crytic / crytic/tealer

Detect contracts lacking validations on asset id field of asset transfer transaction

Open
#147 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
63
Forks
13
PR merge metrics
No merged PRs in 30d

Description

If a contract verifies that a certain transaction in the group is an "AssetTransfer" Then it should also check that the asset-id of the transaction is valid.

See [building-secure-contracts/not-so-smart-contracts/algorand/asset_id_check](https://github.com/crytic/building-secure-contracts/tree/master/not-so-smart-contracts/algorand/asset_id_check)

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked building-secure-contracts/not-so-smart-contracts/algorand/asset_id_check example to understand the missing asset-id validation. Then locate the existing AssetTransfer transaction checks in tealer and their tests; done means contracts with an unchecked asset id are detected and the relevant test coverage passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.