Rule
shielded-contract-recipient-review
Review canonical shielded sends with a modeled non-self ContractAddress recipient arm.
Specimen 71 of 96 · Other active opt-ins / Token, coin and value transfers
- Severity
- info
- Confidence
- varies
- Maturity
- experimental
- Selection
- Opt-in
- Policy intent
- not required
- Release
- v0.1.1
- Engine facts used
exact-canonical-send-operandcomplete-successful-historiesnon-self-contract-arm
Selection and scope#
Not selected by default. Select it with --detectors or the detectors list in nightshade.json. Either one replaces profile selection, so list every rule you want.
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors shielded-contract-recipient-review
./.nightshade/node_modules/.bin/nightshade detector show shielded-contract-recipient-reviewThe first command runs only this rule; --detectors takes a comma-separated list. The second prints the rule's metadata from your installed version.
Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.
Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.
Corpus checks#
Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.
| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
|---|---|---|---|---|
| 2/2 | 2/2 | 2/2 | 1/1 | 0 |
No deviations were recorded for this rule.
These are behavior checks on synthetic fixtures, not a precision or recall estimate. See evaluation.
Rule documentation#
From docs/detectors/shielded-contract-recipient-review.md at v0.1.1.
Availability: opt-in, informational severity. No policy required. Select with --detectors shielded-contract-recipient-review.
This rule reports an exact canonical sendShielded or sendImmediateShielded call on a complete modeled successful history whose recipient selects the ContractAddress arm of native Either<ZswapCoinPublicKey, ContractAddress> and has an enforced exact non-self address relation. Its supported applicable scope is Compact 0.34.0 / ZKIR2. Canonical call and native type identity, exact recipient operands and immutable byte relations supply the evidence; application names and shared wildcard paths do not.
Review how the transaction supplies the recipient contract's matching receive/claim composition. External same-transaction composition is unmodeled. The finding does not establish a missing claim, transaction rejection, concrete path feasibility or security impact. Intentional forwarding and testing helpers can match. Account-only and exact self-recipient controls remain quiet.
The ordinary pass and admitted top-level native recipient-tag specializations share the unchanged allowances: 40,000 steps, 256 retained paths and 50,000 cumulative abstract values by default. All required passes must finish before findings are admitted. Unknown or opaque tags, unavailable exact histories, unsupported applicable profiles, checkpoints, external contract-call composition and exhausted allowances produce scoped incomplete diagnostics. Structural absence does not provide an absence guarantee for incomplete baseline semantics.
Suppress a match#
If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:
// nightshade-disable-next-line shielded-contract-recipient-review -- Reason this match is intentionalDiagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See configuration for fingerprint suppressions and baselines.