Rules are grouped by selection category, then by topic for other opt-ins. Each line gives severity, selection and a description, with a link to its documentation at v0.1.1.
All built-in rules are experimental. Severity is review priority, not a probability or a confirmed impact. Intentional behavior can match. Read each rule's evidence, benign matches and limits.
The implicit audit profile selects ordinary audit rules and dormant policy rules. --profile hygiene adds source hygiene. --detectors ID,ID replaces profile selection with an exact nonempty set. Policy rules need matching application intent even when selected. Topic headings are not CLI selection shortcuts.
Audit-default ordinary rules#
24 rules. Run on every ordinary scan.
-
caller-supplied-deadlinemedium
Caller-supplied time satisfies a ledger-derived delay without a chain-time upper bound.
-
circuit-costinfo
Expanded source-operation estimate exceeds the review threshold; this is not a proof-row estimate.
-
A comparison not reduced to a source constant is discarded or kept only by unused immutable aliases.
-
Canonical shielded send or mint metadata is discarded or retained only by unused immutable aliases.
-
duplicate-shielded-mintmedium
Identical canonical shielded mint inputs produce a duplicate coin commitment in one transaction.
-
Terminating branch repeats its immediate following expression and return tail.
-
A native Either's known inactive arm reaches an output, state effect or successful effect gate.
-
Enforced Field recomposition retains quotient/remainder envelopes beyond the modulus.
-
Caller-supplied time reaches a security-sensitive effect without a canonical block-time freshness bound.
-
identity-signature-keymedium
A successful history passes a known identity point to the pinned Schnorr verifier.
-
A canonical signature verifier's Boolean outcome is discarded or retained only by unused local aliases.
-
impossible-assertionmedium
A nonliteral assertion fails on every reaching path, or an entry has no successful path.
-
A private preimage checked against a ledger hash is also published on a potential successful path.
-
A published direct hash has one private input drawn from a small declared domain.
-
Checked Merkle path leaves lack binding to supplied lookup inputs or exact Field hash write candidates.
-
Proof-related state changes lack an enforced relationship between the exact digest and trusted ledger roots.
-
An authenticated ShieldedAccessControl instance initializes but has no role-seeding route.
-
A published private-derived commitment uses statically known randomness.
-
A raw native ownPublicKey selects a required member of preexisting public ledger storage before successful state-changing effects.
-
A published digest determines the scalar of a registered curve point through resolved native calls.
-
Both branch arms only return opposite Boolean literals.
-
Exact self-addressed canonical returned coin is subsequently passed to receiveShielded.
-
spoofable-authorizationlowhighcritical
A raw witness equality with public data is required for a state-changing effect; review the intended authentication.
-
Review exact surviving Set absence consumption before a zero-inclusive canonical unshielded payout.
Additional hygiene rules#
7 rules. Added by --profile hygiene.
-
Assertion is already true on every analyzed reach before enforcing it.
-
Branch condition reduces to a typed scalar source constant.
-
dead-codeinfo
Statement, branch or loop is excluded by source control flow.
-
shadowinginfo
Parameter or local binding hides an outer declaration.
-
time-dependenceinfo
A successful circuit uses a protocol block-time comparison.
-
Disclosure operand is already public in the source context.
-
Ledger, witness or private circuit has no reference in the compilation unit.
Policy-dependent rules#
13 rules. Need application intent declared in policies.
-
A checkpoint splits a declared ordinary Cell co-update across atomic units.
-
Expanded source-operation estimate exceeds an explicit circuit work budget.
-
An explicitly selected membership guard lacks current-root evidence at enforcement time.
-
Policy-declared secret information reaches a public sink through an unapproved transformation.
-
A scalar state write may cross a transition explicitly forbidden by policy.
-
Opt-in documented preconditions of authenticated OpenZeppelin Compact modules.
-
A protected Cell mutation does not satisfy its declared complete operation-intent statement.
-
An explicitly documented configured Map getter returns only default without reading the selected Map.
-
Review an explicit adjacent source claim paired with shielded issuance to a user key.
-
Policy-selected current NFT metadata retains an old auxiliary payload across same-history burn/remint.
-
A successful path writes policy-protected state without the configured preceding guard.
-
A declared callable pinned Ownable instance finishes with a contract-address owner rejected by its guard.
-
Under a declared zero-amount policy, every modeled successful invocation requires the same Map entry to have been present initially.
Other active opt-ins#
52 rules. Select them explicitly with --detectors or the detectors list.
Time and freshness
-
Review an effect-bearing caller value checked against a ledger bound without a same-branch exact clock constraint; time intent unknown.
-
A definite native shielded output exceeds the expressly assumed runtime coin encoding range.
Authorization, identity and membership
-
Review a surviving zero numeric Map insertion at a direct caller key without required initial same-key membership.
-
A represented constructor history contradicts distinct Set memberships under a complete source closure without subsequent writers.
-
Immediate post-constructor collection capacity contradicts required distinct memberships.
-
Review unknown persistent Schnorr keys without modeled identity rejection.
-
Keyed mutation digest/key equality and required Set membership use independent witness snapshots.
-
Canonical prover-supplied ownPublicKey participates in a required ledger credential check.
-
Adjacent signer inequalities omit non-adjacent pairs in a verified threshold claim vector.
-
Review unknown native signature keys without modeled exact identity exclusion.
-
Ledger-bound witness digest and mutation operand use independently supplied witness snapshots without mandatory equality binding.
-
Review stored supplied Schnorr keys with enrollment and enforced canonical use lacking modeled identity rejection.
-
Review explicit absent-to-zero getter evidence alongside an all-zero-success initial-membership Map decrement.
Privacy and cryptographic derivations
-
A full canonical hash is range-checked by a Uint cast on its source route to a ledger write or exported return.
-
Conditional unsigned subtraction reaches a fixed-width native persistent-hash input without a qualified inactive-case range invariant.
-
Shared generic optional witness dispatch has incompatible mandatory bigint/byte-array payload guards; profile-specific compatibility review.
-
Review a public two-input native digest lacking represented self binding and component default exclusion.
-
Published exact digest determines a scalar used in native generator multiplication whose result survives in a ledger Cell.
-
Same-key ledger writers enforce different domain-qualified secret-binding declaration families.
-
Terminal ledger data is constructed using an upgrade-unstable transient hash or commitment.
-
A raw witness leaf reaches surviving ledger state without a modeled assertion using that leaf.
-
Review direct witness-derived canonical-send recipients without an exact prior ledger equality binding.
Token, coin and value transfers
-
Canonical shielded coin descriptor fields have an unchanged source route to an exported result.
-
Permissionless mint and egress compose around a stored-value boundary without a modeled authorization predicate.
-
Received shielded coin lacks a recorded application constraint on color or value.
-
An exported amount is forwarded unchanged to a canonical shielded burn whose coin and API amount types are wider.
-
Review canonical shielded sends with a modeled non-self ContractAddress recipient arm.
-
Review ordinary state or shielded input coin sources absent from enforced signature message dependencies.
-
unbounded-mintmedium
A variable mint amount has no modeled per-call cap below the native range or public ledger bound.
-
Successful token operations have no required application predicate constraining private caller inputs.
-
Review a complete local refund-validator endpoint producing a zero remainder send expression.
-
Review exact same-color complementary sends with two zero-inclusive amount envelopes.
-
Review an amount-zero successful numeric Map debit whose exact lookup has unknown prior membership.
-
Review canonical unshielded send amounts with a zero-inclusive successful-history range.
-
Review zero-inclusive actual transfers paired with retained List append for the exact user recipient.
State and collections
-
An unchanged caller input must equal preexisting public ledger bytes before a state-changing effect.
-
Whole-list reset lacks a recognized same-revision count, empty-list or absent-slot acknowledgment.
-
Consumer co-membership is checked on only some successful histories of a keyed insert.
-
Terminal payout remains reachable after a mutually exclusive one-time milestone.
-
Opt-in review of initializer-named entries with a state-changing second invocation.
-
Canonical shielded coin nonce derives solely from a selected ledger List length that another exported entry can reset.
-
Stored recipient List payload and canonical coin nonce both evolve from the same resettable selected List extent.
-
Ordinary ledger Cell is explicitly written but has no Compact source read in the compilation unit.
Source structure and validation
-
A successful value output or pinned Ownable update uses a known default active address.
-
A threshold-only assertion uses the exact unshielded balance getter instead of its comparison API.
-
A directly published Field operation on preserved unsigned quantities may wrap without a proved bound.
-
An exported writer omits the caller-check convention required by a strict majority of its peers.
-
Review sequential bounded Merkle insertion without exact surviving duplicate prevention.
-
Required collection absence lacks a definite surviving insertion on a state-changing history.
-
A supplied tag is required equal to a hash derived from preexisting public ledger data and caller-supplied inputs before an effect.
-
Review predicate outcomes discarded before effects, persisted, or returned with an effect; security intent unknown.
No rules match. Try a shorter search or clear the filters.
Inspect the installed rules#
Using the installation from getting started:
./.nightshade/node_modules/.bin/nightshade detector list
./.nightshade/node_modules/.bin/nightshade detector show ledger-bound-preimage-publication