Detect contracts lacking validations on asset id field of asset transfer transaction
- Dominant language
- Python
- Stars
- 63
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
If a contract verifies that a certain transaction in the group is an "AssetTransfer" Then it should also check that the asset-id of the transaction is valid.
See [building-secure-contracts/not-so-smart-contracts/algorand/asset_id_check](https://github.com/crytic/building-secure-contracts/tree/master/not-so-smart-contracts/algorand/asset_id_check)
Contributor guide
Research direction
Start by reading the linked building-secure-contracts/not-so-smart-contracts/algorand/asset_id_check example to understand the missing asset-id validation. Then locate the existing AssetTransfer transaction checks in tealer and their tests; done means contracts with an unchecked asset id are detected and the relevant test coverage passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100