[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-cairo-vulnerability-scanner":3,"mdc--93przq-key":38,"related-repo-trail-of-bits-cairo-vulnerability-scanner":1952,"related-org-trail-of-bits-cairo-vulnerability-scanner":2046},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":33,"sourceUrl":36,"mdContent":37},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},"Smart Contracts","smart-contracts",{"name":24,"slug":25,"type":16},"Code Analysis","code-analysis",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-18T05:47:42.84568",null,541,[32],"agent-skills",{"repoUrl":27,"stars":26,"forks":30,"topics":34,"description":35},[32],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Fbuilding-secure-contracts\u002Fskills\u002Fcairo-vulnerability-scanner","---\nname: cairo-vulnerability-scanner\ndescription: Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.\n---\n\n# Cairo\u002FStarkNet Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan Cairo smart contracts on StarkNet for platform-specific security vulnerabilities related to arithmetic, cross-layer messaging, and cryptographic operations. This skill encodes 6 critical vulnerability patterns unique to Cairo\u002FStarkNet ecosystem.\n\n## 2. When to Use This Skill\n\n- Auditing StarkNet smart contracts (Cairo)\n- Reviewing L1-L2 bridge implementations\n- Pre-launch security assessment of StarkNet applications\n- Validating cross-layer message handling\n- Reviewing signature verification logic\n- Assessing L1 handler functions\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **Cairo files**: `.cairo`\n\n### Language\u002FFramework Markers\n```rust\n\u002F\u002F Cairo contract indicators\n#[contract]\nmod MyContract {\n    use starknet::ContractAddress;\n\n    #[storage]\n    struct Storage {\n        balance: LegacyMap\u003CContractAddress, felt252>,\n    }\n\n    #[external(v0)]\n    fn transfer(ref self: ContractState, to: ContractAddress, amount: felt252) {\n        \u002F\u002F Contract logic\n    }\n\n    #[l1_handler]\n    fn handle_deposit(ref self: ContractState, from_address: felt252, amount: u256) {\n        \u002F\u002F L1 message handler\n    }\n}\n\n\u002F\u002F Common patterns\nfelt252, u128, u256\nContractAddress, EthAddress\n#[external(v0)], #[l1_handler], #[constructor]\nget_caller_address(), get_contract_address()\nsend_message_to_l1_syscall\n```\n\n### Project Structure\n- `src\u002Fcontract.cairo` - Main contract implementation\n- `src\u002Flib.cairo` - Library modules\n- `tests\u002F` - Contract tests\n- `Scarb.toml` - Cairo project configuration\n\n### Tool Support\n- **Caracal**: Trail of Bits static analyzer for Cairo\n- Installation: `pip install caracal`\n- Usage: `caracal detect src\u002F`\n- **cairo-test**: Built-in testing framework\n- **Starknet Foundry**: Testing and development toolkit\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for Cairo files\n2. **Analyze each contract** for the 6 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check L1-L2 interactions** for messaging vulnerabilities\n\n---\n\n## 5. Example Output\n\nWhen vulnerabilities are found, you'll get a report like this:\n\n```\n=== CAIRO\u002FSTARKNET VULNERABILITY SCAN RESULTS ===\n\n\n---\n\n## 5. Vulnerability Patterns (6 Patterns)\n\nI check for 6 critical vulnerability patterns unique to Cairo\u002FStarknet. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Unchecked Arithmetic** ⚠️ CRITICAL - Integer overflow\u002Funderflow in felt252\n2. **Storage Collision** ⚠️ CRITICAL - Conflicting storage variable hashes\n3. **Missing Access Control** ⚠️ CRITICAL - No caller validation on sensitive functions\n4. **Improper Felt252 Boundaries** ⚠️ HIGH - Not validating felt252 range\n5. **Unvalidated Contract Address** ⚠️ HIGH - Using untrusted contract addresses\n6. **Missing Caller Validation** ⚠️ CRITICAL - No get_caller_address() checks\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify Cairo language and StarkNet framework\n2. Check Cairo version (Cairo 1.0+ vs legacy Cairo 0)\n3. Locate contract files (`src\u002F*.cairo`)\n4. Identify L1-L2 bridge contracts (if applicable)\n\n### Step 2: Arithmetic Safety Sweep\n```bash\n# Find felt252 usage in arithmetic\nrg \"felt252\" src\u002F | rg \"[-+*\u002F]\"\n\n# Find balance\u002Famount storage using felt252\nrg \"felt252\" src\u002F | rg \"balance|amount|total|supply\"\n\n# Should prefer u128, u256 instead\n```\n\n### Step 3: L1 Handler Analysis\nFor each `#[l1_handler]` function:\n- [ ] Validates `from_address` parameter\n- [ ] Checks address != zero\n- [ ] Has proper access control\n- [ ] Emits events for monitoring\n\n### Step 4: Signature Verification Review\nFor signature-based functions:\n- [ ] Includes nonce tracking\n- [ ] Nonce incremented after use\n- [ ] Domain separator includes chain ID and contract address\n- [ ] Cannot replay signatures\n\n### Step 5: L1-L2 Bridge Audit\nIf contract includes bridge functionality:\n- [ ] L1 validates address \u003C STARKNET_FIELD_PRIME\n- [ ] L1 implements message cancellation\n- [ ] L2 validates from_address in handlers\n- [ ] Symmetric access controls L1 ↔ L2\n- [ ] Test full roundtrip flows\n\n### Step 6: Static Analysis with Caracal\n```bash\n# Run Caracal detectors\ncaracal detect src\u002F\n\n# Specific detectors\ncaracal detect src\u002F --detectors unchecked-felt252-arithmetic\ncaracal detect src\u002F --detectors unchecked-l1-handler-from\ncaracal detect src\u002F --detectors missing-nonce-validation\n```\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Unchecked from_address in L1 Handler\n\n**Location**: `src\u002Fbridge.cairo:145-155` (handle_deposit function)\n\n**Description**:\nThe `handle_deposit` L1 handler function does not validate the `from_address` parameter. Any L1 contract can send messages to this function and mint tokens for arbitrary users, bypassing the intended L1 bridge access controls.\n\n**Vulnerable Code**:\n```rust\n\u002F\u002F bridge.cairo, line 145\n#[l1_handler]\nfn handle_deposit(\n    ref self: ContractState,\n    from_address: felt252,  \u002F\u002F Not validated!\n    user: ContractAddress,\n    amount: u256\n) {\n    let current_balance = self.balances.read(user);\n    self.balances.write(user, current_balance + amount);\n}\n```\n\n**Attack Scenario**:\n1. Attacker deploys malicious L1 contract\n2. Malicious contract calls `starknetCore.sendMessageToL2(l2Contract, selector, [attacker_address, 1000000])`\n3. L2 handler processes message without checking sender\n4. Attacker receives 1,000,000 tokens without depositing any funds\n5. Protocol suffers infinite mint vulnerability\n\n**Recommendation**:\nValidate `from_address` against authorized L1 bridge:\n```rust\n#[l1_handler]\nfn handle_deposit(\n    ref self: ContractState,\n    from_address: felt252,\n    user: ContractAddress,\n    amount: u256\n) {\n    \u002F\u002F Validate L1 sender\n    let authorized_l1_bridge = self.l1_bridge_address.read();\n    assert(from_address == authorized_l1_bridge, 'Unauthorized L1 sender');\n\n    let current_balance = self.balances.read(user);\n    self.balances.write(user, current_balance + amount);\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcairo\u002Funchecked_l1_handler_from\n- Caracal detector: `unchecked-l1-handler-from`\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Unchecked from_address in L1 handlers (infinite mint)\n- L1-L2 address conversion issues (funds to zero address)\n\n### High (Fix Before Deployment)\n- Felt252 arithmetic overflow\u002Funderflow (balance manipulation)\n- Missing signature replay protection (replay attacks)\n- L1-L2 message failure without cancellation (locked funds)\n\n### Medium (Address in Audit)\n- Overconstrained L1-L2 interactions (trapped funds)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n\n    #[test]\n    fn test_felt252_overflow() {\n        \u002F\u002F Test arithmetic edge cases\n    }\n\n    #[test]\n    #[should_panic]\n    fn test_unauthorized_l1_handler() {\n        \u002F\u002F Wrong from_address should fail\n    }\n\n    #[test]\n    fn test_signature_replay_protection() {\n        \u002F\u002F Same signature twice should fail\n    }\n}\n```\n\n### Integration Tests (with L1)\n```rust\n\u002F\u002F Test full L1-L2 flow\n#[test]\nfn test_deposit_withdraw_roundtrip() {\n    \u002F\u002F 1. Deposit on L1\n    \u002F\u002F 2. Wait for L2 processing\n    \u002F\u002F 3. Verify L2 balance\n    \u002F\u002F 4. Withdraw to L1\n    \u002F\u002F 5. Verify L1 balance restored\n}\n```\n\n### Caracal CI Integration\n```yaml\n# .github\u002Fworkflows\u002Fsecurity.yml\n- name: Run Caracal\n  run: |\n    pip install caracal\n    caracal detect src\u002F --fail-on high,critical\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcairo\u002F`\n- **Caracal**: https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fcaracal\n- **Cairo Documentation**: https:\u002F\u002Fbook.cairo-lang.org\u002F\n- **StarkNet Documentation**: https:\u002F\u002Fdocs.starknet.io\u002F\n- **OpenZeppelin Cairo Contracts**: https:\u002F\u002Fgithub.com\u002FOpenZeppelin\u002Fcairo-contracts\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing Cairo\u002FStarkNet audit:\n\n**Arithmetic Safety (HIGH)**:\n- [ ] No felt252 used for balances\u002Famounts (use u128\u002Fu256)\n- [ ] OR felt252 arithmetic has explicit bounds checking\n- [ ] Overflow\u002Funderflow scenarios tested\n\n**L1 Handler Security (CRITICAL)**:\n- [ ] ALL `#[l1_handler]` functions validate `from_address`\n- [ ] from_address compared against stored L1 contract address\n- [ ] Cannot bypass by deploying alternate L1 contract\n\n**L1-L2 Messaging (HIGH)**:\n- [ ] L1 bridge validates addresses \u003C STARKNET_FIELD_PRIME\n- [ ] L1 bridge implements message cancellation\n- [ ] L2 handlers check from_address\n- [ ] Symmetric validation rules L1 ↔ L2\n- [ ] Full roundtrip flows tested\n\n**Signature Security (HIGH)**:\n- [ ] Signatures include nonce tracking\n- [ ] Nonce incremented after each use\n- [ ] Domain separator includes chain ID and contract address\n- [ ] Signature replay tested and prevented\n- [ ] Cross-chain replay prevented\n\n**Tool Usage**:\n- [ ] Caracal scan completed with no critical findings\n- [ ] Unit tests cover all vulnerability scenarios\n- [ ] Integration tests verify L1-L2 flows\n- [ ] Testnet deployment tested before mainnet\n",{"data":39,"body":40},{"name":4,"description":6},{"type":41,"children":42},"root",[43,52,59,65,71,106,112,119,140,146,398,404,451,457,512,516,522,527,581,584,590,595,605,611,624,676,682,687,727,733,738,787,793,920,923,929,935,1217,1227,1261,1278,1387,1396,1415,1424,1430,1508,1514,1588,1591,1597,1676,1679,1685,1690,1699,1730,1739,1782,1791,1840,1849,1897,1906,1946],{"type":44,"tag":45,"props":46,"children":48},"element","h1",{"id":47},"cairostarknet-vulnerability-scanner",[49],{"type":50,"value":51},"text","Cairo\u002FStarkNet Vulnerability Scanner",{"type":44,"tag":53,"props":54,"children":56},"h2",{"id":55},"_1-purpose",[57],{"type":50,"value":58},"1. Purpose",{"type":44,"tag":60,"props":61,"children":62},"p",{},[63],{"type":50,"value":64},"Systematically scan Cairo smart contracts on StarkNet for platform-specific security vulnerabilities related to arithmetic, cross-layer messaging, and cryptographic operations. This skill encodes 6 critical vulnerability patterns unique to Cairo\u002FStarkNet ecosystem.",{"type":44,"tag":53,"props":66,"children":68},{"id":67},"_2-when-to-use-this-skill",[69],{"type":50,"value":70},"2. When to Use This Skill",{"type":44,"tag":72,"props":73,"children":74},"ul",{},[75,81,86,91,96,101],{"type":44,"tag":76,"props":77,"children":78},"li",{},[79],{"type":50,"value":80},"Auditing StarkNet smart contracts (Cairo)",{"type":44,"tag":76,"props":82,"children":83},{},[84],{"type":50,"value":85},"Reviewing L1-L2 bridge implementations",{"type":44,"tag":76,"props":87,"children":88},{},[89],{"type":50,"value":90},"Pre-launch security assessment of StarkNet applications",{"type":44,"tag":76,"props":92,"children":93},{},[94],{"type":50,"value":95},"Validating cross-layer message handling",{"type":44,"tag":76,"props":97,"children":98},{},[99],{"type":50,"value":100},"Reviewing signature verification logic",{"type":44,"tag":76,"props":102,"children":103},{},[104],{"type":50,"value":105},"Assessing L1 handler functions",{"type":44,"tag":53,"props":107,"children":109},{"id":108},"_3-platform-detection",[110],{"type":50,"value":111},"3. Platform Detection",{"type":44,"tag":113,"props":114,"children":116},"h3",{"id":115},"file-extensions-indicators",[117],{"type":50,"value":118},"File Extensions & Indicators",{"type":44,"tag":72,"props":120,"children":121},{},[122],{"type":44,"tag":76,"props":123,"children":124},{},[125,131,133],{"type":44,"tag":126,"props":127,"children":128},"strong",{},[129],{"type":50,"value":130},"Cairo files",{"type":50,"value":132},": ",{"type":44,"tag":134,"props":135,"children":137},"code",{"className":136},[],[138],{"type":50,"value":139},".cairo",{"type":44,"tag":113,"props":141,"children":143},{"id":142},"languageframework-markers",[144],{"type":50,"value":145},"Language\u002FFramework Markers",{"type":44,"tag":147,"props":148,"children":153},"pre",{"className":149,"code":150,"language":151,"meta":152,"style":152},"language-rust shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F Cairo contract indicators\n#[contract]\nmod MyContract {\n    use starknet::ContractAddress;\n\n    #[storage]\n    struct Storage {\n        balance: LegacyMap\u003CContractAddress, felt252>,\n    }\n\n    #[external(v0)]\n    fn transfer(ref self: ContractState, to: ContractAddress, amount: felt252) {\n        \u002F\u002F Contract logic\n    }\n\n    #[l1_handler]\n    fn handle_deposit(ref self: ContractState, from_address: felt252, amount: u256) {\n        \u002F\u002F L1 message handler\n    }\n}\n\n\u002F\u002F Common patterns\nfelt252, u128, u256\nContractAddress, EthAddress\n#[external(v0)], #[l1_handler], #[constructor]\nget_caller_address(), get_contract_address()\nsend_message_to_l1_syscall\n","rust","",[154],{"type":44,"tag":134,"props":155,"children":156},{"__ignoreMap":152},[157,168,177,186,195,205,214,223,232,241,249,258,267,276,284,292,301,310,319,327,336,344,353,362,371,380,389],{"type":44,"tag":158,"props":159,"children":162},"span",{"class":160,"line":161},"line",1,[163],{"type":44,"tag":158,"props":164,"children":165},{},[166],{"type":50,"value":167},"\u002F\u002F Cairo contract indicators\n",{"type":44,"tag":158,"props":169,"children":171},{"class":160,"line":170},2,[172],{"type":44,"tag":158,"props":173,"children":174},{},[175],{"type":50,"value":176},"#[contract]\n",{"type":44,"tag":158,"props":178,"children":180},{"class":160,"line":179},3,[181],{"type":44,"tag":158,"props":182,"children":183},{},[184],{"type":50,"value":185},"mod MyContract {\n",{"type":44,"tag":158,"props":187,"children":189},{"class":160,"line":188},4,[190],{"type":44,"tag":158,"props":191,"children":192},{},[193],{"type":50,"value":194},"    use starknet::ContractAddress;\n",{"type":44,"tag":158,"props":196,"children":198},{"class":160,"line":197},5,[199],{"type":44,"tag":158,"props":200,"children":202},{"emptyLinePlaceholder":201},true,[203],{"type":50,"value":204},"\n",{"type":44,"tag":158,"props":206,"children":208},{"class":160,"line":207},6,[209],{"type":44,"tag":158,"props":210,"children":211},{},[212],{"type":50,"value":213},"    #[storage]\n",{"type":44,"tag":158,"props":215,"children":217},{"class":160,"line":216},7,[218],{"type":44,"tag":158,"props":219,"children":220},{},[221],{"type":50,"value":222},"    struct Storage {\n",{"type":44,"tag":158,"props":224,"children":226},{"class":160,"line":225},8,[227],{"type":44,"tag":158,"props":228,"children":229},{},[230],{"type":50,"value":231},"        balance: LegacyMap\u003CContractAddress, felt252>,\n",{"type":44,"tag":158,"props":233,"children":235},{"class":160,"line":234},9,[236],{"type":44,"tag":158,"props":237,"children":238},{},[239],{"type":50,"value":240},"    }\n",{"type":44,"tag":158,"props":242,"children":244},{"class":160,"line":243},10,[245],{"type":44,"tag":158,"props":246,"children":247},{"emptyLinePlaceholder":201},[248],{"type":50,"value":204},{"type":44,"tag":158,"props":250,"children":252},{"class":160,"line":251},11,[253],{"type":44,"tag":158,"props":254,"children":255},{},[256],{"type":50,"value":257},"    #[external(v0)]\n",{"type":44,"tag":158,"props":259,"children":261},{"class":160,"line":260},12,[262],{"type":44,"tag":158,"props":263,"children":264},{},[265],{"type":50,"value":266},"    fn transfer(ref self: ContractState, to: ContractAddress, amount: felt252) {\n",{"type":44,"tag":158,"props":268,"children":270},{"class":160,"line":269},13,[271],{"type":44,"tag":158,"props":272,"children":273},{},[274],{"type":50,"value":275},"        \u002F\u002F Contract logic\n",{"type":44,"tag":158,"props":277,"children":279},{"class":160,"line":278},14,[280],{"type":44,"tag":158,"props":281,"children":282},{},[283],{"type":50,"value":240},{"type":44,"tag":158,"props":285,"children":287},{"class":160,"line":286},15,[288],{"type":44,"tag":158,"props":289,"children":290},{"emptyLinePlaceholder":201},[291],{"type":50,"value":204},{"type":44,"tag":158,"props":293,"children":295},{"class":160,"line":294},16,[296],{"type":44,"tag":158,"props":297,"children":298},{},[299],{"type":50,"value":300},"    #[l1_handler]\n",{"type":44,"tag":158,"props":302,"children":304},{"class":160,"line":303},17,[305],{"type":44,"tag":158,"props":306,"children":307},{},[308],{"type":50,"value":309},"    fn handle_deposit(ref self: ContractState, from_address: felt252, amount: u256) {\n",{"type":44,"tag":158,"props":311,"children":313},{"class":160,"line":312},18,[314],{"type":44,"tag":158,"props":315,"children":316},{},[317],{"type":50,"value":318},"        \u002F\u002F L1 message handler\n",{"type":44,"tag":158,"props":320,"children":322},{"class":160,"line":321},19,[323],{"type":44,"tag":158,"props":324,"children":325},{},[326],{"type":50,"value":240},{"type":44,"tag":158,"props":328,"children":330},{"class":160,"line":329},20,[331],{"type":44,"tag":158,"props":332,"children":333},{},[334],{"type":50,"value":335},"}\n",{"type":44,"tag":158,"props":337,"children":339},{"class":160,"line":338},21,[340],{"type":44,"tag":158,"props":341,"children":342},{"emptyLinePlaceholder":201},[343],{"type":50,"value":204},{"type":44,"tag":158,"props":345,"children":347},{"class":160,"line":346},22,[348],{"type":44,"tag":158,"props":349,"children":350},{},[351],{"type":50,"value":352},"\u002F\u002F Common patterns\n",{"type":44,"tag":158,"props":354,"children":356},{"class":160,"line":355},23,[357],{"type":44,"tag":158,"props":358,"children":359},{},[360],{"type":50,"value":361},"felt252, u128, u256\n",{"type":44,"tag":158,"props":363,"children":365},{"class":160,"line":364},24,[366],{"type":44,"tag":158,"props":367,"children":368},{},[369],{"type":50,"value":370},"ContractAddress, EthAddress\n",{"type":44,"tag":158,"props":372,"children":374},{"class":160,"line":373},25,[375],{"type":44,"tag":158,"props":376,"children":377},{},[378],{"type":50,"value":379},"#[external(v0)], #[l1_handler], #[constructor]\n",{"type":44,"tag":158,"props":381,"children":383},{"class":160,"line":382},26,[384],{"type":44,"tag":158,"props":385,"children":386},{},[387],{"type":50,"value":388},"get_caller_address(), get_contract_address()\n",{"type":44,"tag":158,"props":390,"children":392},{"class":160,"line":391},27,[393],{"type":44,"tag":158,"props":394,"children":395},{},[396],{"type":50,"value":397},"send_message_to_l1_syscall\n",{"type":44,"tag":113,"props":399,"children":401},{"id":400},"project-structure",[402],{"type":50,"value":403},"Project Structure",{"type":44,"tag":72,"props":405,"children":406},{},[407,418,429,440],{"type":44,"tag":76,"props":408,"children":409},{},[410,416],{"type":44,"tag":134,"props":411,"children":413},{"className":412},[],[414],{"type":50,"value":415},"src\u002Fcontract.cairo",{"type":50,"value":417}," - Main contract implementation",{"type":44,"tag":76,"props":419,"children":420},{},[421,427],{"type":44,"tag":134,"props":422,"children":424},{"className":423},[],[425],{"type":50,"value":426},"src\u002Flib.cairo",{"type":50,"value":428}," - Library modules",{"type":44,"tag":76,"props":430,"children":431},{},[432,438],{"type":44,"tag":134,"props":433,"children":435},{"className":434},[],[436],{"type":50,"value":437},"tests\u002F",{"type":50,"value":439}," - Contract tests",{"type":44,"tag":76,"props":441,"children":442},{},[443,449],{"type":44,"tag":134,"props":444,"children":446},{"className":445},[],[447],{"type":50,"value":448},"Scarb.toml",{"type":50,"value":450}," - Cairo project configuration",{"type":44,"tag":113,"props":452,"children":454},{"id":453},"tool-support",[455],{"type":50,"value":456},"Tool Support",{"type":44,"tag":72,"props":458,"children":459},{},[460,470,481,492,502],{"type":44,"tag":76,"props":461,"children":462},{},[463,468],{"type":44,"tag":126,"props":464,"children":465},{},[466],{"type":50,"value":467},"Caracal",{"type":50,"value":469},": Trail of Bits static analyzer for Cairo",{"type":44,"tag":76,"props":471,"children":472},{},[473,475],{"type":50,"value":474},"Installation: ",{"type":44,"tag":134,"props":476,"children":478},{"className":477},[],[479],{"type":50,"value":480},"pip install caracal",{"type":44,"tag":76,"props":482,"children":483},{},[484,486],{"type":50,"value":485},"Usage: ",{"type":44,"tag":134,"props":487,"children":489},{"className":488},[],[490],{"type":50,"value":491},"caracal detect src\u002F",{"type":44,"tag":76,"props":493,"children":494},{},[495,500],{"type":44,"tag":126,"props":496,"children":497},{},[498],{"type":50,"value":499},"cairo-test",{"type":50,"value":501},": Built-in testing framework",{"type":44,"tag":76,"props":503,"children":504},{},[505,510],{"type":44,"tag":126,"props":506,"children":507},{},[508],{"type":50,"value":509},"Starknet Foundry",{"type":50,"value":511},": Testing and development toolkit",{"type":44,"tag":513,"props":514,"children":515},"hr",{},[],{"type":44,"tag":53,"props":517,"children":519},{"id":518},"_4-how-this-skill-works",[520],{"type":50,"value":521},"4. How This Skill Works",{"type":44,"tag":60,"props":523,"children":524},{},[525],{"type":50,"value":526},"When invoked, I will:",{"type":44,"tag":528,"props":529,"children":530},"ol",{},[531,541,551,561,571],{"type":44,"tag":76,"props":532,"children":533},{},[534,539],{"type":44,"tag":126,"props":535,"children":536},{},[537],{"type":50,"value":538},"Search your codebase",{"type":50,"value":540}," for Cairo files",{"type":44,"tag":76,"props":542,"children":543},{},[544,549],{"type":44,"tag":126,"props":545,"children":546},{},[547],{"type":50,"value":548},"Analyze each contract",{"type":50,"value":550}," for the 6 vulnerability patterns",{"type":44,"tag":76,"props":552,"children":553},{},[554,559],{"type":44,"tag":126,"props":555,"children":556},{},[557],{"type":50,"value":558},"Report findings",{"type":50,"value":560}," with file references and severity",{"type":44,"tag":76,"props":562,"children":563},{},[564,569],{"type":44,"tag":126,"props":565,"children":566},{},[567],{"type":50,"value":568},"Provide fixes",{"type":50,"value":570}," for each identified issue",{"type":44,"tag":76,"props":572,"children":573},{},[574,579],{"type":44,"tag":126,"props":575,"children":576},{},[577],{"type":50,"value":578},"Check L1-L2 interactions",{"type":50,"value":580}," for messaging vulnerabilities",{"type":44,"tag":513,"props":582,"children":583},{},[],{"type":44,"tag":53,"props":585,"children":587},{"id":586},"_5-example-output",[588],{"type":50,"value":589},"5. Example Output",{"type":44,"tag":60,"props":591,"children":592},{},[593],{"type":50,"value":594},"When vulnerabilities are found, you'll get a report like this:",{"type":44,"tag":147,"props":596,"children":600},{"className":597,"code":599,"language":50},[598],"language-text","=== CAIRO\u002FSTARKNET VULNERABILITY SCAN RESULTS ===\n\n\n---\n\n## 5. Vulnerability Patterns (6 Patterns)\n\nI check for 6 critical vulnerability patterns unique to Cairo\u002FStarknet. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Unchecked Arithmetic** ⚠️ CRITICAL - Integer overflow\u002Funderflow in felt252\n2. **Storage Collision** ⚠️ CRITICAL - Conflicting storage variable hashes\n3. **Missing Access Control** ⚠️ CRITICAL - No caller validation on sensitive functions\n4. **Improper Felt252 Boundaries** ⚠️ HIGH - Not validating felt252 range\n5. **Unvalidated Contract Address** ⚠️ HIGH - Using untrusted contract addresses\n6. **Missing Caller Validation** ⚠️ CRITICAL - No get_caller_address() checks\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify Cairo language and StarkNet framework\n2. Check Cairo version (Cairo 1.0+ vs legacy Cairo 0)\n3. Locate contract files (`src\u002F*.cairo`)\n4. Identify L1-L2 bridge contracts (if applicable)\n\n### Step 2: Arithmetic Safety Sweep\n```bash\n# Find felt252 usage in arithmetic\nrg \"felt252\" src\u002F | rg \"[-+*\u002F]\"\n\n# Find balance\u002Famount storage using felt252\nrg \"felt252\" src\u002F | rg \"balance|amount|total|supply\"\n\n# Should prefer u128, u256 instead\n",[601],{"type":44,"tag":134,"props":602,"children":603},{"__ignoreMap":152},[604],{"type":50,"value":599},{"type":44,"tag":113,"props":606,"children":608},{"id":607},"step-3-l1-handler-analysis",[609],{"type":50,"value":610},"Step 3: L1 Handler Analysis",{"type":44,"tag":60,"props":612,"children":613},{},[614,616,622],{"type":50,"value":615},"For each ",{"type":44,"tag":134,"props":617,"children":619},{"className":618},[],[620],{"type":50,"value":621},"#[l1_handler]",{"type":50,"value":623}," function:",{"type":44,"tag":72,"props":625,"children":628},{"className":626},[627],"contains-task-list",[629,649,658,667],{"type":44,"tag":76,"props":630,"children":633},{"className":631},[632],"task-list-item",[634,639,641,647],{"type":44,"tag":635,"props":636,"children":638},"input",{"disabled":201,"type":637},"checkbox",[],{"type":50,"value":640}," Validates ",{"type":44,"tag":134,"props":642,"children":644},{"className":643},[],[645],{"type":50,"value":646},"from_address",{"type":50,"value":648}," parameter",{"type":44,"tag":76,"props":650,"children":652},{"className":651},[632],[653,656],{"type":44,"tag":635,"props":654,"children":655},{"disabled":201,"type":637},[],{"type":50,"value":657}," Checks address != zero",{"type":44,"tag":76,"props":659,"children":661},{"className":660},[632],[662,665],{"type":44,"tag":635,"props":663,"children":664},{"disabled":201,"type":637},[],{"type":50,"value":666}," Has proper access control",{"type":44,"tag":76,"props":668,"children":670},{"className":669},[632],[671,674],{"type":44,"tag":635,"props":672,"children":673},{"disabled":201,"type":637},[],{"type":50,"value":675}," Emits events for monitoring",{"type":44,"tag":113,"props":677,"children":679},{"id":678},"step-4-signature-verification-review",[680],{"type":50,"value":681},"Step 4: Signature Verification Review",{"type":44,"tag":60,"props":683,"children":684},{},[685],{"type":50,"value":686},"For signature-based functions:",{"type":44,"tag":72,"props":688,"children":690},{"className":689},[627],[691,700,709,718],{"type":44,"tag":76,"props":692,"children":694},{"className":693},[632],[695,698],{"type":44,"tag":635,"props":696,"children":697},{"disabled":201,"type":637},[],{"type":50,"value":699}," Includes nonce tracking",{"type":44,"tag":76,"props":701,"children":703},{"className":702},[632],[704,707],{"type":44,"tag":635,"props":705,"children":706},{"disabled":201,"type":637},[],{"type":50,"value":708}," Nonce incremented after use",{"type":44,"tag":76,"props":710,"children":712},{"className":711},[632],[713,716],{"type":44,"tag":635,"props":714,"children":715},{"disabled":201,"type":637},[],{"type":50,"value":717}," Domain separator includes chain ID and contract address",{"type":44,"tag":76,"props":719,"children":721},{"className":720},[632],[722,725],{"type":44,"tag":635,"props":723,"children":724},{"disabled":201,"type":637},[],{"type":50,"value":726}," Cannot replay signatures",{"type":44,"tag":113,"props":728,"children":730},{"id":729},"step-5-l1-l2-bridge-audit",[731],{"type":50,"value":732},"Step 5: L1-L2 Bridge Audit",{"type":44,"tag":60,"props":734,"children":735},{},[736],{"type":50,"value":737},"If contract includes bridge functionality:",{"type":44,"tag":72,"props":739,"children":741},{"className":740},[627],[742,751,760,769,778],{"type":44,"tag":76,"props":743,"children":745},{"className":744},[632],[746,749],{"type":44,"tag":635,"props":747,"children":748},{"disabled":201,"type":637},[],{"type":50,"value":750}," L1 validates address \u003C STARKNET_FIELD_PRIME",{"type":44,"tag":76,"props":752,"children":754},{"className":753},[632],[755,758],{"type":44,"tag":635,"props":756,"children":757},{"disabled":201,"type":637},[],{"type":50,"value":759}," L1 implements message cancellation",{"type":44,"tag":76,"props":761,"children":763},{"className":762},[632],[764,767],{"type":44,"tag":635,"props":765,"children":766},{"disabled":201,"type":637},[],{"type":50,"value":768}," L2 validates from_address in handlers",{"type":44,"tag":76,"props":770,"children":772},{"className":771},[632],[773,776],{"type":44,"tag":635,"props":774,"children":775},{"disabled":201,"type":637},[],{"type":50,"value":777}," Symmetric access controls L1 ↔ L2",{"type":44,"tag":76,"props":779,"children":781},{"className":780},[632],[782,785],{"type":44,"tag":635,"props":783,"children":784},{"disabled":201,"type":637},[],{"type":50,"value":786}," Test full roundtrip flows",{"type":44,"tag":113,"props":788,"children":790},{"id":789},"step-6-static-analysis-with-caracal",[791],{"type":50,"value":792},"Step 6: Static Analysis with Caracal",{"type":44,"tag":147,"props":794,"children":798},{"className":795,"code":796,"language":797,"meta":152,"style":152},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Run Caracal detectors\ncaracal detect src\u002F\n\n# Specific detectors\ncaracal detect src\u002F --detectors unchecked-felt252-arithmetic\ncaracal detect src\u002F --detectors unchecked-l1-handler-from\ncaracal detect src\u002F --detectors missing-nonce-validation\n","bash",[799],{"type":44,"tag":134,"props":800,"children":801},{"__ignoreMap":152},[802,811,831,838,846,872,896],{"type":44,"tag":158,"props":803,"children":804},{"class":160,"line":161},[805],{"type":44,"tag":158,"props":806,"children":808},{"style":807},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[809],{"type":50,"value":810},"# Run Caracal detectors\n",{"type":44,"tag":158,"props":812,"children":813},{"class":160,"line":170},[814,820,826],{"type":44,"tag":158,"props":815,"children":817},{"style":816},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[818],{"type":50,"value":819},"caracal",{"type":44,"tag":158,"props":821,"children":823},{"style":822},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[824],{"type":50,"value":825}," detect",{"type":44,"tag":158,"props":827,"children":828},{"style":822},[829],{"type":50,"value":830}," src\u002F\n",{"type":44,"tag":158,"props":832,"children":833},{"class":160,"line":179},[834],{"type":44,"tag":158,"props":835,"children":836},{"emptyLinePlaceholder":201},[837],{"type":50,"value":204},{"type":44,"tag":158,"props":839,"children":840},{"class":160,"line":188},[841],{"type":44,"tag":158,"props":842,"children":843},{"style":807},[844],{"type":50,"value":845},"# Specific detectors\n",{"type":44,"tag":158,"props":847,"children":848},{"class":160,"line":197},[849,853,857,862,867],{"type":44,"tag":158,"props":850,"children":851},{"style":816},[852],{"type":50,"value":819},{"type":44,"tag":158,"props":854,"children":855},{"style":822},[856],{"type":50,"value":825},{"type":44,"tag":158,"props":858,"children":859},{"style":822},[860],{"type":50,"value":861}," src\u002F",{"type":44,"tag":158,"props":863,"children":864},{"style":822},[865],{"type":50,"value":866}," --detectors",{"type":44,"tag":158,"props":868,"children":869},{"style":822},[870],{"type":50,"value":871}," unchecked-felt252-arithmetic\n",{"type":44,"tag":158,"props":873,"children":874},{"class":160,"line":207},[875,879,883,887,891],{"type":44,"tag":158,"props":876,"children":877},{"style":816},[878],{"type":50,"value":819},{"type":44,"tag":158,"props":880,"children":881},{"style":822},[882],{"type":50,"value":825},{"type":44,"tag":158,"props":884,"children":885},{"style":822},[886],{"type":50,"value":861},{"type":44,"tag":158,"props":888,"children":889},{"style":822},[890],{"type":50,"value":866},{"type":44,"tag":158,"props":892,"children":893},{"style":822},[894],{"type":50,"value":895}," unchecked-l1-handler-from\n",{"type":44,"tag":158,"props":897,"children":898},{"class":160,"line":216},[899,903,907,911,915],{"type":44,"tag":158,"props":900,"children":901},{"style":816},[902],{"type":50,"value":819},{"type":44,"tag":158,"props":904,"children":905},{"style":822},[906],{"type":50,"value":825},{"type":44,"tag":158,"props":908,"children":909},{"style":822},[910],{"type":50,"value":861},{"type":44,"tag":158,"props":912,"children":913},{"style":822},[914],{"type":50,"value":866},{"type":44,"tag":158,"props":916,"children":917},{"style":822},[918],{"type":50,"value":919}," missing-nonce-validation\n",{"type":44,"tag":513,"props":921,"children":922},{},[],{"type":44,"tag":53,"props":924,"children":926},{"id":925},"_6-reporting-format",[927],{"type":50,"value":928},"6. Reporting Format",{"type":44,"tag":113,"props":930,"children":932},{"id":931},"finding-template",[933],{"type":50,"value":934},"Finding Template",{"type":44,"tag":147,"props":936,"children":940},{"className":937,"code":938,"language":939,"meta":152,"style":152},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## [CRITICAL] Unchecked from_address in L1 Handler\n\n**Location**: `src\u002Fbridge.cairo:145-155` (handle_deposit function)\n\n**Description**:\nThe `handle_deposit` L1 handler function does not validate the `from_address` parameter. Any L1 contract can send messages to this function and mint tokens for arbitrary users, bypassing the intended L1 bridge access controls.\n\n**Vulnerable Code**:\n```rust\n\u002F\u002F bridge.cairo, line 145\n#[l1_handler]\nfn handle_deposit(\n    ref self: ContractState,\n    from_address: felt252,  \u002F\u002F Not validated!\n    user: ContractAddress,\n    amount: u256\n) {\n    let current_balance = self.balances.read(user);\n    self.balances.write(user, current_balance + amount);\n}\n","markdown",[941],{"type":44,"tag":134,"props":942,"children":943},{"__ignoreMap":152},[944,968,975,1018,1025,1046,1089,1096,1116,1130,1138,1146,1154,1162,1170,1178,1186,1194,1202,1210],{"type":44,"tag":158,"props":945,"children":946},{"class":160,"line":161},[947,953,958,963],{"type":44,"tag":158,"props":948,"children":950},{"style":949},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[951],{"type":50,"value":952},"## [",{"type":44,"tag":158,"props":954,"children":955},{"style":822},[956],{"type":50,"value":957},"CRITICAL",{"type":44,"tag":158,"props":959,"children":960},{"style":949},[961],{"type":50,"value":962},"]",{"type":44,"tag":158,"props":964,"children":965},{"style":816},[966],{"type":50,"value":967}," Unchecked from_address in L1 Handler\n",{"type":44,"tag":158,"props":969,"children":970},{"class":160,"line":170},[971],{"type":44,"tag":158,"props":972,"children":973},{"emptyLinePlaceholder":201},[974],{"type":50,"value":204},{"type":44,"tag":158,"props":976,"children":977},{"class":160,"line":179},[978,984,990,994,999,1004,1009,1013],{"type":44,"tag":158,"props":979,"children":981},{"style":980},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[982],{"type":50,"value":983},"**",{"type":44,"tag":158,"props":985,"children":987},{"style":986},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[988],{"type":50,"value":989},"Location",{"type":44,"tag":158,"props":991,"children":992},{"style":980},[993],{"type":50,"value":983},{"type":44,"tag":158,"props":995,"children":997},{"style":996},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[998],{"type":50,"value":132},{"type":44,"tag":158,"props":1000,"children":1001},{"style":949},[1002],{"type":50,"value":1003},"`",{"type":44,"tag":158,"props":1005,"children":1006},{"style":822},[1007],{"type":50,"value":1008},"src\u002Fbridge.cairo:145-155",{"type":44,"tag":158,"props":1010,"children":1011},{"style":949},[1012],{"type":50,"value":1003},{"type":44,"tag":158,"props":1014,"children":1015},{"style":996},[1016],{"type":50,"value":1017}," (handle_deposit function)\n",{"type":44,"tag":158,"props":1019,"children":1020},{"class":160,"line":188},[1021],{"type":44,"tag":158,"props":1022,"children":1023},{"emptyLinePlaceholder":201},[1024],{"type":50,"value":204},{"type":44,"tag":158,"props":1026,"children":1027},{"class":160,"line":197},[1028,1032,1037,1041],{"type":44,"tag":158,"props":1029,"children":1030},{"style":980},[1031],{"type":50,"value":983},{"type":44,"tag":158,"props":1033,"children":1034},{"style":986},[1035],{"type":50,"value":1036},"Description",{"type":44,"tag":158,"props":1038,"children":1039},{"style":980},[1040],{"type":50,"value":983},{"type":44,"tag":158,"props":1042,"children":1043},{"style":996},[1044],{"type":50,"value":1045},":\n",{"type":44,"tag":158,"props":1047,"children":1048},{"class":160,"line":207},[1049,1054,1058,1063,1067,1072,1076,1080,1084],{"type":44,"tag":158,"props":1050,"children":1051},{"style":996},[1052],{"type":50,"value":1053},"The ",{"type":44,"tag":158,"props":1055,"children":1056},{"style":949},[1057],{"type":50,"value":1003},{"type":44,"tag":158,"props":1059,"children":1060},{"style":822},[1061],{"type":50,"value":1062},"handle_deposit",{"type":44,"tag":158,"props":1064,"children":1065},{"style":949},[1066],{"type":50,"value":1003},{"type":44,"tag":158,"props":1068,"children":1069},{"style":996},[1070],{"type":50,"value":1071}," L1 handler function does not validate the ",{"type":44,"tag":158,"props":1073,"children":1074},{"style":949},[1075],{"type":50,"value":1003},{"type":44,"tag":158,"props":1077,"children":1078},{"style":822},[1079],{"type":50,"value":646},{"type":44,"tag":158,"props":1081,"children":1082},{"style":949},[1083],{"type":50,"value":1003},{"type":44,"tag":158,"props":1085,"children":1086},{"style":996},[1087],{"type":50,"value":1088}," parameter. Any L1 contract can send messages to this function and mint tokens for arbitrary users, bypassing the intended L1 bridge access controls.\n",{"type":44,"tag":158,"props":1090,"children":1091},{"class":160,"line":216},[1092],{"type":44,"tag":158,"props":1093,"children":1094},{"emptyLinePlaceholder":201},[1095],{"type":50,"value":204},{"type":44,"tag":158,"props":1097,"children":1098},{"class":160,"line":225},[1099,1103,1108,1112],{"type":44,"tag":158,"props":1100,"children":1101},{"style":980},[1102],{"type":50,"value":983},{"type":44,"tag":158,"props":1104,"children":1105},{"style":986},[1106],{"type":50,"value":1107},"Vulnerable Code",{"type":44,"tag":158,"props":1109,"children":1110},{"style":980},[1111],{"type":50,"value":983},{"type":44,"tag":158,"props":1113,"children":1114},{"style":996},[1115],{"type":50,"value":1045},{"type":44,"tag":158,"props":1117,"children":1118},{"class":160,"line":234},[1119,1124],{"type":44,"tag":158,"props":1120,"children":1121},{"style":822},[1122],{"type":50,"value":1123},"```",{"type":44,"tag":158,"props":1125,"children":1127},{"style":1126},"--shiki-light:#90A4AE90;--shiki-default:#EEFFFF90;--shiki-dark:#BABED890",[1128],{"type":50,"value":1129},"rust\n",{"type":44,"tag":158,"props":1131,"children":1132},{"class":160,"line":243},[1133],{"type":44,"tag":158,"props":1134,"children":1135},{"style":1126},[1136],{"type":50,"value":1137},"\u002F\u002F bridge.cairo, line 145\n",{"type":44,"tag":158,"props":1139,"children":1140},{"class":160,"line":251},[1141],{"type":44,"tag":158,"props":1142,"children":1143},{"style":1126},[1144],{"type":50,"value":1145},"#[l1_handler]\n",{"type":44,"tag":158,"props":1147,"children":1148},{"class":160,"line":260},[1149],{"type":44,"tag":158,"props":1150,"children":1151},{"style":1126},[1152],{"type":50,"value":1153},"fn handle_deposit(\n",{"type":44,"tag":158,"props":1155,"children":1156},{"class":160,"line":269},[1157],{"type":44,"tag":158,"props":1158,"children":1159},{"style":1126},[1160],{"type":50,"value":1161},"    ref self: ContractState,\n",{"type":44,"tag":158,"props":1163,"children":1164},{"class":160,"line":278},[1165],{"type":44,"tag":158,"props":1166,"children":1167},{"style":1126},[1168],{"type":50,"value":1169},"    from_address: felt252,  \u002F\u002F Not validated!\n",{"type":44,"tag":158,"props":1171,"children":1172},{"class":160,"line":286},[1173],{"type":44,"tag":158,"props":1174,"children":1175},{"style":1126},[1176],{"type":50,"value":1177},"    user: ContractAddress,\n",{"type":44,"tag":158,"props":1179,"children":1180},{"class":160,"line":294},[1181],{"type":44,"tag":158,"props":1182,"children":1183},{"style":1126},[1184],{"type":50,"value":1185},"    amount: u256\n",{"type":44,"tag":158,"props":1187,"children":1188},{"class":160,"line":303},[1189],{"type":44,"tag":158,"props":1190,"children":1191},{"style":1126},[1192],{"type":50,"value":1193},") {\n",{"type":44,"tag":158,"props":1195,"children":1196},{"class":160,"line":312},[1197],{"type":44,"tag":158,"props":1198,"children":1199},{"style":1126},[1200],{"type":50,"value":1201},"    let current_balance = self.balances.read(user);\n",{"type":44,"tag":158,"props":1203,"children":1204},{"class":160,"line":321},[1205],{"type":44,"tag":158,"props":1206,"children":1207},{"style":1126},[1208],{"type":50,"value":1209},"    self.balances.write(user, current_balance + amount);\n",{"type":44,"tag":158,"props":1211,"children":1212},{"class":160,"line":329},[1213],{"type":44,"tag":158,"props":1214,"children":1215},{"style":1126},[1216],{"type":50,"value":335},{"type":44,"tag":60,"props":1218,"children":1219},{},[1220,1225],{"type":44,"tag":126,"props":1221,"children":1222},{},[1223],{"type":50,"value":1224},"Attack Scenario",{"type":50,"value":1226},":",{"type":44,"tag":528,"props":1228,"children":1229},{},[1230,1235,1246,1251,1256],{"type":44,"tag":76,"props":1231,"children":1232},{},[1233],{"type":50,"value":1234},"Attacker deploys malicious L1 contract",{"type":44,"tag":76,"props":1236,"children":1237},{},[1238,1240],{"type":50,"value":1239},"Malicious contract calls ",{"type":44,"tag":134,"props":1241,"children":1243},{"className":1242},[],[1244],{"type":50,"value":1245},"starknetCore.sendMessageToL2(l2Contract, selector, [attacker_address, 1000000])",{"type":44,"tag":76,"props":1247,"children":1248},{},[1249],{"type":50,"value":1250},"L2 handler processes message without checking sender",{"type":44,"tag":76,"props":1252,"children":1253},{},[1254],{"type":50,"value":1255},"Attacker receives 1,000,000 tokens without depositing any funds",{"type":44,"tag":76,"props":1257,"children":1258},{},[1259],{"type":50,"value":1260},"Protocol suffers infinite mint vulnerability",{"type":44,"tag":60,"props":1262,"children":1263},{},[1264,1269,1271,1276],{"type":44,"tag":126,"props":1265,"children":1266},{},[1267],{"type":50,"value":1268},"Recommendation",{"type":50,"value":1270},":\nValidate ",{"type":44,"tag":134,"props":1272,"children":1274},{"className":1273},[],[1275],{"type":50,"value":646},{"type":50,"value":1277}," against authorized L1 bridge:",{"type":44,"tag":147,"props":1279,"children":1281},{"className":149,"code":1280,"language":151,"meta":152,"style":152},"#[l1_handler]\nfn handle_deposit(\n    ref self: ContractState,\n    from_address: felt252,\n    user: ContractAddress,\n    amount: u256\n) {\n    \u002F\u002F Validate L1 sender\n    let authorized_l1_bridge = self.l1_bridge_address.read();\n    assert(from_address == authorized_l1_bridge, 'Unauthorized L1 sender');\n\n    let current_balance = self.balances.read(user);\n    self.balances.write(user, current_balance + amount);\n}\n",[1282],{"type":44,"tag":134,"props":1283,"children":1284},{"__ignoreMap":152},[1285,1292,1299,1306,1314,1321,1328,1335,1343,1351,1359,1366,1373,1380],{"type":44,"tag":158,"props":1286,"children":1287},{"class":160,"line":161},[1288],{"type":44,"tag":158,"props":1289,"children":1290},{},[1291],{"type":50,"value":1145},{"type":44,"tag":158,"props":1293,"children":1294},{"class":160,"line":170},[1295],{"type":44,"tag":158,"props":1296,"children":1297},{},[1298],{"type":50,"value":1153},{"type":44,"tag":158,"props":1300,"children":1301},{"class":160,"line":179},[1302],{"type":44,"tag":158,"props":1303,"children":1304},{},[1305],{"type":50,"value":1161},{"type":44,"tag":158,"props":1307,"children":1308},{"class":160,"line":188},[1309],{"type":44,"tag":158,"props":1310,"children":1311},{},[1312],{"type":50,"value":1313},"    from_address: felt252,\n",{"type":44,"tag":158,"props":1315,"children":1316},{"class":160,"line":197},[1317],{"type":44,"tag":158,"props":1318,"children":1319},{},[1320],{"type":50,"value":1177},{"type":44,"tag":158,"props":1322,"children":1323},{"class":160,"line":207},[1324],{"type":44,"tag":158,"props":1325,"children":1326},{},[1327],{"type":50,"value":1185},{"type":44,"tag":158,"props":1329,"children":1330},{"class":160,"line":216},[1331],{"type":44,"tag":158,"props":1332,"children":1333},{},[1334],{"type":50,"value":1193},{"type":44,"tag":158,"props":1336,"children":1337},{"class":160,"line":225},[1338],{"type":44,"tag":158,"props":1339,"children":1340},{},[1341],{"type":50,"value":1342},"    \u002F\u002F Validate L1 sender\n",{"type":44,"tag":158,"props":1344,"children":1345},{"class":160,"line":234},[1346],{"type":44,"tag":158,"props":1347,"children":1348},{},[1349],{"type":50,"value":1350},"    let authorized_l1_bridge = self.l1_bridge_address.read();\n",{"type":44,"tag":158,"props":1352,"children":1353},{"class":160,"line":243},[1354],{"type":44,"tag":158,"props":1355,"children":1356},{},[1357],{"type":50,"value":1358},"    assert(from_address == authorized_l1_bridge, 'Unauthorized L1 sender');\n",{"type":44,"tag":158,"props":1360,"children":1361},{"class":160,"line":251},[1362],{"type":44,"tag":158,"props":1363,"children":1364},{"emptyLinePlaceholder":201},[1365],{"type":50,"value":204},{"type":44,"tag":158,"props":1367,"children":1368},{"class":160,"line":260},[1369],{"type":44,"tag":158,"props":1370,"children":1371},{},[1372],{"type":50,"value":1201},{"type":44,"tag":158,"props":1374,"children":1375},{"class":160,"line":269},[1376],{"type":44,"tag":158,"props":1377,"children":1378},{},[1379],{"type":50,"value":1209},{"type":44,"tag":158,"props":1381,"children":1382},{"class":160,"line":278},[1383],{"type":44,"tag":158,"props":1384,"children":1385},{},[1386],{"type":50,"value":335},{"type":44,"tag":60,"props":1388,"children":1389},{},[1390,1395],{"type":44,"tag":126,"props":1391,"children":1392},{},[1393],{"type":50,"value":1394},"References",{"type":50,"value":1226},{"type":44,"tag":72,"props":1397,"children":1398},{},[1399,1404],{"type":44,"tag":76,"props":1400,"children":1401},{},[1402],{"type":50,"value":1403},"building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcairo\u002Funchecked_l1_handler_from",{"type":44,"tag":76,"props":1405,"children":1406},{},[1407,1409],{"type":50,"value":1408},"Caracal detector: ",{"type":44,"tag":134,"props":1410,"children":1412},{"className":1411},[],[1413],{"type":50,"value":1414},"unchecked-l1-handler-from",{"type":44,"tag":147,"props":1416,"children":1419},{"className":1417,"code":1418,"language":50},[598],"\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Unchecked from_address in L1 handlers (infinite mint)\n- L1-L2 address conversion issues (funds to zero address)\n\n### High (Fix Before Deployment)\n- Felt252 arithmetic overflow\u002Funderflow (balance manipulation)\n- Missing signature replay protection (replay attacks)\n- L1-L2 message failure without cancellation (locked funds)\n\n### Medium (Address in Audit)\n- Overconstrained L1-L2 interactions (trapped funds)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n\n    #[test]\n    fn test_felt252_overflow() {\n        \u002F\u002F Test arithmetic edge cases\n    }\n\n    #[test]\n    #[should_panic]\n    fn test_unauthorized_l1_handler() {\n        \u002F\u002F Wrong from_address should fail\n    }\n\n    #[test]\n    fn test_signature_replay_protection() {\n        \u002F\u002F Same signature twice should fail\n    }\n}\n",[1420],{"type":44,"tag":134,"props":1421,"children":1422},{"__ignoreMap":152},[1423],{"type":50,"value":1418},{"type":44,"tag":113,"props":1425,"children":1427},{"id":1426},"integration-tests-with-l1",[1428],{"type":50,"value":1429},"Integration Tests (with L1)",{"type":44,"tag":147,"props":1431,"children":1433},{"className":149,"code":1432,"language":151,"meta":152,"style":152},"\u002F\u002F Test full L1-L2 flow\n#[test]\nfn test_deposit_withdraw_roundtrip() {\n    \u002F\u002F 1. Deposit on L1\n    \u002F\u002F 2. Wait for L2 processing\n    \u002F\u002F 3. Verify L2 balance\n    \u002F\u002F 4. Withdraw to L1\n    \u002F\u002F 5. Verify L1 balance restored\n}\n",[1434],{"type":44,"tag":134,"props":1435,"children":1436},{"__ignoreMap":152},[1437,1445,1453,1461,1469,1477,1485,1493,1501],{"type":44,"tag":158,"props":1438,"children":1439},{"class":160,"line":161},[1440],{"type":44,"tag":158,"props":1441,"children":1442},{},[1443],{"type":50,"value":1444},"\u002F\u002F Test full L1-L2 flow\n",{"type":44,"tag":158,"props":1446,"children":1447},{"class":160,"line":170},[1448],{"type":44,"tag":158,"props":1449,"children":1450},{},[1451],{"type":50,"value":1452},"#[test]\n",{"type":44,"tag":158,"props":1454,"children":1455},{"class":160,"line":179},[1456],{"type":44,"tag":158,"props":1457,"children":1458},{},[1459],{"type":50,"value":1460},"fn test_deposit_withdraw_roundtrip() {\n",{"type":44,"tag":158,"props":1462,"children":1463},{"class":160,"line":188},[1464],{"type":44,"tag":158,"props":1465,"children":1466},{},[1467],{"type":50,"value":1468},"    \u002F\u002F 1. Deposit on L1\n",{"type":44,"tag":158,"props":1470,"children":1471},{"class":160,"line":197},[1472],{"type":44,"tag":158,"props":1473,"children":1474},{},[1475],{"type":50,"value":1476},"    \u002F\u002F 2. Wait for L2 processing\n",{"type":44,"tag":158,"props":1478,"children":1479},{"class":160,"line":207},[1480],{"type":44,"tag":158,"props":1481,"children":1482},{},[1483],{"type":50,"value":1484},"    \u002F\u002F 3. Verify L2 balance\n",{"type":44,"tag":158,"props":1486,"children":1487},{"class":160,"line":216},[1488],{"type":44,"tag":158,"props":1489,"children":1490},{},[1491],{"type":50,"value":1492},"    \u002F\u002F 4. Withdraw to L1\n",{"type":44,"tag":158,"props":1494,"children":1495},{"class":160,"line":225},[1496],{"type":44,"tag":158,"props":1497,"children":1498},{},[1499],{"type":50,"value":1500},"    \u002F\u002F 5. Verify L1 balance restored\n",{"type":44,"tag":158,"props":1502,"children":1503},{"class":160,"line":234},[1504],{"type":44,"tag":158,"props":1505,"children":1506},{},[1507],{"type":50,"value":335},{"type":44,"tag":113,"props":1509,"children":1511},{"id":1510},"caracal-ci-integration",[1512],{"type":50,"value":1513},"Caracal CI Integration",{"type":44,"tag":147,"props":1515,"children":1519},{"className":1516,"code":1517,"language":1518,"meta":152,"style":152},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# .github\u002Fworkflows\u002Fsecurity.yml\n- name: Run Caracal\n  run: |\n    pip install caracal\n    caracal detect src\u002F --fail-on high,critical\n","yaml",[1520],{"type":44,"tag":134,"props":1521,"children":1522},{"__ignoreMap":152},[1523,1531,1554,1572,1580],{"type":44,"tag":158,"props":1524,"children":1525},{"class":160,"line":161},[1526],{"type":44,"tag":158,"props":1527,"children":1528},{"style":807},[1529],{"type":50,"value":1530},"# .github\u002Fworkflows\u002Fsecurity.yml\n",{"type":44,"tag":158,"props":1532,"children":1533},{"class":160,"line":170},[1534,1539,1545,1549],{"type":44,"tag":158,"props":1535,"children":1536},{"style":949},[1537],{"type":50,"value":1538},"-",{"type":44,"tag":158,"props":1540,"children":1542},{"style":1541},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[1543],{"type":50,"value":1544}," name",{"type":44,"tag":158,"props":1546,"children":1547},{"style":949},[1548],{"type":50,"value":1226},{"type":44,"tag":158,"props":1550,"children":1551},{"style":822},[1552],{"type":50,"value":1553}," Run Caracal\n",{"type":44,"tag":158,"props":1555,"children":1556},{"class":160,"line":179},[1557,1562,1566],{"type":44,"tag":158,"props":1558,"children":1559},{"style":1541},[1560],{"type":50,"value":1561},"  run",{"type":44,"tag":158,"props":1563,"children":1564},{"style":949},[1565],{"type":50,"value":1226},{"type":44,"tag":158,"props":1567,"children":1569},{"style":1568},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1570],{"type":50,"value":1571}," |\n",{"type":44,"tag":158,"props":1573,"children":1574},{"class":160,"line":188},[1575],{"type":44,"tag":158,"props":1576,"children":1577},{"style":822},[1578],{"type":50,"value":1579},"    pip install caracal\n",{"type":44,"tag":158,"props":1581,"children":1582},{"class":160,"line":197},[1583],{"type":44,"tag":158,"props":1584,"children":1585},{"style":822},[1586],{"type":50,"value":1587},"    caracal detect src\u002F --fail-on high,critical\n",{"type":44,"tag":513,"props":1589,"children":1590},{},[],{"type":44,"tag":53,"props":1592,"children":1594},{"id":1593},"_9-additional-resources",[1595],{"type":50,"value":1596},"9. Additional Resources",{"type":44,"tag":72,"props":1598,"children":1599},{},[1600,1615,1631,1646,1661],{"type":44,"tag":76,"props":1601,"children":1602},{},[1603,1608,1609],{"type":44,"tag":126,"props":1604,"children":1605},{},[1606],{"type":50,"value":1607},"Building Secure Contracts",{"type":50,"value":132},{"type":44,"tag":134,"props":1610,"children":1612},{"className":1611},[],[1613],{"type":50,"value":1614},"building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcairo\u002F",{"type":44,"tag":76,"props":1616,"children":1617},{},[1618,1622,1623],{"type":44,"tag":126,"props":1619,"children":1620},{},[1621],{"type":50,"value":467},{"type":50,"value":132},{"type":44,"tag":1624,"props":1625,"children":1629},"a",{"href":1626,"rel":1627},"https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fcaracal",[1628],"nofollow",[1630],{"type":50,"value":1626},{"type":44,"tag":76,"props":1632,"children":1633},{},[1634,1639,1640],{"type":44,"tag":126,"props":1635,"children":1636},{},[1637],{"type":50,"value":1638},"Cairo Documentation",{"type":50,"value":132},{"type":44,"tag":1624,"props":1641,"children":1644},{"href":1642,"rel":1643},"https:\u002F\u002Fbook.cairo-lang.org\u002F",[1628],[1645],{"type":50,"value":1642},{"type":44,"tag":76,"props":1647,"children":1648},{},[1649,1654,1655],{"type":44,"tag":126,"props":1650,"children":1651},{},[1652],{"type":50,"value":1653},"StarkNet Documentation",{"type":50,"value":132},{"type":44,"tag":1624,"props":1656,"children":1659},{"href":1657,"rel":1658},"https:\u002F\u002Fdocs.starknet.io\u002F",[1628],[1660],{"type":50,"value":1657},{"type":44,"tag":76,"props":1662,"children":1663},{},[1664,1669,1670],{"type":44,"tag":126,"props":1665,"children":1666},{},[1667],{"type":50,"value":1668},"OpenZeppelin Cairo Contracts",{"type":50,"value":132},{"type":44,"tag":1624,"props":1671,"children":1674},{"href":1672,"rel":1673},"https:\u002F\u002Fgithub.com\u002FOpenZeppelin\u002Fcairo-contracts",[1628],[1675],{"type":50,"value":1672},{"type":44,"tag":513,"props":1677,"children":1678},{},[],{"type":44,"tag":53,"props":1680,"children":1682},{"id":1681},"_10-quick-reference-checklist",[1683],{"type":50,"value":1684},"10. Quick Reference Checklist",{"type":44,"tag":60,"props":1686,"children":1687},{},[1688],{"type":50,"value":1689},"Before completing Cairo\u002FStarkNet audit:",{"type":44,"tag":60,"props":1691,"children":1692},{},[1693,1698],{"type":44,"tag":126,"props":1694,"children":1695},{},[1696],{"type":50,"value":1697},"Arithmetic Safety (HIGH)",{"type":50,"value":1226},{"type":44,"tag":72,"props":1700,"children":1702},{"className":1701},[627],[1703,1712,1721],{"type":44,"tag":76,"props":1704,"children":1706},{"className":1705},[632],[1707,1710],{"type":44,"tag":635,"props":1708,"children":1709},{"disabled":201,"type":637},[],{"type":50,"value":1711}," No felt252 used for balances\u002Famounts (use u128\u002Fu256)",{"type":44,"tag":76,"props":1713,"children":1715},{"className":1714},[632],[1716,1719],{"type":44,"tag":635,"props":1717,"children":1718},{"disabled":201,"type":637},[],{"type":50,"value":1720}," OR felt252 arithmetic has explicit bounds checking",{"type":44,"tag":76,"props":1722,"children":1724},{"className":1723},[632],[1725,1728],{"type":44,"tag":635,"props":1726,"children":1727},{"disabled":201,"type":637},[],{"type":50,"value":1729}," Overflow\u002Funderflow scenarios tested",{"type":44,"tag":60,"props":1731,"children":1732},{},[1733,1738],{"type":44,"tag":126,"props":1734,"children":1735},{},[1736],{"type":50,"value":1737},"L1 Handler Security (CRITICAL)",{"type":50,"value":1226},{"type":44,"tag":72,"props":1740,"children":1742},{"className":1741},[627],[1743,1764,1773],{"type":44,"tag":76,"props":1744,"children":1746},{"className":1745},[632],[1747,1750,1752,1757,1759],{"type":44,"tag":635,"props":1748,"children":1749},{"disabled":201,"type":637},[],{"type":50,"value":1751}," ALL ",{"type":44,"tag":134,"props":1753,"children":1755},{"className":1754},[],[1756],{"type":50,"value":621},{"type":50,"value":1758}," functions validate ",{"type":44,"tag":134,"props":1760,"children":1762},{"className":1761},[],[1763],{"type":50,"value":646},{"type":44,"tag":76,"props":1765,"children":1767},{"className":1766},[632],[1768,1771],{"type":44,"tag":635,"props":1769,"children":1770},{"disabled":201,"type":637},[],{"type":50,"value":1772}," from_address compared against stored L1 contract address",{"type":44,"tag":76,"props":1774,"children":1776},{"className":1775},[632],[1777,1780],{"type":44,"tag":635,"props":1778,"children":1779},{"disabled":201,"type":637},[],{"type":50,"value":1781}," Cannot bypass by deploying alternate L1 contract",{"type":44,"tag":60,"props":1783,"children":1784},{},[1785,1790],{"type":44,"tag":126,"props":1786,"children":1787},{},[1788],{"type":50,"value":1789},"L1-L2 Messaging (HIGH)",{"type":50,"value":1226},{"type":44,"tag":72,"props":1792,"children":1794},{"className":1793},[627],[1795,1804,1813,1822,1831],{"type":44,"tag":76,"props":1796,"children":1798},{"className":1797},[632],[1799,1802],{"type":44,"tag":635,"props":1800,"children":1801},{"disabled":201,"type":637},[],{"type":50,"value":1803}," L1 bridge validates addresses \u003C STARKNET_FIELD_PRIME",{"type":44,"tag":76,"props":1805,"children":1807},{"className":1806},[632],[1808,1811],{"type":44,"tag":635,"props":1809,"children":1810},{"disabled":201,"type":637},[],{"type":50,"value":1812}," L1 bridge implements message cancellation",{"type":44,"tag":76,"props":1814,"children":1816},{"className":1815},[632],[1817,1820],{"type":44,"tag":635,"props":1818,"children":1819},{"disabled":201,"type":637},[],{"type":50,"value":1821}," L2 handlers check from_address",{"type":44,"tag":76,"props":1823,"children":1825},{"className":1824},[632],[1826,1829],{"type":44,"tag":635,"props":1827,"children":1828},{"disabled":201,"type":637},[],{"type":50,"value":1830}," Symmetric validation rules L1 ↔ L2",{"type":44,"tag":76,"props":1832,"children":1834},{"className":1833},[632],[1835,1838],{"type":44,"tag":635,"props":1836,"children":1837},{"disabled":201,"type":637},[],{"type":50,"value":1839}," Full roundtrip flows tested",{"type":44,"tag":60,"props":1841,"children":1842},{},[1843,1848],{"type":44,"tag":126,"props":1844,"children":1845},{},[1846],{"type":50,"value":1847},"Signature Security (HIGH)",{"type":50,"value":1226},{"type":44,"tag":72,"props":1850,"children":1852},{"className":1851},[627],[1853,1862,1871,1879,1888],{"type":44,"tag":76,"props":1854,"children":1856},{"className":1855},[632],[1857,1860],{"type":44,"tag":635,"props":1858,"children":1859},{"disabled":201,"type":637},[],{"type":50,"value":1861}," Signatures include nonce tracking",{"type":44,"tag":76,"props":1863,"children":1865},{"className":1864},[632],[1866,1869],{"type":44,"tag":635,"props":1867,"children":1868},{"disabled":201,"type":637},[],{"type":50,"value":1870}," Nonce incremented after each use",{"type":44,"tag":76,"props":1872,"children":1874},{"className":1873},[632],[1875,1878],{"type":44,"tag":635,"props":1876,"children":1877},{"disabled":201,"type":637},[],{"type":50,"value":717},{"type":44,"tag":76,"props":1880,"children":1882},{"className":1881},[632],[1883,1886],{"type":44,"tag":635,"props":1884,"children":1885},{"disabled":201,"type":637},[],{"type":50,"value":1887}," Signature replay tested and prevented",{"type":44,"tag":76,"props":1889,"children":1891},{"className":1890},[632],[1892,1895],{"type":44,"tag":635,"props":1893,"children":1894},{"disabled":201,"type":637},[],{"type":50,"value":1896}," Cross-chain replay prevented",{"type":44,"tag":60,"props":1898,"children":1899},{},[1900,1905],{"type":44,"tag":126,"props":1901,"children":1902},{},[1903],{"type":50,"value":1904},"Tool Usage",{"type":50,"value":1226},{"type":44,"tag":72,"props":1907,"children":1909},{"className":1908},[627],[1910,1919,1928,1937],{"type":44,"tag":76,"props":1911,"children":1913},{"className":1912},[632],[1914,1917],{"type":44,"tag":635,"props":1915,"children":1916},{"disabled":201,"type":637},[],{"type":50,"value":1918}," Caracal scan completed with no critical findings",{"type":44,"tag":76,"props":1920,"children":1922},{"className":1921},[632],[1923,1926],{"type":44,"tag":635,"props":1924,"children":1925},{"disabled":201,"type":637},[],{"type":50,"value":1927}," Unit tests cover all vulnerability scenarios",{"type":44,"tag":76,"props":1929,"children":1931},{"className":1930},[632],[1932,1935],{"type":44,"tag":635,"props":1933,"children":1934},{"disabled":201,"type":637},[],{"type":50,"value":1936}," Integration tests verify L1-L2 flows",{"type":44,"tag":76,"props":1938,"children":1940},{"className":1939},[632],[1941,1944],{"type":44,"tag":635,"props":1942,"children":1943},{"disabled":201,"type":637},[],{"type":50,"value":1945}," Testnet deployment tested before mainnet",{"type":44,"tag":1947,"props":1948,"children":1949},"style",{},[1950],{"type":50,"value":1951},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1953,"total":2045},[1954,1971,1981,1999,2010,2023,2035],{"slug":1955,"name":1955,"fn":1956,"description":1957,"org":1958,"tags":1959,"stars":26,"repoUrl":27,"updatedAt":1970},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1960,1963,1966,1967],{"name":1961,"slug":1962,"type":16},"C#","c",{"name":1964,"slug":1965,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":1968,"slug":1969,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":1972,"name":1972,"fn":1973,"description":1974,"org":1975,"tags":1976,"stars":26,"repoUrl":27,"updatedAt":1980},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1977,1978,1979],{"name":1961,"slug":1962,"type":16},{"name":14,"slug":15,"type":16},{"name":1968,"slug":1969,"type":16},"2026-07-17T06:05:12.433192",{"slug":1982,"name":1982,"fn":1983,"description":1984,"org":1985,"tags":1986,"stars":26,"repoUrl":27,"updatedAt":1998},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1987,1990,1993,1994,1997],{"name":1988,"slug":1989,"type":16},"Agents","agents",{"name":1991,"slug":1992,"type":16},"CI\u002FCD","ci-cd",{"name":24,"slug":25,"type":16},{"name":1995,"slug":1996,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":2000,"name":2000,"fn":2001,"description":2002,"org":2003,"tags":2004,"stars":26,"repoUrl":27,"updatedAt":2009},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2005,2006,2007,2008],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-18T05:47:43.989063",{"slug":2011,"name":2011,"fn":2012,"description":2013,"org":2014,"tags":2015,"stars":26,"repoUrl":27,"updatedAt":2022},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2016,2019],{"name":2017,"slug":2018,"type":16},"Engineering","engineering",{"name":2020,"slug":2021,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":2024,"name":2024,"fn":2025,"description":2026,"org":2027,"tags":2028,"stars":26,"repoUrl":27,"updatedAt":2034},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2029,2032,2033],{"name":2030,"slug":2031,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":1968,"slug":1969,"type":16},"2026-07-17T06:05:14.575191",{"slug":2036,"name":2036,"fn":2037,"description":2038,"org":2039,"tags":2040,"stars":26,"repoUrl":27,"updatedAt":2044},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2041,2042,2043],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",77,{"items":2047,"total":2147},[2048,2055,2061,2069,2076,2081,2087,2093,2106,2117,2129,2140],{"slug":1955,"name":1955,"fn":1956,"description":1957,"org":2049,"tags":2050,"stars":26,"repoUrl":27,"updatedAt":1970},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2051,2052,2053,2054],{"name":1961,"slug":1962,"type":16},{"name":1964,"slug":1965,"type":16},{"name":14,"slug":15,"type":16},{"name":1968,"slug":1969,"type":16},{"slug":1972,"name":1972,"fn":1973,"description":1974,"org":2056,"tags":2057,"stars":26,"repoUrl":27,"updatedAt":1980},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2058,2059,2060],{"name":1961,"slug":1962,"type":16},{"name":14,"slug":15,"type":16},{"name":1968,"slug":1969,"type":16},{"slug":1982,"name":1982,"fn":1983,"description":1984,"org":2062,"tags":2063,"stars":26,"repoUrl":27,"updatedAt":1998},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2064,2065,2066,2067,2068],{"name":1988,"slug":1989,"type":16},{"name":1991,"slug":1992,"type":16},{"name":24,"slug":25,"type":16},{"name":1995,"slug":1996,"type":16},{"name":14,"slug":15,"type":16},{"slug":2000,"name":2000,"fn":2001,"description":2002,"org":2070,"tags":2071,"stars":26,"repoUrl":27,"updatedAt":2009},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2072,2073,2074,2075],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":2011,"name":2011,"fn":2012,"description":2013,"org":2077,"tags":2078,"stars":26,"repoUrl":27,"updatedAt":2022},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2079,2080],{"name":2017,"slug":2018,"type":16},{"name":2020,"slug":2021,"type":16},{"slug":2024,"name":2024,"fn":2025,"description":2026,"org":2082,"tags":2083,"stars":26,"repoUrl":27,"updatedAt":2034},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2084,2085,2086],{"name":2030,"slug":2031,"type":16},{"name":14,"slug":15,"type":16},{"name":1968,"slug":1969,"type":16},{"slug":2036,"name":2036,"fn":2037,"description":2038,"org":2088,"tags":2089,"stars":26,"repoUrl":27,"updatedAt":2044},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2090,2091,2092],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"slug":2094,"name":2094,"fn":2095,"description":2096,"org":2097,"tags":2098,"stars":26,"repoUrl":27,"updatedAt":2105},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2099,2102,2103,2104],{"name":2100,"slug":2101,"type":16},"Architecture","architecture",{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":2017,"slug":2018,"type":16},"2026-07-18T05:47:40.122449",{"slug":2107,"name":2107,"fn":2108,"description":2109,"org":2110,"tags":2111,"stars":26,"repoUrl":27,"updatedAt":2116},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2112,2113,2114,2115],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":2017,"slug":2018,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":2118,"name":2118,"fn":2119,"description":2120,"org":2121,"tags":2122,"stars":26,"repoUrl":27,"updatedAt":2128},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2123,2124,2127],{"name":18,"slug":19,"type":16},{"name":2125,"slug":2126,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":2130,"name":2130,"fn":2131,"description":2132,"org":2133,"tags":2134,"stars":26,"repoUrl":27,"updatedAt":2139},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2135,2136,2137,2138],{"name":18,"slug":19,"type":16},{"name":1961,"slug":1962,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":4,"name":4,"fn":5,"description":6,"org":2141,"tags":2142,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2143,2144,2145,2146],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},111]