crytic / crytic/caracal

feat: inaccessible replace_class_syscall detector

Open
#46 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Cairo
Stars
147
Forks
11
PR merge metrics
No merged PRs in 30d

Description

### Describe the desired feature

I have a suggestion for a new detector based on a bug I've seen in one codebase.

A contract was supposed to be upgradable via the [`replace_class_syscall`](https://docs.starknet.io/documentation/architecture_and_concepts/Smart_Contracts/system-calls-cairo1/#replace_class), but the function wrapping this syscall was not exposed as an entrypoint, i.e. it was missing the `#[external(v0)]` attribute.

TBH I'm not sure how caracal works under the hood, but this feels like something it could detect 🤞

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading Caracal's existing detector architecture and the Starknet replace_class_syscall documentation linked in the issue. Identify how the analyzer recognizes exposed entrypoints, then define the detector's done condition as reporting a wrapper around replace_class_syscall that lacks the required external entrypoint attribute.

Written by the indexing model from the issue text.

Assessment

Domain
blockchain, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.