# shielded-contract-recipient-review

> Review canonical shielded sends with a modeled non-self ContractAddress recipient arm.

Canonical: https://nightshade.dicksonwu.xyz/rules/shielded-contract-recipient-review.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `shielded-contract-recipient-review` |
| Severity | info |
| Confidence | varies |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Token, coin and value transfers |
| Engine facts used | exact-canonical-send-operand, complete-successful-histories, non-self-contract-arm |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors shielded-contract-recipient-review
./.nightshade/node_modules/.bin/nightshade detector show shielded-contract-recipient-review
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.

| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
| ---: | ---: | ---: | ---: | ---: |
| 2/2 | 2/2 | 2/2 | 1/1 | 0 |

No deviations were recorded for this rule.

These are behavior checks on synthetic fixtures, not a precision or recall estimate. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/shielded-contract-recipient-review.md at v0.1.1.

Availability: **opt-in**, informational severity. No policy required. Select with
`--detectors shielded-contract-recipient-review`.

This rule reports an exact canonical `sendShielded` or `sendImmediateShielded`
call on a complete modeled successful history whose recipient selects the
`ContractAddress` arm of native `Either<ZswapCoinPublicKey, ContractAddress>` and
has an enforced exact non-self address relation. Its supported applicable scope
is Compact 0.34.0 / ZKIR2. Canonical call and native type identity, exact recipient
operands and immutable byte relations supply the evidence; application names and
shared wildcard paths do not.

Review how the transaction supplies the recipient contract's matching
receive/claim composition. External same-transaction composition is unmodeled.
The finding does not establish a missing claim, transaction rejection, concrete
path feasibility or security impact. Intentional forwarding and testing helpers
can match. Account-only and exact self-recipient controls remain quiet.

The ordinary pass and admitted top-level native recipient-tag specializations
share the unchanged allowances: 40,000 steps, 256 retained paths and 50,000
cumulative abstract values by default. All required passes must finish before
findings are admitted. Unknown or opaque tags, unavailable exact histories,
unsupported applicable profiles, checkpoints, external contract-call composition
and exhausted allowances produce scoped incomplete diagnostics. Structural
absence does not provide an absence guarantee for incomplete baseline semantics.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line shielded-contract-recipient-review -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/shielded-contract-recipient-review.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#token-coin-and-value-transfers)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)