# caller-supplied-time-review

> Review an effect-bearing caller value checked against a ledger bound without a same-branch exact clock constraint; time intent unknown.

Canonical: https://nightshade.dicksonwu.xyz/rules/caller-supplied-time-review.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `caller-supplied-time-review` |
| Severity | medium |
| Confidence | medium |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Time and freshness |
| Engine facts used | resolved-model |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors caller-supplied-time-review
./.nightshade/node_modules/.bin/nightshade detector show caller-supplied-time-review
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

The 0.1.1 proof run had no mapped synthetic corpus checks for this rule, so there are no measured results to show here. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/caller-supplied-time-review.md at v0.1.1.

Availability: **opt-in** with `--detectors caller-supplied-time-review`; no policy
required. Severity/confidence: **medium/low**.

On a local exported-circuit branch with a ledger write or canonical send, flags an
enforced comparison that places a caller `Uint<64>` above a ledger-derived bound
without enforcing `blockTimeGte` or `blockTimeGt` on the same value. A `Uint<64>`
need not represent time; independent review must establish that intent.

Uses resolved identities, local aliases and separate branch states. It does not
infer time from names, comments or strings. Direct calls are supported;
helper-mediated constraints are outside this review. Unsupported loops and
exhausted traversal budgets produce diagnostics.

A caller-supplied numeric bound can be intentional, and the rule does not infer
that the value represents a timestamp. Review the protocol's time source and
same-branch guards before changing the circuit; this finding does not prove a
feasible stale-time execution.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line caller-supplied-time-review -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/caller-supplied-time-review.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#time-and-freshness)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)