Rule
caller-supplied-time-review
Review an effect-bearing caller value checked against a ledger bound without a same-branch exact clock constraint; time intent unknown.
Specimen 45 of 96 · Other active opt-ins / Time and freshness
- Severity
- medium
- Confidence
- medium
- Maturity
- experimental
- Selection
- Opt-in
- Policy intent
- not required
- Release
- v0.1.1
- Engine facts used
resolved-model
Selection and scope#
Not selected by default. Select it with --detectors or the detectors list in nightshade.json. Either one replaces profile selection, so list every rule you want.
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors caller-supplied-time-review
./.nightshade/node_modules/.bin/nightshade detector show caller-supplied-time-reviewThe first command runs only this rule; --detectors takes a comma-separated list. The second prints the rule's metadata from your installed version.
Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.
Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.
Corpus checks#
The 0.1.1 proof run had no mapped synthetic corpus checks for this rule, so there are no measured results to show here. See evaluation.
Rule documentation#
From docs/detectors/caller-supplied-time-review.md at v0.1.1.
Availability: opt-in with --detectors caller-supplied-time-review; no policy required. Severity/confidence: medium/low.
On a local exported-circuit branch with a ledger write or canonical send, flags an enforced comparison that places a caller Uint<64> above a ledger-derived bound without enforcing blockTimeGte or blockTimeGt on the same value. A Uint<64> need not represent time; independent review must establish that intent.
Uses resolved identities, local aliases and separate branch states. It does not infer time from names, comments or strings. Direct calls are supported; helper-mediated constraints are outside this review. Unsupported loops and exhausted traversal budgets produce diagnostics.
A caller-supplied numeric bound can be intentional, and the rule does not infer that the value represents a timestamp. Review the protocol's time source and same-branch guards before changing the circuit; this finding does not prove a feasible stale-time execution.
Suppress a match#
If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:
// nightshade-disable-next-line caller-supplied-time-review -- Reason this match is intentionalDiagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See configuration for fingerprint suppressions and baselines.