{ "$schema": "https://nightshade.dicksonwu.xyz/rules.schema.json", "schemaVersion": 1, "tool": "Nightshade", "toolVersion": "0.1.1", "release": "v0.1.1", "releaseUrl": "https://github.com/DicksonWu654/nightshade/releases/tag/v0.1.1", "generatedFrom": "content/detector-catalog.json and docs/detectors at v0.1.1", "ruleCount": 96, "severityMeaning": "Review priority; not a probability, exploitability or impact.", "confidenceMeaning": "Detector metadata; not a probability.", "rules": [ { "id": "caller-supplied-deadline", "description": "Caller-supplied time satisfies a ledger-derived delay without a chain-time upper bound", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/caller-supplied-deadline.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/caller-supplied-deadline.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/caller-supplied-deadline.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "circuit-cost", "description": "Circuit exceeds 10000 expanded source-operation units (not proof rows)", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "cfg", "resolved-calls", "static-loop-bounds" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/circuit-cost.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/circuit-cost.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/circuit-cost.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "discarded-comparison", "description": "A comparison not reduced to a source constant is discarded or kept only by unused immutable aliases", "severity": "low", "severityLevels": [ "low" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-source-references", "typed-source-constants" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/discarded-comparison.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/discarded-comparison.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/discarded-comparison.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "discarded-shielded-send-result", "description": "Canonical shielded send or mint metadata is discarded or retained only by unused immutable aliases", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-source-references", "typed-source-constants" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/discarded-shielded-send-result.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/discarded-shielded-send-result.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/discarded-shielded-send-result.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 5, 5 ], "corrected": [ 5, 5 ], "lookalike": [ 5, 5 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "duplicate-shielded-mint", "description": "Identical canonical shielded mint inputs produce a duplicate coin commitment in one transaction", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-calls", "cfg", "successful-predicates", "canonical-mint-observations" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/duplicate-shielded-mint.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/duplicate-shielded-mint.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/duplicate-shielded-mint.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#duplicate-shielded-mint", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "duplicated-branch-tail", "description": "Terminating branch repeats its immediate following expression and return tail", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "typed-source-constants" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/duplicated-branch-tail.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/duplicated-branch-tail.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/duplicated-branch-tail.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "either-payload-mismatch", "description": "A native Either's known inactive arm reaches an output, state effect or successful effect gate", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-types", "successful-either-selections", "public-sinks", "state-writes", "predicates" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/either-payload-mismatch.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/either-payload-mismatch.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/either-payload-mismatch.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "field-recomposition-range-review", "description": "Enforced Field recomposition retains quotient/remainder envelopes beyond the modulus", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "owned-numeric-expressions", "successful-predicates", "resolved-types" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/field-recomposition-range-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/field-recomposition-range-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/field-recomposition-range-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 5, 5 ], "corrected": [ 4, 5 ], "lookalike": [ 4, 5 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "freshness-bound-caller-time", "description": "Caller-supplied time reaches a security-sensitive effect without a canonical block-time freshness bound", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "state-writes", "public-sinks" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/freshness-bound-caller-time.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/freshness-bound-caller-time.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/freshness-bound-caller-time.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#freshness-bound-caller-time", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 12, 12 ], "corrected": [ 12, 12 ], "lookalike": [ 12, 12 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "identity-signature-key", "description": "A successful history passes a known identity point to the pinned Schnorr verifier", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-calls", "constants", "successful-signature-calls" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/identity-signature-key.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/identity-signature-key.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/identity-signature-key.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 4 ], "corrected": [ 4, 4 ], "lookalike": [ 4, 4 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "ignored-validation-result", "description": "A canonical signature verifier's Boolean outcome is discarded or retained only by unused local aliases", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-calls", "resolved-source-references" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/ignored-validation-result.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/ignored-validation-result.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/ignored-validation-result.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#ignored-validation-result", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 3, 3 ], "lookalike": [ 3, 3 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "impossible-assertion", "description": "A nonliteral assertion fails on every reaching path, or an entry has no successful path", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "cfg", "constants", "path-constraints", "failed-assertions", "assertion-reaches", "completed-entries" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/impossible-assertion.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/impossible-assertion.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/impossible-assertion.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "ledger-bound-preimage-publication", "description": "A private preimage checked against a ledger hash is also published on a potential successful path", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-calls", "cfg", "private-provenance", "hash-bindings", "public-sinks" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/ledger-bound-preimage-publication.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/ledger-bound-preimage-publication.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/ledger-bound-preimage-publication.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#ledger-bound-preimage-publication", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 7, 7 ], "corrected": [ 12, 12 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "low-entropy-hash-disclosure", "description": "A published direct hash has one private input drawn from a small declared domain", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-types", "private-provenance", "public-sinks", "direct-hash-inputs" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/low-entropy-hash-disclosure.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/low-entropy-hash-disclosure.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/low-entropy-hash-disclosure.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "merkle-leaf-binding-review", "description": "Checked Merkle path leaves lack binding to supplied lookup inputs or exact Field hash write candidates", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "merkle-observations", "successful-predicates", "digest-inputs", "mint-quantity-observations", "state-writes", "completed-entries" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/merkle-leaf-binding-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/merkle-leaf-binding-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/merkle-leaf-binding-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 6, 6 ], "corrected": [ 6, 6 ], "lookalike": [ 6, 6 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "merkle-membership-not-enforced", "description": "Proof-related state changes lack an enforced relationship between the exact digest and trusted ledger roots", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "merkle-observations", "successful-predicates", "private-provenance", "state-writes", "completed-entries" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/merkle-membership-not-enforced.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/merkle-membership-not-enforced.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/merkle-membership-not-enforced.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#merkle-membership-not-enforced", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 5, 5 ], "corrected": [ 5, 5 ], "lookalike": [ 5, 5 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "missing-role-bootstrap", "description": "An authenticated ShieldedAccessControl instance initializes but has no role-seeding route", "severity": "low", "severityLevels": [ "low" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-calls", "module-identities", "constructor-histories" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/missing-role-bootstrap.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/missing-role-bootstrap.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/missing-role-bootstrap.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "predictable-commitment-randomness", "description": "A published private-derived commitment uses statically known randomness", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "private-provenance", "commitments", "public-sinks", "constants" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/predictable-commitment-randomness.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/predictable-commitment-randomness.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/predictable-commitment-randomness.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#predictable-commitment-randomness", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "public-key-membership-authorization", "description": "A raw native ownPublicKey selects a required member of preexisting public ledger storage before successful state-changing effects", "severity": "high", "severityLevels": [ "high" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "collection-observations", "successful-predicates", "successful-histories", "private-provenance", "state-writes", "runtime-operations", "completed-entries" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/public-key-membership-authorization.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/public-key-membership-authorization.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/public-key-membership-authorization.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 9, 9 ], "corrected": [ 6, 6 ], "lookalike": [ 6, 6 ], "negative": [ 3, 3 ], "incomplete": 0 } }, { "id": "publicly-derivable-encryption-secret", "description": "A published digest determines the scalar of a registered curve point through resolved native calls", "severity": "high", "severityLevels": [ "high" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-calls", "private-provenance", "public-sinks", "direct-hash-inputs", "exact-invocation-operands" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/publicly-derivable-encryption-secret.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/publicly-derivable-encryption-secret.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/publicly-derivable-encryption-secret.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "redundant-boolean-branch", "description": "Both branch arms only return opposite Boolean literals", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "typed-source-constants" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/redundant-boolean-branch.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/redundant-boolean-branch.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/redundant-boolean-branch.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "redundant-self-shielded-receive", "description": "Exact self-addressed canonical returned coin is subsequently passed to receiveShielded", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "runtime-operations", "selected-invocation-observations", "canonical-mint-observations", "completed-entries" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/redundant-self-shielded-receive.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/redundant-self-shielded-receive.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/redundant-self-shielded-receive.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "spoofable-authorization", "description": "A raw witness equality with public data is required for a state-changing effect; review the intended authentication", "severity": "varies", "severityLevels": [ "low", "high", "critical" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "successful-predicates", "private-provenance", "state-writes", "runtime-operations", "completed-entries" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/spoofable-authorization.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/spoofable-authorization.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/spoofable-authorization.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#spoofable-authorization", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 28, 28 ], "corrected": [ 28, 28 ], "lookalike": [ 28, 28 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "zero-amount-set-consumption-review", "description": "Review exact surviving Set absence consumption before a zero-inclusive canonical unshielded payout", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "canonical-invocation-snapshots", "collection-observations", "all-predicates", "exact-numeric-operands", "completed-entries" ], "selection": "Audit default", "category": "Audit-default ordinary rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/zero-amount-set-consumption-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/zero-amount-set-consumption-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/zero-amount-set-consumption-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 4, 5 ], "negative": [ 8, 8 ], "incomplete": 0 } }, { "id": "always-true-assertion", "description": "Assertion is already true on every analyzed reach before enforcing it", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "assertion-reaches", "completed-entries" ], "selection": "Hygiene only", "category": "Additional hygiene rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/always-true-assertion.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/always-true-assertion.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/always-true-assertion.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "constant-condition", "description": "Branch condition reduces to a typed scalar source constant", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "typed-source-constants" ], "selection": "Hygiene only", "category": "Additional hygiene rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/constant-condition.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/constant-condition.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/constant-condition.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "dead-code", "description": "Statement, branch or loop is excluded by source control flow", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "typed-source-constants" ], "selection": "Hygiene only", "category": "Additional hygiene rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/dead-code.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/dead-code.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/dead-code.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "shadowing", "description": "Parameter or local binding hides an outer declaration", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "typed-source-constants" ], "selection": "Hygiene only", "category": "Additional hygiene rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/shadowing.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/shadowing.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/shadowing.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "time-dependence", "description": "A successful circuit uses a protocol block-time comparison", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "runtime-operations", "completed-entries" ], "selection": "Hygiene only", "category": "Additional hygiene rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/time-dependence.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/time-dependence.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/time-dependence.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unnecessary-disclose", "description": "Disclosure operand is already public in the source context", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "typed-source-constants" ], "selection": "Hygiene only", "category": "Additional hygiene rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/unnecessary-disclose.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unnecessary-disclose.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unnecessary-disclose.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unused-declaration", "description": "Ledger, witness or private circuit has no reference in the compilation unit", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": false, "requires": [ "resolved-model", "typed-source-constants" ], "selection": "Hygiene only", "category": "Additional hygiene rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/unused-declaration.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unused-declaration.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unused-declaration.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "checkpoint-splits-atomic-update", "description": "A checkpoint splits a declared ordinary Cell co-update across atomic units", "severity": "low", "severityLevels": [ "low" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "declared-atomic-update-group", "complete-checkpoint-linkage", "ordered-cell-writes" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/checkpoint-splits-atomic-update.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/checkpoint-splits-atomic-update.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/checkpoint-splits-atomic-update.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "circuit-work-budget", "description": "Expanded source-operation estimate exceeds an explicit circuit work budget", "severity": "low", "severityLevels": [ "low" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": true, "requires": [ "cfg", "resolved-calls", "static-loop-bounds", "work-policy" ], "selection": "Audit; needs policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/circuit-work-budget.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/circuit-work-budget.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/circuit-work-budget.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "current-root-policy-mismatch", "description": "An explicitly selected membership guard lacks current-root evidence at enforcement time", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "declared-current-root-policy", "all-successful-predicates", "native-merkle-queries", "ordered-writes" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/current-root-policy-mismatch.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/current-root-policy-mismatch.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/current-root-policy-mismatch.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "declared-secret-publication", "description": "Policy-declared secret information reaches a public sink through an unapproved transformation", "severity": "high", "severityLevels": [ "high" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": true, "policyRequired": true, "requires": [ "private-provenance", "implicit-flows", "public-sinks", "privacy-policy" ], "selection": "Audit; needs policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/declared-secret-publication.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/declared-secret-publication.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/declared-secret-publication.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 3, 3 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "forbidden-state-transition", "description": "A scalar state write may cross a transition explicitly forbidden by policy", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": true, "policyRequired": true, "requires": [ "successful-paths", "state-writes", "constant-constraints", "transition-policy" ], "selection": "Audit; needs policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/forbidden-state-transition.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/forbidden-state-transition.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/forbidden-state-transition.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "openzeppelin-preconditions", "description": "Opt-in documented preconditions of authenticated OpenZeppelin Compact modules", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": true, "policyRequired": true, "requires": [ "resolved-calls", "call-reaches", "complete-caller-coverage", "builtin-policy" ], "selection": "Configured builtins", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/openzeppelin-preconditions.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/openzeppelin-preconditions.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/openzeppelin-preconditions.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 6, 6 ], "corrected": [ 6, 6 ], "lookalike": [ 6, 6 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "operation-intent-policy", "description": "A protected Cell mutation does not satisfy its declared complete operation-intent statement", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "declared-operation-intent", "exact-signed-statement", "registered-key", "original-write-history", "canonical-self", "nonce-consumption" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/operation-intent-policy.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/operation-intent-policy.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/operation-intent-policy.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "source-claim-map-getter-review", "description": "An explicitly documented configured Map getter returns only default without reading the selected Map", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "explicit-source-map-getter-policy", "parser-owned-adjacent-comment", "complete-original-setter-getter-histories", "complete-getter-source-closure" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/source-claim-map-getter-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/source-claim-map-getter-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/source-claim-map-getter-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 4, 4 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 10, 10 ], "incomplete": 0 } }, { "id": "source-claim-shielded-issuance-review", "description": "Review an explicit adjacent source claim paired with shielded issuance to a user key", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "explicit-source-claim-policy", "parser-owned-exact-adjacent-comment", "canonical-mint-invocation", "complete-original-successful-histories" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/source-claim-shielded-issuance-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/source-claim-shielded-issuance-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/source-claim-shielded-issuance-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 6, 6 ], "corrected": [ 2, 2 ], "lookalike": [ 15, 16 ], "negative": [ 0, 1 ], "incomplete": 1 } }, { "id": "stale-nft-metadata", "description": "Policy-selected current NFT metadata retains an old auxiliary payload across same-history burn/remint", "severity": "low", "severityLevels": [ "low" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "module-identities", "collection-observations", "successful-histories", "current-incarnation-policy" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/stale-nft-metadata.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/stale-nft-metadata.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/stale-nft-metadata.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unguarded-sensitive-state-write", "description": "A successful path writes policy-protected state without the configured preceding guard", "severity": "high", "severityLevels": [ "high" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": true, "policyRequired": true, "requires": [ "successful-paths", "state-writes", "guard-calls", "authorization-policy" ], "selection": "Audit; needs policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/unguarded-sensitive-state-write.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unguarded-sensitive-state-write.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unguarded-sensitive-state-write.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 3, 3 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unsupported-contract-owner", "description": "A declared callable pinned Ownable instance finishes with a contract-address owner rejected by its guard", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "module-identities", "state-writes", "all-predicates", "constants", "completed-entries", "callable-ownable-policy" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/unsupported-contract-owner.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unsupported-contract-owner.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unsupported-contract-owner.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "zero-amount-initial-membership", "description": "Under a declared zero-amount policy, every modeled successful invocation requires the same Map entry to have been present initially", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": true, "requires": [ "declared-zero-entry", "exact-map-preconditions", "all-successful-predicates", "ordered-writes" ], "selection": "Opt-in + policy", "category": "Policy-dependent rules", "topic": null, "url": "https://nightshade.dicksonwu.xyz/rules/zero-amount-initial-membership.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/zero-amount-initial-membership.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/zero-amount-initial-membership.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "caller-supplied-time-review", "description": "Review an effect-bearing caller Uint<64>/ledger bound without a same-branch exact clock constraint; time intent unknown", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-model" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Time and freshness", "url": "https://nightshade.dicksonwu.xyz/rules/caller-supplied-time-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/caller-supplied-time-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/caller-supplied-time-review.md" }, { "id": "shielded-coin-runtime-width", "description": "A definite native shielded output exceeds the expressly assumed runtime 0.19.0 coin encoding range", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-native-output-sites", "exact-numeric-operands", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Time and freshness", "url": "https://nightshade.dicksonwu.xyz/rules/shielded-coin-runtime-width.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/shielded-coin-runtime-width.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/shielded-coin-runtime-width.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "caller-key-zero-entry-review", "description": "Review a surviving zero numeric Map insertion at a direct caller Bytes32 key without required initial same-key membership", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "entry-zero-history", "exact-map-preconditions", "all-successful-predicates", "ordered-writes" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/caller-key-zero-entry-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/caller-key-zero-entry-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/caller-key-zero-entry-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "closed-membership-capacity-review", "description": "A represented constructor history contradicts distinct Set memberships under a complete source closure without subsequent writers", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "constructor-to-entry-prefixes", "exact-collection-capacity", "complete-post-constructor-effects" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/closed-membership-capacity-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/closed-membership-capacity-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/closed-membership-capacity-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 6, 6 ], "corrected": [ 3, 3 ], "lookalike": [ 2, 2 ], "negative": [ 10, 10 ], "incomplete": 0 } }, { "id": "configured-membership-capacity-review", "description": "Immediate post-constructor collection capacity contradicts required distinct memberships", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "constructor-to-entry-prefixes", "exact-collection-capacity", "successful-predicates" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/configured-membership-capacity-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/configured-membership-capacity-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/configured-membership-capacity-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 3, 3 ], "lookalike": [ 3, 3 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "enrolled-signature-key-review", "description": "Review unknown persistent Schnorr keys without modeled identity rejection", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-signature-calls", "all-predicates", "original-write-history" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/enrolled-signature-key-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/enrolled-signature-key-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/enrolled-signature-key-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "membership-identity-binding-review", "description": "Keyed mutation digest/key equality and required Set membership use independent witness snapshots", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "all-predicates", "digest-inputs", "collection-operations", "original-write-history" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/membership-identity-binding-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/membership-identity-binding-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/membership-identity-binding-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 4, 4 ], "corrected": [ 3, 3 ], "lookalike": [ 2, 3 ], "negative": [ 5, 5 ], "incomplete": 0 } }, { "id": "native-key-authentication-review", "description": "Canonical prover-supplied ownPublicKey participates in a required ledger credential check", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "all-successful-predicates", "direct-hash-inputs", "exact-effect-histories" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/native-key-authentication-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/native-key-authentication-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/native-key-authentication-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 5, 5 ], "corrected": [ 5, 5 ], "lookalike": [ 5, 5 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "quorum-signer-uniqueness-review", "description": "Adjacent signer inequalities omit non-adjacent pairs in a verified threshold claim vector", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "all-successful-predicates", "exact-entry-operands", "canonical-ecdsa-operands", "collection-operations", "direct-hash-inputs" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/quorum-signer-uniqueness-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/quorum-signer-uniqueness-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/quorum-signer-uniqueness-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "signature-key-identity-exclusion-review", "description": "Review unknown native signature keys without modeled exact identity exclusion", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-native-verifier-operands", "complete-original-successful-histories", "typed-immutable-key-exclusion" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/signature-key-identity-exclusion-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/signature-key-identity-exclusion-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/signature-key-identity-exclusion-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 3, 3 ], "lookalike": [ 2, 5 ], "negative": [ 1, 1 ], "incomplete": 0 } }, { "id": "split-witness-identity", "description": "Ledger-bound witness digest and mutation operand use independently supplied witness snapshots without mandatory equality binding", "severity": "low", "severityLevels": [ "low" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "all-predicates", "digest-inputs", "collection-operations", "original-write-history" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/split-witness-identity.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/split-witness-identity.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/split-witness-identity.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "stored-schnorr-key-enrollment-review", "description": "Review stored supplied Schnorr keys with enrollment and enforced canonical use lacking modeled identity rejection", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "complete-cell-writers", "surviving-point-write", "exact-enforced-signature-outcome", "original-all-predicate-histories" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/stored-schnorr-key-enrollment-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/stored-schnorr-key-enrollment-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/stored-schnorr-key-enrollment-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "zero-default-getter-membership-review", "description": "Review explicit absent-to-zero getter evidence alongside an all-zero-success initial-membership Map decrement", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "exact-cross-entry-getter", "source-key-pattern-binding", "all-full-zero-successes", "ordered-initial-membership", "numeric-map-decrement" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Authorization, identity and membership", "url": "https://nightshade.dicksonwu.xyz/rules/zero-default-getter-membership-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/zero-default-getter-membership-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/zero-default-getter-membership-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 7, 7 ], "corrected": [ 4, 4 ], "lookalike": [ 2, 2 ], "negative": [ 14, 14 ], "incomplete": 0 } }, { "id": "checked-digest-narrowing", "description": "A full canonical hash is range-checked by a Uint cast on its source route to a ledger write or exported return", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-source", "canonical-stdlib-calls", "resolved-types", "local-result-uses" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/checked-digest-narrowing.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/checked-digest-narrowing.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/checked-digest-narrowing.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "conditional-hash-range", "description": "Conditional Uint128 subtraction reaches a fixed-width native persistent-hash input without a qualified inactive-case range invariant (Compact 0.34.0/ZKIR2 review)", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-source-references", "resolved-types", "canonical-native-calls" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/conditional-hash-range.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/conditional-hash-range.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/conditional-hash-range.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "generic-witness-maybe-abi", "description": "Shared generic optional witness dispatch has incompatible mandatory bigint/byte-array payload guards (Compact 0.34.0/ZKIR2 compatibility review)", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-source-references", "canonical-generic-specializations", "resolved-types" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/generic-witness-maybe-abi.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/generic-witness-maybe-abi.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/generic-witness-maybe-abi.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "public-two-component-domain-review", "description": "Review a public two-input native digest lacking represented self binding and component default exclusion", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "exact-native-preimage", "canonical-self-provenance", "all-successful-predicates", "scalar-entry-input-identity" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/public-two-component-domain-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/public-two-component-domain-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/public-two-component-domain-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 6, 6 ], "corrected": [ 5, 5 ], "lookalike": [ 3, 4 ], "negative": [ 4, 5 ], "incomplete": 1 } }, { "id": "published-digest-generator-scalar-review", "description": "Published exact digest determines a scalar used in native generator multiplication whose result survives in a ledger Cell", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-calls", "private-provenance", "public-sinks", "direct-hash-inputs", "exact-invocation-operands" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/published-digest-generator-scalar-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/published-digest-generator-scalar-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/published-digest-generator-scalar-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 4, 4 ], "corrected": [ 4, 4 ], "lookalike": [ 4, 4 ], "negative": [ 6, 6 ], "incomplete": 0 } }, { "id": "secret-binding-divergence-review", "description": "Same-key ledger writers enforce different domain-qualified secret-binding declaration families", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "secret-binding-histories", "successful-predicates", "digest-inputs", "state-writes", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/secret-binding-divergence-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/secret-binding-divergence-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/secret-binding-divergence-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 7, 7 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 3 ], "negative": [ 9, 9 ], "incomplete": 0 } }, { "id": "transient-digest-to-ledger", "description": "Terminal ledger data is constructed using an upgrade-unstable transient hash or commitment", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "transient-data-origins", "state-writes", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/transient-digest-to-ledger.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/transient-digest-to-ledger.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/transient-digest-to-ledger.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unconstrained-witness-to-state", "description": "A raw witness leaf reaches surviving ledger state without a modeled assertion using that leaf", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-predicates", "private-provenance", "state-writes", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/unconstrained-witness-to-state.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unconstrained-witness-to-state.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unconstrained-witness-to-state.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#unconstrained-witness-to-state", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "witness-derived-value-review", "description": "Review direct witness-derived canonical-send recipients without an exact prior ledger equality binding", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-model" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Privacy and cryptographic derivations", "url": "https://nightshade.dicksonwu.xyz/rules/witness-derived-value-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/witness-derived-value-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/witness-derived-value-review.md" }, { "id": "exported-shielded-descriptor", "description": "Canonical shielded coin descriptor fields have an unchanged source route to an exported result", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-source", "canonical-stdlib-calls", "resolved-types" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/exported-shielded-descriptor.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/exported-shielded-descriptor.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/exported-shielded-descriptor.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 3, 3 ], "lookalike": [ 3, 3 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "permissionless-mint-egress", "description": "Permissionless mint and egress compose around a stored-value boundary without a modeled authorization predicate", "severity": "high", "severityLevels": [ "high" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "runtime-operations", "successful-predicates", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/permissionless-mint-egress.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/permissionless-mint-egress.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/permissionless-mint-egress.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "received-coin-not-validated", "description": "Received shielded coin lacks a recorded application constraint on color or value", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-predicates", "all-predicates", "runtime-operations", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/received-coin-not-validated.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/received-coin-not-validated.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/received-coin-not-validated.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "shielded-burn-amount-width", "description": "An exported Uint<64> amount is forwarded unchanged to a canonical shielded burn with Uint<128> coin and API amounts", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-source", "canonical-stdlib-calls", "resolved-types" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/shielded-burn-amount-width.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/shielded-burn-amount-width.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/shielded-burn-amount-width.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "shielded-contract-recipient-review", "description": "Review canonical shielded sends with a modeled non-self ContractAddress recipient arm", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "exact-canonical-send-operand", "complete-successful-histories", "non-self-contract-arm" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/shielded-contract-recipient-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/shielded-contract-recipient-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/shielded-contract-recipient-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 1, 1 ], "incomplete": 0 } }, { "id": "signed-effect-input", "description": "Review ordinary state or shielded input coin sources absent from enforced signature message dependencies", "severity": "low", "severityLevels": [ "low" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-signature-calls", "all-predicates", "original-write-history" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/signed-effect-input.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/signed-effect-input.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/signed-effect-input.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 3, 3 ], "lookalike": [ 3, 3 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unbounded-mint", "description": "A variable mint amount has no modeled per-call cap below the native range or public ledger bound", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-predicates", "canonical-mint-observations", "numeric-bounds" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/unbounded-mint.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unbounded-mint.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unbounded-mint.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unprotected-value-transfer", "description": "Successful token operations have no required application predicate constraining private caller inputs", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-predicates", "all-predicates", "runtime-operations", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/unprotected-value-transfer.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unprotected-value-transfer.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unprotected-value-transfer.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unshielded-refund-endpoint-review", "description": "Review a complete local refund-validator endpoint producing a zero remainder send expression", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "source-local-formula-certificate" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/unshielded-refund-endpoint-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unshielded-refund-endpoint-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unshielded-refund-endpoint-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 5, 5 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 3 ], "negative": [ 7, 9 ], "incomplete": 2 } }, { "id": "zero-amount-complementary-send-review", "description": "Review exact same-color complementary sends with two zero-inclusive amount envelopes", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-send-operands", "complete-original-successful-histories", "immutable-unsigned-subtraction" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/zero-amount-complementary-send-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/zero-amount-complementary-send-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/zero-amount-complementary-send-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 4, 4 ], "corrected": [ 2, 2 ], "lookalike": [ 3, 4 ], "negative": [ 7, 8 ], "incomplete": 1 } }, { "id": "zero-amount-unguarded-map-debit-review", "description": "Review an amount-zero successful numeric Map debit whose exact lookup has unknown prior membership", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "entry-zero-history", "exact-map-lookup", "numeric-subtraction", "ordered-writes" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/zero-amount-unguarded-map-debit-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/zero-amount-unguarded-map-debit-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/zero-amount-unguarded-map-debit-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "zero-amount-unshielded-send", "description": "Review canonical unshielded send amounts with a zero-inclusive successful-history range", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-invocation-snapshots", "all-predicates", "exact-numeric-operands", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/zero-amount-unshielded-send.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/zero-amount-unshielded-send.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/zero-amount-unshielded-send.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "zero-transfer-retained-list-review", "description": "Review zero-inclusive actual transfers paired with retained List append for the exact user recipient", "severity": "info", "severityLevels": [ "info" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-invocation-snapshots", "all-predicates", "exact-collection-selectors", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Token, coin and value transfers", "url": "https://nightshade.dicksonwu.xyz/rules/zero-transfer-retained-list-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/zero-transfer-retained-list-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/zero-transfer-retained-list-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 3, 3 ], "corrected": [ 2, 2 ], "lookalike": [ 3, 4 ], "negative": [ 3, 5 ], "incomplete": 2 } }, { "id": "caller-supplied-ledger-equality", "description": "An unchanged caller input must equal preexisting public ledger bytes before a state-changing effect", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "all-successful-predicates", "private-provenance", "exact-effect-histories" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/caller-supplied-ledger-equality.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/caller-supplied-ledger-equality.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/caller-supplied-ledger-equality.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "destructive-list-reset", "description": "Whole-list reset lacks a recognized same-revision count, empty-list or absent-slot acknowledgment", "severity": "low", "severityLevels": [ "low" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-histories", "successful-predicates", "state-writes", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/destructive-list-reset.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/destructive-list-reset.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/destructive-list-reset.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "inconsistent-keyed-state-guard", "description": "Consumer co-membership is checked on only some successful histories of a keyed insert", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "collection-observations", "successful-predicates", "successful-histories", "state-writes", "runtime-operations", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/inconsistent-keyed-state-guard.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/inconsistent-keyed-state-guard.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/inconsistent-keyed-state-guard.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "mutually-exclusive-terminal-payout", "description": "Terminal payout remains reachable after a mutually exclusive one-time milestone", "severity": "high", "severityLevels": [ "high" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "runtime-operations", "state-writes", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/mutually-exclusive-terminal-payout.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/mutually-exclusive-terminal-payout.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/mutually-exclusive-terminal-payout.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "re-initialization", "description": "Opt-in review of initializer-named entries with a state-changing second invocation", "severity": "low", "severityLevels": [ "low" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "consecutive-invocations", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/re-initialization.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/re-initialization.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/re-initialization.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#re-initialization", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "resettable-list-nonce", "description": "Canonical shielded coin nonce derives solely from a selected ledger List length that another exported entry can reset", "severity": "low", "severityLevels": [ "low" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-mint-observations", "completed-entries", "cross-entry-state-writes" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/resettable-list-nonce.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/resettable-list-nonce.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/resettable-list-nonce.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 4, 4 ], "corrected": [ 4, 4 ], "lookalike": [ 4, 4 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "resettable-memo-nonce-review", "description": "Stored recipient List payload and canonical coin nonce both evolve from the same resettable selected List extent", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-mint-observations", "memo-append-observations", "completed-entries", "cross-entry-state-writes" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/resettable-memo-nonce-review.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/resettable-memo-nonce-review.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/resettable-memo-nonce-review.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 7, 7 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "shared-module-once-gate", "description": "Distinct importing module wrappers expose one canonical false-guard then true-write Boolean gate", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-model", "canonical-module-identities" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/shared-module-once-gate.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/shared-module-once-gate.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/shared-module-once-gate.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 1, 1 ], "incomplete": 0 } }, { "id": "write-only-ledger", "description": "Ordinary ledger Cell is explicitly written but has no Compact source read in the compilation unit", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-model", "ledger-read-write-usage", "bounded-source-absence" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "State and collections", "url": "https://nightshade.dicksonwu.xyz/rules/write-only-ledger.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/write-only-ledger.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/write-only-ledger.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 1, 2 ], "lookalike": [ 1, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "default-recipient-or-owner", "description": "A successful value output or pinned Ownable update uses a known default active address", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "all-predicates", "runtime-operations", "state-writes", "constants", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/default-recipient-or-owner.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/default-recipient-or-owner.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/default-recipient-or-owner.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "exact-balance-threshold", "description": "A threshold-only assertion uses the exact unshielded balance getter instead of its comparison API", "severity": "info", "severityLevels": [ "info" ], "confidence": "high", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-source", "canonical-stdlib-calls", "local-result-uses" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/exact-balance-threshold.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/exact-balance-threshold.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/exact-balance-threshold.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "field-arithmetic-wraparound", "description": "A directly published Field operation on preserved unsigned quantities may wrap without a proved bound", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-types", "numeric-operands", "successful-predicates", "public-sinks" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/field-arithmetic-wraparound.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/field-arithmetic-wraparound.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/field-arithmetic-wraparound.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "inconsistent-access-control", "description": "An exported writer omits the caller-check convention required by a strict majority of its peers", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "successful-predicates", "all-private-predicates", "state-writes", "runtime-operations", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/inconsistent-access-control.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/inconsistent-access-control.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/inconsistent-access-control.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "merkle-insert-without-dedupe", "description": "Review sequential bounded Merkle insertion without exact surviving duplicate prevention", "severity": "info", "severityLevels": [ "info" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "canonical-insertion-snapshots", "collection-observations", "all-predicates", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/merkle-insert-without-dedupe.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/merkle-insert-without-dedupe.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/merkle-insert-without-dedupe.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 1, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "nullifier-check-without-insert", "description": "Required collection absence lacks a definite surviving insertion on a state-changing history", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "low", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "collection-observations", "successful-predicates", "state-writes", "completed-entries" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/nullifier-check-without-insert.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/nullifier-check-without-insert.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/nullifier-check-without-insert.md", "exampleUrl": "https://nightshade.dicksonwu.xyz/examples.html#nullifier-check-without-insert", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 2, 2 ], "corrected": [ 2, 2 ], "lookalike": [ 2, 2 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "publicly-derived-guard-tag", "description": "A supplied tag is required equal to a hash derived from preexisting public ledger data and caller-supplied inputs before an effect", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "medium", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "direct-hash-inputs", "all-successful-predicates", "exact-effect-histories" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/publicly-derived-guard-tag.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/publicly-derived-guard-tag.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/publicly-derived-guard-tag.md", "corpusChecks": { "proofVersion": "0.1.1", "positive": [ 1, 1 ], "corrected": [ 1, 1 ], "lookalike": [ 1, 1 ], "negative": [ 0, 0 ], "incomplete": 0 } }, { "id": "unasserted-security-result", "description": "Review predicate outcomes discarded before effects, persisted, or returned with an effect; security intent unknown", "severity": "medium", "severityLevels": [ "medium" ], "confidence": "varies", "maturity": "experimental", "defaultEnabled": false, "policyRequired": false, "requires": [ "resolved-model" ], "selection": "Opt-in", "category": "Other active opt-ins", "topic": "Source structure and validation", "url": "https://nightshade.dicksonwu.xyz/rules/unasserted-security-result.html", "markdownUrl": "https://nightshade.dicksonwu.xyz/rules/unasserted-security-result.md", "sourceUrl": "https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/unasserted-security-result.md" } ] }