Rule
permissionless-mint-egress
Permissionless mint and egress compose around a stored-value boundary without a modeled authorization predicate.
Specimen 68 of 96 · Other active opt-ins / Token, coin and value transfers
- Severity
- high
- Confidence
- high
- Maturity
- experimental
- Selection
- Opt-in
- Policy intent
- not required
- Release
- v0.1.1
- Engine facts used
runtime-operationssuccessful-predicatescompleted-entries
Selection and scope#
Not selected by default. Select it with --detectors or the detectors list in nightshade.json. Either one replaces profile selection, so list every rule you want.
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors permissionless-mint-egress
./.nightshade/node_modules/.bin/nightshade detector show permissionless-mint-egressThe first command runs only this rule; --detectors takes a comma-separated list. The second prints the rule's metadata from your installed version.
Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.
Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.
Corpus checks#
Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.
| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
|---|---|---|---|---|
| 1/1 | 1/1 | 1/1 | 0/0 | 0 |
No deviations were recorded for this rule.
These are behavior checks on synthetic fixtures, not a precision or recall estimate. See evaluation.
Rule documentation#
From docs/detectors/permissionless-mint-egress.md at v0.1.1.
Availability: opt-in effect review, no policy required. Severity/confidence: high/low.
The rule correlates a canonical mint effect with an unguarded token egress effect. It requires an unguarded mint authority and a completed successful history; beneficiary or buyer predicates may guard the egress. It recognizes named supply/treasury state, a shared token domain, or a same-root permissionless pair as the stored-value boundary. Standard-library mint/send wrappers are mapped back to their user call sites; internal mint claims and output-counter lowerings are not treated as separate withdrawals.
Remediation: bind mint and egress to an authenticated role or protocol state, and enforce the supply/custody invariant across both circuits. An amount cap alone does not establish that invariant.
Intentionally permissionless minting, treasury flows, or public claims can match when they meet the structural conditions. Review the intended supply and custody policy before treating the finding as a defect. The analysis does not establish runtime feasibility, asset loss, or deployed impact.
Suppress a match#
If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:
// nightshade-disable-next-line permissionless-mint-egress -- Reason this match is intentionalDiagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See configuration for fingerprint suppressions and baselines.