# Rules > All 96 Nightshade rules for Compact, with severity, confidence, selection mode and a page for each rule. Canonical: https://nightshade.dicksonwu.xyz/rules.html Release: Nightshade 0.1.1 (v0.1.1) Rules are grouped by selection category, then by topic for other opt-ins. Each line gives severity, selection and a description, with a link to its documentation at v0.1.1. All built-in rules are experimental. Severity is review priority, not a probability or a confirmed impact. Intentional behavior can match. Read each rule's evidence, benign matches and limits. The implicit `audit` profile selects ordinary audit rules and dormant policy rules. `--profile hygiene` adds source hygiene. `--detectors ID,ID` replaces profile selection with an exact nonempty set. Policy rules need matching application intent even when selected. Topic headings are not CLI selection shortcuts. Machine-readable catalog: https://nightshade.dicksonwu.xyz/rules.json ## Audit-default ordinary rules 24 rules. Run on every ordinary scan. - [caller-supplied-deadline](https://nightshade.dicksonwu.xyz/rules/caller-supplied-deadline.md): Caller-supplied time satisfies a ledger-derived delay without a chain-time upper bound. Severity medium; Audit default; confidence medium. - [circuit-cost](https://nightshade.dicksonwu.xyz/rules/circuit-cost.md): Expanded source-operation estimate exceeds the review threshold; this is not a proof-row estimate. Severity info; Audit default; confidence high. - [discarded-comparison](https://nightshade.dicksonwu.xyz/rules/discarded-comparison.md): A comparison not reduced to a source constant is discarded or kept only by unused immutable aliases. Severity low; Audit default; confidence high. - [discarded-shielded-send-result](https://nightshade.dicksonwu.xyz/rules/discarded-shielded-send-result.md): Canonical shielded send or mint metadata is discarded or retained only by unused immutable aliases. Severity info; Audit default; confidence varies. - [duplicate-shielded-mint](https://nightshade.dicksonwu.xyz/rules/duplicate-shielded-mint.md): Identical canonical shielded mint inputs produce a duplicate coin commitment in one transaction. Severity medium; Audit default; confidence varies. - [duplicated-branch-tail](https://nightshade.dicksonwu.xyz/rules/duplicated-branch-tail.md): Terminating branch repeats its immediate following expression and return tail. Severity info; Audit default; confidence high. - [either-payload-mismatch](https://nightshade.dicksonwu.xyz/rules/either-payload-mismatch.md): A native Either's known inactive arm reaches an output, state effect or successful effect gate. Severity info; Audit default; confidence high. - [field-recomposition-range-review](https://nightshade.dicksonwu.xyz/rules/field-recomposition-range-review.md): Enforced Field recomposition retains quotient/remainder envelopes beyond the modulus. Severity info; Audit default; confidence high. - [freshness-bound-caller-time](https://nightshade.dicksonwu.xyz/rules/freshness-bound-caller-time.md): Caller-supplied time reaches a security-sensitive effect without a canonical block-time freshness bound. Severity medium; Audit default; confidence medium. - [identity-signature-key](https://nightshade.dicksonwu.xyz/rules/identity-signature-key.md): A successful history passes a known identity point to the pinned Schnorr verifier. Severity medium; Audit default; confidence high. - [ignored-validation-result](https://nightshade.dicksonwu.xyz/rules/ignored-validation-result.md): A canonical signature verifier's Boolean outcome is discarded or retained only by unused local aliases. Severity medium; Audit default; confidence high. - [impossible-assertion](https://nightshade.dicksonwu.xyz/rules/impossible-assertion.md): A nonliteral assertion fails on every reaching path, or an entry has no successful path. Severity medium; Audit default; confidence high. - [ledger-bound-preimage-publication](https://nightshade.dicksonwu.xyz/rules/ledger-bound-preimage-publication.md): A private preimage checked against a ledger hash is also published on a potential successful path. Severity medium; Audit default; confidence medium. - [low-entropy-hash-disclosure](https://nightshade.dicksonwu.xyz/rules/low-entropy-hash-disclosure.md): A published direct hash has one private input drawn from a small declared domain. Severity medium; Audit default; confidence high. - [merkle-leaf-binding-review](https://nightshade.dicksonwu.xyz/rules/merkle-leaf-binding-review.md): Checked Merkle path leaves lack binding to supplied lookup inputs or exact Field hash write candidates. Severity info; Audit default; confidence varies. - [merkle-membership-not-enforced](https://nightshade.dicksonwu.xyz/rules/merkle-membership-not-enforced.md): Proof-related state changes lack an enforced relationship between the exact digest and trusted ledger roots. Severity medium; Audit default; confidence low. - [missing-role-bootstrap](https://nightshade.dicksonwu.xyz/rules/missing-role-bootstrap.md): An authenticated ShieldedAccessControl instance initializes but has no role-seeding route. Severity low; Audit default; confidence varies. - [predictable-commitment-randomness](https://nightshade.dicksonwu.xyz/rules/predictable-commitment-randomness.md): A published private-derived commitment uses statically known randomness. Severity medium; Audit default; confidence high. - [public-key-membership-authorization](https://nightshade.dicksonwu.xyz/rules/public-key-membership-authorization.md): A raw native ownPublicKey selects a required member of preexisting public ledger storage before successful state-changing effects. Severity high; Audit default; confidence high. - [publicly-derivable-encryption-secret](https://nightshade.dicksonwu.xyz/rules/publicly-derivable-encryption-secret.md): A published digest determines the scalar of a registered curve point through resolved native calls. Severity high; Audit default; confidence varies. - [redundant-boolean-branch](https://nightshade.dicksonwu.xyz/rules/redundant-boolean-branch.md): Both branch arms only return opposite Boolean literals. Severity info; Audit default; confidence high. - [redundant-self-shielded-receive](https://nightshade.dicksonwu.xyz/rules/redundant-self-shielded-receive.md): Exact self-addressed canonical returned coin is subsequently passed to receiveShielded. Severity info; Audit default; confidence high. - [spoofable-authorization](https://nightshade.dicksonwu.xyz/rules/spoofable-authorization.md): A raw witness equality with public data is required for a state-changing effect; review the intended authentication. Severity low / high / critical; Audit default; confidence varies. - [zero-amount-set-consumption-review](https://nightshade.dicksonwu.xyz/rules/zero-amount-set-consumption-review.md): Review exact surviving Set absence consumption before a zero-inclusive canonical unshielded payout. Severity info; Audit default; confidence varies. ## Additional hygiene rules 7 rules. Added by --profile hygiene. - [always-true-assertion](https://nightshade.dicksonwu.xyz/rules/always-true-assertion.md): Assertion is already true on every analyzed reach before enforcing it. Severity info; Hygiene only; confidence high. - [constant-condition](https://nightshade.dicksonwu.xyz/rules/constant-condition.md): Branch condition reduces to a typed scalar source constant. Severity info; Hygiene only; confidence high. - [dead-code](https://nightshade.dicksonwu.xyz/rules/dead-code.md): Statement, branch or loop is excluded by source control flow. Severity info; Hygiene only; confidence high. - [shadowing](https://nightshade.dicksonwu.xyz/rules/shadowing.md): Parameter or local binding hides an outer declaration. Severity info; Hygiene only; confidence high. - [time-dependence](https://nightshade.dicksonwu.xyz/rules/time-dependence.md): A successful circuit uses a protocol block-time comparison. Severity info; Hygiene only; confidence high. - [unnecessary-disclose](https://nightshade.dicksonwu.xyz/rules/unnecessary-disclose.md): Disclosure operand is already public in the source context. Severity info; Hygiene only; confidence high. - [unused-declaration](https://nightshade.dicksonwu.xyz/rules/unused-declaration.md): Ledger, witness or private circuit has no reference in the compilation unit. Severity info; Hygiene only; confidence high. ## Policy-dependent rules 13 rules. Need application intent declared in policies. - [checkpoint-splits-atomic-update](https://nightshade.dicksonwu.xyz/rules/checkpoint-splits-atomic-update.md): A checkpoint splits a declared ordinary Cell co-update across atomic units. Severity low; Opt-in + policy; confidence high. - [circuit-work-budget](https://nightshade.dicksonwu.xyz/rules/circuit-work-budget.md): Expanded source-operation estimate exceeds an explicit circuit work budget. Severity low; Audit; needs policy; confidence high. - [current-root-policy-mismatch](https://nightshade.dicksonwu.xyz/rules/current-root-policy-mismatch.md): An explicitly selected membership guard lacks current-root evidence at enforcement time. Severity medium; Opt-in + policy; confidence medium. - [declared-secret-publication](https://nightshade.dicksonwu.xyz/rules/declared-secret-publication.md): Policy-declared secret information reaches a public sink through an unapproved transformation. Severity high; Audit; needs policy; confidence medium. - [forbidden-state-transition](https://nightshade.dicksonwu.xyz/rules/forbidden-state-transition.md): A scalar state write may cross a transition explicitly forbidden by policy. Severity medium; Audit; needs policy; confidence medium. - [openzeppelin-preconditions](https://nightshade.dicksonwu.xyz/rules/openzeppelin-preconditions.md): Opt-in documented preconditions of authenticated OpenZeppelin Compact modules. Severity medium; Configured builtins; confidence high. - [operation-intent-policy](https://nightshade.dicksonwu.xyz/rules/operation-intent-policy.md): A protected Cell mutation does not satisfy its declared complete operation-intent statement. Severity info; Opt-in + policy; confidence high. - [source-claim-map-getter-review](https://nightshade.dicksonwu.xyz/rules/source-claim-map-getter-review.md): An explicitly documented configured Map getter returns only default without reading the selected Map. Severity info; Opt-in + policy; confidence varies. - [source-claim-shielded-issuance-review](https://nightshade.dicksonwu.xyz/rules/source-claim-shielded-issuance-review.md): Review an explicit adjacent source claim paired with shielded issuance to a user key. Severity info; Opt-in + policy; confidence varies. - [stale-nft-metadata](https://nightshade.dicksonwu.xyz/rules/stale-nft-metadata.md): Policy-selected current NFT metadata retains an old auxiliary payload across same-history burn/remint. Severity low; Opt-in + policy; confidence varies. - [unguarded-sensitive-state-write](https://nightshade.dicksonwu.xyz/rules/unguarded-sensitive-state-write.md): A successful path writes policy-protected state without the configured preceding guard. Severity high; Audit; needs policy; confidence medium. - [unsupported-contract-owner](https://nightshade.dicksonwu.xyz/rules/unsupported-contract-owner.md): A declared callable pinned Ownable instance finishes with a contract-address owner rejected by its guard. Severity medium; Opt-in + policy; confidence high. - [zero-amount-initial-membership](https://nightshade.dicksonwu.xyz/rules/zero-amount-initial-membership.md): Under a declared zero-amount policy, every modeled successful invocation requires the same Map entry to have been present initially. Severity low; Opt-in + policy; confidence low. ## Other active opt-ins 52 rules. Select them explicitly with --detectors or the detectors list. ### Time and freshness - [caller-supplied-time-review](https://nightshade.dicksonwu.xyz/rules/caller-supplied-time-review.md): Review an effect-bearing caller value checked against a ledger bound without a same-branch exact clock constraint; time intent unknown. Severity medium; Opt-in; confidence medium. - [shielded-coin-runtime-width](https://nightshade.dicksonwu.xyz/rules/shielded-coin-runtime-width.md): A definite native shielded output exceeds the expressly assumed runtime coin encoding range. Severity low; Opt-in; confidence low. ### Authorization, identity and membership - [caller-key-zero-entry-review](https://nightshade.dicksonwu.xyz/rules/caller-key-zero-entry-review.md): Review a surviving zero numeric Map insertion at a direct caller key without required initial same-key membership. Severity info; Opt-in; confidence high. - [closed-membership-capacity-review](https://nightshade.dicksonwu.xyz/rules/closed-membership-capacity-review.md): A represented constructor history contradicts distinct Set memberships under a complete source closure without subsequent writers. Severity info; Opt-in; confidence varies. - [configured-membership-capacity-review](https://nightshade.dicksonwu.xyz/rules/configured-membership-capacity-review.md): Immediate post-constructor collection capacity contradicts required distinct memberships. Severity info; Opt-in; confidence high. - [enrolled-signature-key-review](https://nightshade.dicksonwu.xyz/rules/enrolled-signature-key-review.md): Review unknown persistent Schnorr keys without modeled identity rejection. Severity info; Opt-in; confidence varies. - [membership-identity-binding-review](https://nightshade.dicksonwu.xyz/rules/membership-identity-binding-review.md): Keyed mutation digest/key equality and required Set membership use independent witness snapshots. Severity info; Opt-in; confidence varies. - [native-key-authentication-review](https://nightshade.dicksonwu.xyz/rules/native-key-authentication-review.md): Canonical prover-supplied ownPublicKey participates in a required ledger credential check. Severity info; Opt-in; confidence high. - [quorum-signer-uniqueness-review](https://nightshade.dicksonwu.xyz/rules/quorum-signer-uniqueness-review.md): Adjacent signer inequalities omit non-adjacent pairs in a verified threshold claim vector. Severity info; Opt-in; confidence high. - [signature-key-identity-exclusion-review](https://nightshade.dicksonwu.xyz/rules/signature-key-identity-exclusion-review.md): Review unknown native signature keys without modeled exact identity exclusion. Severity info; Opt-in; confidence varies. - [split-witness-identity](https://nightshade.dicksonwu.xyz/rules/split-witness-identity.md): Ledger-bound witness digest and mutation operand use independently supplied witness snapshots without mandatory equality binding. Severity low; Opt-in; confidence high. - [stored-schnorr-key-enrollment-review](https://nightshade.dicksonwu.xyz/rules/stored-schnorr-key-enrollment-review.md): Review stored supplied Schnorr keys with enrollment and enforced canonical use lacking modeled identity rejection. Severity info; Opt-in; confidence varies. - [zero-default-getter-membership-review](https://nightshade.dicksonwu.xyz/rules/zero-default-getter-membership-review.md): Review explicit absent-to-zero getter evidence alongside an all-zero-success initial-membership Map decrement. Severity info; Opt-in; confidence high. ### Privacy and cryptographic derivations - [checked-digest-narrowing](https://nightshade.dicksonwu.xyz/rules/checked-digest-narrowing.md): A full canonical hash is range-checked by a Uint cast on its source route to a ledger write or exported return. Severity info; Opt-in; confidence high. - [conditional-hash-range](https://nightshade.dicksonwu.xyz/rules/conditional-hash-range.md): Conditional unsigned subtraction reaches a fixed-width native persistent-hash input without a qualified inactive-case range invariant. Severity low; Opt-in; confidence low. - [generic-witness-maybe-abi](https://nightshade.dicksonwu.xyz/rules/generic-witness-maybe-abi.md): Shared generic optional witness dispatch has incompatible mandatory bigint/byte-array payload guards; profile-specific compatibility review. Severity low; Opt-in; confidence low. - [public-two-component-domain-review](https://nightshade.dicksonwu.xyz/rules/public-two-component-domain-review.md): Review a public two-input native digest lacking represented self binding and component default exclusion. Severity info; Opt-in; confidence high. - [published-digest-generator-scalar-review](https://nightshade.dicksonwu.xyz/rules/published-digest-generator-scalar-review.md): Published exact digest determines a scalar used in native generator multiplication whose result survives in a ledger Cell. Severity info; Opt-in; confidence high. - [secret-binding-divergence-review](https://nightshade.dicksonwu.xyz/rules/secret-binding-divergence-review.md): Same-key ledger writers enforce different domain-qualified secret-binding declaration families. Severity info; Opt-in; confidence varies. - [transient-digest-to-ledger](https://nightshade.dicksonwu.xyz/rules/transient-digest-to-ledger.md): Terminal ledger data is constructed using an upgrade-unstable transient hash or commitment. Severity low; Opt-in; confidence low. - [unconstrained-witness-to-state](https://nightshade.dicksonwu.xyz/rules/unconstrained-witness-to-state.md): A raw witness leaf reaches surviving ledger state without a modeled assertion using that leaf. Severity medium; Opt-in; confidence varies. - [witness-derived-value-review](https://nightshade.dicksonwu.xyz/rules/witness-derived-value-review.md): Review direct witness-derived canonical-send recipients without an exact prior ledger equality binding. Severity medium; Opt-in; confidence varies. ### Token, coin and value transfers - [exported-shielded-descriptor](https://nightshade.dicksonwu.xyz/rules/exported-shielded-descriptor.md): Canonical shielded coin descriptor fields have an unchanged source route to an exported result. Severity info; Opt-in; confidence varies. - [permissionless-mint-egress](https://nightshade.dicksonwu.xyz/rules/permissionless-mint-egress.md): Permissionless mint and egress compose around a stored-value boundary without a modeled authorization predicate. Severity high; Opt-in; confidence high. - [received-coin-not-validated](https://nightshade.dicksonwu.xyz/rules/received-coin-not-validated.md): Received shielded coin lacks a recorded application constraint on color or value. Severity low; Opt-in; confidence low. - [shielded-burn-amount-width](https://nightshade.dicksonwu.xyz/rules/shielded-burn-amount-width.md): An exported amount is forwarded unchanged to a canonical shielded burn whose coin and API amount types are wider. Severity info; Opt-in; confidence high. - [shielded-contract-recipient-review](https://nightshade.dicksonwu.xyz/rules/shielded-contract-recipient-review.md): Review canonical shielded sends with a modeled non-self ContractAddress recipient arm. Severity info; Opt-in; confidence varies. - [signed-effect-input](https://nightshade.dicksonwu.xyz/rules/signed-effect-input.md): Review ordinary state or shielded input coin sources absent from enforced signature message dependencies. Severity low; Opt-in; confidence varies. - [unbounded-mint](https://nightshade.dicksonwu.xyz/rules/unbounded-mint.md): A variable mint amount has no modeled per-call cap below the native range or public ledger bound. Severity medium; Opt-in; confidence varies. - [unprotected-value-transfer](https://nightshade.dicksonwu.xyz/rules/unprotected-value-transfer.md): Successful token operations have no required application predicate constraining private caller inputs. Severity low; Opt-in; confidence low. - [unshielded-refund-endpoint-review](https://nightshade.dicksonwu.xyz/rules/unshielded-refund-endpoint-review.md): Review a complete local refund-validator endpoint producing a zero remainder send expression. Severity info; Opt-in; confidence varies. - [zero-amount-complementary-send-review](https://nightshade.dicksonwu.xyz/rules/zero-amount-complementary-send-review.md): Review exact same-color complementary sends with two zero-inclusive amount envelopes. Severity info; Opt-in; confidence varies. - [zero-amount-unguarded-map-debit-review](https://nightshade.dicksonwu.xyz/rules/zero-amount-unguarded-map-debit-review.md): Review an amount-zero successful numeric Map debit whose exact lookup has unknown prior membership. Severity info; Opt-in; confidence high. - [zero-amount-unshielded-send](https://nightshade.dicksonwu.xyz/rules/zero-amount-unshielded-send.md): Review canonical unshielded send amounts with a zero-inclusive successful-history range. Severity info; Opt-in; confidence varies. - [zero-transfer-retained-list-review](https://nightshade.dicksonwu.xyz/rules/zero-transfer-retained-list-review.md): Review zero-inclusive actual transfers paired with retained List append for the exact user recipient. Severity info; Opt-in; confidence varies. ### State and collections - [caller-supplied-ledger-equality](https://nightshade.dicksonwu.xyz/rules/caller-supplied-ledger-equality.md): An unchanged caller input must equal preexisting public ledger bytes before a state-changing effect. Severity medium; Opt-in; confidence medium. - [destructive-list-reset](https://nightshade.dicksonwu.xyz/rules/destructive-list-reset.md): Whole-list reset lacks a recognized same-revision count, empty-list or absent-slot acknowledgment. Severity low; Opt-in; confidence varies. - [inconsistent-keyed-state-guard](https://nightshade.dicksonwu.xyz/rules/inconsistent-keyed-state-guard.md): Consumer co-membership is checked on only some successful histories of a keyed insert. Severity info; Opt-in; confidence high. - [mutually-exclusive-terminal-payout](https://nightshade.dicksonwu.xyz/rules/mutually-exclusive-terminal-payout.md): Terminal payout remains reachable after a mutually exclusive one-time milestone. Severity high; Opt-in; confidence high. - [re-initialization](https://nightshade.dicksonwu.xyz/rules/re-initialization.md): Opt-in review of initializer-named entries with a state-changing second invocation. Severity low; Opt-in; confidence low. - [resettable-list-nonce](https://nightshade.dicksonwu.xyz/rules/resettable-list-nonce.md): Canonical shielded coin nonce derives solely from a selected ledger List length that another exported entry can reset. Severity low; Opt-in; confidence high. - [resettable-memo-nonce-review](https://nightshade.dicksonwu.xyz/rules/resettable-memo-nonce-review.md): Stored recipient List payload and canonical coin nonce both evolve from the same resettable selected List extent. Severity info; Opt-in; confidence high. - [shared-module-once-gate](https://nightshade.dicksonwu.xyz/rules/shared-module-once-gate.md): Distinct importing module wrappers expose one canonical false-guard then true-write Boolean gate. Severity info; Opt-in; confidence high. - [write-only-ledger](https://nightshade.dicksonwu.xyz/rules/write-only-ledger.md): Ordinary ledger Cell is explicitly written but has no Compact source read in the compilation unit. Severity info; Opt-in; confidence high. ### Source structure and validation - [default-recipient-or-owner](https://nightshade.dicksonwu.xyz/rules/default-recipient-or-owner.md): A successful value output or pinned Ownable update uses a known default active address. Severity medium; Opt-in; confidence high. - [exact-balance-threshold](https://nightshade.dicksonwu.xyz/rules/exact-balance-threshold.md): A threshold-only assertion uses the exact unshielded balance getter instead of its comparison API. Severity info; Opt-in; confidence high. - [field-arithmetic-wraparound](https://nightshade.dicksonwu.xyz/rules/field-arithmetic-wraparound.md): A directly published Field operation on preserved unsigned quantities may wrap without a proved bound. Severity medium; Opt-in; confidence varies. - [inconsistent-access-control](https://nightshade.dicksonwu.xyz/rules/inconsistent-access-control.md): An exported writer omits the caller-check convention required by a strict majority of its peers. Severity medium; Opt-in; confidence low. - [merkle-insert-without-dedupe](https://nightshade.dicksonwu.xyz/rules/merkle-insert-without-dedupe.md): Review sequential bounded Merkle insertion without exact surviving duplicate prevention. Severity info; Opt-in; confidence medium. - [nullifier-check-without-insert](https://nightshade.dicksonwu.xyz/rules/nullifier-check-without-insert.md): Required collection absence lacks a definite surviving insertion on a state-changing history. Severity medium; Opt-in; confidence low. - [publicly-derived-guard-tag](https://nightshade.dicksonwu.xyz/rules/publicly-derived-guard-tag.md): A supplied tag is required equal to a hash derived from preexisting public ledger data and caller-supplied inputs before an effect. Severity medium; Opt-in; confidence medium. - [unasserted-security-result](https://nightshade.dicksonwu.xyz/rules/unasserted-security-result.md): Review predicate outcomes discarded before effects, persisted, or returned with an effect; security intent unknown. Severity medium; Opt-in; confidence varies. ## Inspect the installed rules Using the installation from [getting started](https://nightshade.dicksonwu.xyz/getting-started.md): ```sh ./.nightshade/node_modules/.bin/nightshade detector list ./.nightshade/node_modules/.bin/nightshade detector show ledger-bound-preimage-publication ``` [Released catalog](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors.md) | [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)