential bugs.",
    remediation: "Extract common logic into internal functions or libraries. Use inheritance for shared functionality. Consider using modifiers for reusable checks.",
    category: "Architecture",
    blocks_deployment: false,
};

pub const OPTIMIZATION_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-L-003",
    name: "Optimization Suggestions",
    severity: "low",
    description: "Detects optimization opportunities",
    details: "Using more gas than necessary due to suboptimal patterns: redundant operations, unnecessary storage, inefficient data structures, or missing compiler optimizations.",
    remediation: "Enable compiler optimizer. Pack storage variables. Use calldata instead of memory for read-only parameters. Minimize external calls. Use appropriate data types.",
    category: "Gas",
    blocks_deployment: false,
};

// ─────────────────────────────────────────────────────────────────
// INFORMATIONAL checks
// ─────────────────────────────────────────────────────────────────

pub const STYLE_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-I-001",
    name: "Style Issues",
    severity: "informational",
    description: "Detects style guide violations",
    details: "Deviations from the Solidity Style Guide: incorrect indentation, missing or extra spaces, ordering of functions (external, public, internal, private), and NatSpec comments.",
    remediation: "Follow the official Solidity Style Guide. Use forge fmt for automatic formatting. Add NatSpec documentation to all functions. Use consistent layouts.",
    category: "Style",
    blocks_deployment: false,
};

pub const DOCUMENTATION_ISSUES: SecurityCheckMeta = SecurityCheckMeta {
    id: "FA-I-002",
    name: "Missing Documentation",
    severity: "informational",
    description: "Detects missing or insufficient NatSpec documentation",
    details: "Contracts, functions, and state variables without NatSpec comments are harder to audit and maintain. Documentation is critical for security review.",
    remediation: "Add @notice, @param, @return, @dev tags to all functions. Document state variables. Add custom errors documentation. Include usage examples and security assumptions.",
    category: "Documentation",
    blocks_deployment: false,
};

// ─────────────────────────────────────────────────────────────────
// Master list of all checks
// ─────────────────────────────────────────────────────────────────

pub const ALL_CHECKS: &[SecurityCheckMeta] = &[
    // HIGH
    REENTRANCY,
    ACCESS_CONTROL,
    DELEGATECALL,
    TX_ORIGIN,
    CREATE2,
    DOS,
    STORAGE_COLLISION,
    UNSAFE_ASSEMBLY,
    SELFDESTRUCT,
    PROXY_VULNERABILITIES,
    ORACLE_MANIPULATION,
    SIGNATURE_VULNERABILITIES,
    REPLAY_ATTACKS,
    ERC20_ISSUES,
    BRIDGE_VULNERABILITIES,
    FLASH_LOAN_ISSUES,
    MEV_ISSUES,
    CROSS_CHAIN_ISSUES,
    DEPENDENCY_VULNERABILITIES,
    UNSAFE_IMPORTS,
    UNSAFE_INITIALIZERS,
    UNSAFE_UPGRADE_PATHS,
    CLONE_VULNERABILITIES,
    // MEDIUM
    GAS_PROBLEMS,
    UNSAFE_CASTING,
    TIMESTAMP_MANIPULATION,
    STORAGE_INEFFICIENCIES,
    UNSAFE_EVENTS,
    POOR_VISIBILITY,
    BAD_MODIFIERS,
    UNSAFE_MATH,
    POOR_ACCESS_PATTERNS,
    // LOW
    NAMING_ISSUES,
    CODE_DUPLICATION,
    OPTIMIZATION_ISSUES,
    // INFO
    STYLE_ISSUES,
    DOCUMENTATION_ISSUES,
];

/// Get the total number of available checks.
pub const fn check_count() -> usize {
    ALL_CHECKS.len()
}