Rule
caller-supplied-deadline
Caller-supplied time satisfies a ledger-derived delay without a chain-time upper bound.
Specimen 01 of 96 · Audit-default ordinary rules
- Severity
- medium
- Confidence
- medium
- Maturity
- experimental
- Selection
- Audit default
- Policy intent
- not required
- Release
- v0.1.1
- Engine facts used
resolved-model
Selection and scope#
Selected by the default audit profile, so an ordinary scan runs it.
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors caller-supplied-deadline
./.nightshade/node_modules/.bin/nightshade detector show caller-supplied-deadlineThe first command runs only this rule; --detectors takes a comma-separated list. The second prints the rule's metadata from your installed version.
Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.
Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.
Corpus checks#
Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.
| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
|---|---|---|---|---|
| 1/1 | 1/1 | 1/1 | 0/0 | 0 |
No deviations were recorded for this rule.
These are behavior checks on synthetic fixtures, not a precision or recall estimate. See evaluation.
Rule documentation#
From docs/detectors/caller-supplied-deadline.md at v0.1.1.
Availability: audit default; no policy required. Severity/confidence: medium/medium.
An exported circuit asserts that a caller-supplied Uint<64> time has reached a deadline computed by adding to ledger data, but does not assert that the supplied time is at or before protocol block time. A caller may be able to pass the deadline before the intended chain-time wait has elapsed.
const deadline = (announcedAt + noticeSeconds) as Uint<64>;
assert(disclose(currentTimestamp >= deadline), "Wait for notice");The rule follows local aliases and casts in the exported circuit and recognizes an asserted canonical blockTimeGte or blockTimeGt check of the same time parameter as an upper bound. It looks for a Uint<64> parameter whose name contains time or is now; that name is an admission heuristic, not proof of intended time semantics. Helpers and cross-entrypoint guards are not substituted, and a quiet result does not certify a timelock. Its source traversal has a finite allowance and reports exhaustion as a diagnostic.
Check the circuit that records the start time as well as the delayed action. Bind caller time to protocol block time or compare the ledger deadline directly with block time.
A known benign match is a circuit that deliberately uses a caller-selected time for an application-defined delay. The time or now parameter-name test is only an admission heuristic; it does not prove that the value represents protocol time. This local review does not follow helper or cross-entrypoint checks and does not prove a feasible early execution.
Suppress a match#
If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:
// nightshade-disable-next-line caller-supplied-deadline -- Reason this match is intentionalDiagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See configuration for fingerprint suppressions and baselines.