Veritas-Vaults-Network/Soroban-Guard-Core

feat(checks): add interprocedural-storage-toctou check — has()/get() guard and the matching set() live in different functions with no re-check about 11 hours ago

enhancement help wanted rust Maybe Rewarded GrantFox OSS Official Campaign | FWC26

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add revoked-admin-reuse check — a new admin is accepted without cross-checking it against a separate revoked/blacklisted-admins collection maintained elsewhere in the file about 11 hours ago

enhancement help wanted rust Maybe Rewarded GrantFox OSS Official Campaign | FWC26

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add withdrawal-aggregate-bypass check — a per-call amount cap exists but no time-windowed accumulator is ever touched by the same function or its call-graph successors about 11 hours ago

enhancement help wanted rust Maybe Rewarded GrantFox OSS Official Campaign | FWC26

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add batch-partial-write check — a loop over a Vec parameter performs a storage write per element and contains an early exit that can commit some writes while skipping later ones about 11 hours ago

enhancement help wanted rust Maybe Rewarded GrantFox OSS Official Campaign | FWC26

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add multisig-duplicate-signer check — a loop over a Vec<Address> of signers increments an approval counter without deduplicating, letting one signer count multiple times toward quorum about 11 hours ago

enhancement help wanted rust Maybe Rewarded GrantFox OSS Official Campaign | FWC26

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add ttl-duration-provenance check — extend_ttl's duration argument is traced back through prior bindings and helper calls to check whether it's ever capped away from an attacker-controlled source about 11 hours ago

enhancement help wanted rust Maybe Rewarded GrantFox OSS Official Campaign | FWC26

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add interprocedural-supply-cap check — total-supply cap is enforced on one path to a storage mint but a second reachable mint site increases supply with no cap check on its own path about 11 hours ago

enhancement help wanted rust Maybe Rewarded GrantFox OSS Official Campaign | FWC26

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add dominance-correct zero-divisor check — a guard that exists in the function but not on the path to the division about 14 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add upgrade-atomicity-order check — the schema-version write and the update_current_contract_wasm call both exist in the file, but the version write doesn't dominate the wasm swap on every path about 15 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add oracle-price-staleness check — a price/rate value is read and used without checking its stored freshness timestamp anywhere on the read's call path about 15 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add loop-bound-provenance check — trace a for/while loop's bound expression back through prior bindings and helper calls to find whether a cap exists anywhere along the chain about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add governance-threshold-drift check — the quorum/threshold constant differs between the function that checks it for proposing vs. the function that checks it for executing about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add scale-factor-drift check — the same logical amount is scaled by different literal multipliers at different storage read/write sites about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add reentrancy-guard-leak check — a storage-backed lock flag is set before an external call but the matching unlock is missing on some early-exit paths about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add require-auth-for-args-mismatch check — the tuple passed to require_auth_for_args doesn't match the values actually used in the sensitive operation that follows about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add cross-token-provenance-mix check — arithmetic mixes amounts traced back to two differently-named token/Address parameters with no conversion call between them about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add narrowing-cast-taint check — an i128 arithmetic result is narrowed to a smaller type several statements or branches later with no checked/range guard anywhere on the def-use chain about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add stale-auth-binding check — require_auth() is called on a binding that gets reassigned/shadowed before the sensitive operation actually runs about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add struct-field-drift check — a #[contracttype] struct gained a field, and some construction sites in the file still build it without one about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add event-schema-drift check — the same event name is published with a different topic/argument shape at different call sites about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add collection-add-without-remove check — a storage-backed collection is appended to somewhere in the file but never has a matching removal anywhere about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add hash-argument-order-mismatch check — two call sites hash the same fields in a different order, breaking a commit/reveal pair about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add symbol-short-collision check — decode symbol_short!/Symbol::short's actual bit-packing and find two different source strings that encode to the same value about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add deploy-then-init-window check — a freshly deployed contract's Address is used before any initializing call on it about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add mutual-recursion-no-depth check — indirect recursion cycles (A calls B calls A) with no fuel/depth guard anywhere in the cycle about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add branch-exhaustive-auth check — require_auth present in some but not all control-flow paths that reach a storage mutation about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add interprocedural-double-init check — init guard satisfied by a helper the analyzer doesn't currently see about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(checks): add interprocedural-missing-auth check — storage mutation reachable through helper functions with no require_auth anywhere on the call path about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(analysis): add a minimal intraprocedural CFG + dominator-tree helper for one function body about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

feat(analysis): add a same-file call-graph builder — resolve helper-function calls, not just #[contractimpl] entrypoints about 16 hours ago

enhancement help wanted rust

Veritas-Vaults-Network/Soroban-Guard-Core

1

CLI and static analyzer engine for detecting vulnerabilities in Soroban smart contracts on Stellar's Blockchain

Rust

#cli#rust#security#smart-contracts#soroban#static-analysis#stellar

Veritas-Vaults-Network/Soroban-Guard-Core

Open Issues Need Help