feat: inaccessible replace_class_syscall detector
- Dominant language
- Cairo
- Stars
- 147
- Forks
- 11
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the desired feature
I have a suggestion for a new detector based on a bug I've seen in one codebase.
A contract was supposed to be upgradable via the [`replace_class_syscall`](https://docs.starknet.io/documentation/architecture_and_concepts/Smart_Contracts/system-calls-cairo1/#replace_class), but the function wrapping this syscall was not exposed as an entrypoint, i.e. it was missing the `#[external(v0)]` attribute.
TBH I'm not sure how caracal works under the hood, but this feels like something it could detect 🤞
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading Caracal's existing detector architecture and the Starknet replace_class_syscall documentation linked in the issue. Identify how the analyzer recognizes exposed entrypoints, then define the detector's done condition as reporting a wrapper around replace_class_syscall that lacks the required external entrypoint attribute.
Written by the indexing model from the issue text.
Assessment
- Domain
- blockchain, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100