From 75073c20e803c3449cf7b3ffe474b868a271b29c Mon Sep 17 00:00:00 2001 From: raz0r Date: Mon, 12 Aug 2024 11:14:39 +0300 Subject: [PATCH] update messages --- README.md | 9 +++++++++ cairo/lack-of-error-message.yaml | 4 ++-- cairo/tx-origin-authentication.yaml | 2 +- cairo/view-fn-writes.yaml | 2 +- 4 files changed, 13 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index bad1f6e..27fd5bd 100644 --- a/README.md +++ b/README.md @@ -169,3 +169,12 @@ Rule ID | Description --- | --- solana-arbitrary-program-call | An attacker may be able to invoke arbitrary programs without address validations solana-insecure-account-closing | Writing the CLOSED_ACCOUNT_DISCRIMINATOR to a closed account is crucial to prevent the reuse of the account within the same transaction + +## Cairo Rules +Rule ID | Description +--- | --- +lack-of-error-message | Error message is missing in the assert statement +tx-origin-authentication | Using `account_contract_address` for authentication is insecure. Use `get_caller_address` or an appropriate method for verifying users. +view-fn-mutable-state | View function should not be able to modify state +view-fn-writes | View function should not write to the state +zero-division | Possible division by zero \ No newline at end of file diff --git a/cairo/lack-of-error-message.yaml b/cairo/lack-of-error-message.yaml index 08c4276..3a389aa 100644 --- a/cairo/lack-of-error-message.yaml +++ b/cairo/lack-of-error-message.yaml @@ -1,7 +1,7 @@ rules: - - id: lack-of-error-message + - id: lack-of-error-message languages: [cairo] - message: Add error message to assert + message: Error message is missing in the assert statement severity: INFO metadata: category: best-practice diff --git a/cairo/tx-origin-authentication.yaml b/cairo/tx-origin-authentication.yaml index e9c65e0..cd0dd1f 100644 --- a/cairo/tx-origin-authentication.yaml +++ b/cairo/tx-origin-authentication.yaml @@ -1,7 +1,7 @@ rules: - id: tx-origin-authentication languages: [cairo] - message: "Using account_contract_address for authentication is insecure. Use get_caller_address or an appropriate method for verifying users." + message: Using `account_contract_address` for authentication is insecure. Use `get_caller_address` or an appropriate method for verifying users. severity: MEDIUM metadata: category: security diff --git a/cairo/view-fn-writes.yaml b/cairo/view-fn-writes.yaml index c8b6c4f..6389784 100644 --- a/cairo/view-fn-writes.yaml +++ b/cairo/view-fn-writes.yaml @@ -1,7 +1,7 @@ rules: - id: view-fn-writes languages: [cairo] - message: View function $FN should not be able to modify state + message: View function $FN should not write to the state severity: ERROR metadata: category: security