crytic / crytic/solana-lints

detect implicit signer check

Open
#69 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
48
Forks
11
PR merge metrics
No merged PRs in 30d

Description

The missing signer check lint will warn on the `from` account despite being implicitly checked by the system's `transfer` [instruction](https://docs.rs/solana-program/latest/src/solana_program/system_instruction.rs.html#410-420) (It creates an instruction with `AccountMeta:new(from, is_signer:true)`). We can check if accounts are used in instructions for which they are required to be signers to improve the precision.

Example false positive:
```
pub fn my_transfer_func<'a>(
from: &AccountInfo<'a>,
to: &AccountInfo<'a>,
system_program: &AccountInfo<'a>,
amount: u64,
) -> Result<(), ProgramError> {
let instruction = transfer(from.key, to.key, amount);
// [...]
invoke(
&instruction,
&[from.clone(), to.clone(), system_program.clone()],
)?;
Ok(())
}
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.