blitzstrike 2.4.86 → 2.4.87

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.87] — 2026-09-17
+
+### Fixed — web3 class naming consistency + jwt grounding
+
+- Renamed the web3 class `encodePacked_collision` → `encode_packed_collision`
+  (snake_case, matching the other classes; fixes resolution through canonical id).
+- Added the `jwt` → `jwt_alg_confusion` synonym so the `jwt` attack-vector resolves
+  to its pattern grounding + payout (previously returned no bounty signal).
+
 ## [2.4.86] — 2026-09-17
 
 ### Added — Web3 audit extended to 13 bug classes

package/dist/index.js

@@ -34491,6 +34491,7 @@ var ALIASES = {
   "rust format string": "rust_format_string",
   "format string": "rust_format_string",
   "format string injection": "rust_format_string",
+  jwt: "jwt_alg_confusion",
   "jwt algorithm confusion": "jwt_alg_confusion",
   "jwt alg confusion": "jwt_alg_confusion",
   "alg confusion": "jwt_alg_confusion",
@@ -60489,7 +60490,7 @@ var SEVERITY = {
   timestamp_dependence: { severity: "medium", cwe: "CWE-1164", category: "block.timestamp / block.number dependence" },
   oracle_manipulation: { severity: "high", cwe: "CWE-1235", category: "Spot-price oracle (DEX pair) manipulation" },
   unbounded_loop: { severity: "medium", cwe: "CWE-834", category: "Unbounded loop over user-controlled length" },
-  encodePacked_collision: { severity: "high", cwe: "CWE-701", category: "abi.encodePacked hash collision (dynamic types)" },
+  encode_packed_collision: { severity: "high", cwe: "CWE-701", category: "abi.encodePacked hash collision (dynamic types)" },
   address_zero_check: { severity: "low", cwe: "CWE-20", category: "Missing address(0) validation on privileged assignment" }
 };
 function lines3(code) {
@@ -60649,7 +60650,7 @@ function web3Audit(code, file) {
   }
   const packedRe = /keccak256\s*\(\s*abi\.encodePacked\s*\(/g;
   while ((m = packedRe.exec(clean)) !== null) {
-    push(out, file, code, m.index, "encodePacked_collision", (ls[lineNo4(code, m.index) - 1] ?? "").trim(), "`keccak256(abi.encodePacked(...))` over dynamic types (string/bytes/array) is ambiguous — ['a','bc'] and ['ab','c'] pack identically, enabling hash collisions and signature forgery (CWE-701). Use `abi.encode` (which pads + length-prefixes each argument) for any hash or signature digest.");
+    push(out, file, code, m.index, "encode_packed_collision", (ls[lineNo4(code, m.index) - 1] ?? "").trim(), "`keccak256(abi.encodePacked(...))` over dynamic types (string/bytes/array) is ambiguous — ['a','bc'] and ['ab','c'] pack identically, enabling hash collisions and signature forgery (CWE-701). Use `abi.encode` (which pads + length-prefixes each argument) for any hash or signature digest.");
   }
   const zeroCheckRe = /\b(constructor|initialize|setOwner|transferOwnership|setAdmin|setFeeRecipient|setPendingOwner)\s*\(/g;
   const cleanLines = lines3(clean);
@@ -60790,7 +60791,7 @@ contract Evil {
         vm.expectRevert(); // or assert gas consumption
         target.processAll();
     }`,
-    encodePacked_collision: `    function testEncodePackedCollision() public {
+    encode_packed_collision: `    function testEncodePackedCollision() public {
         // two distinct inputs pack to the same hash
         bytes32 a = target.hashFor("a", "bc");
         bytes32 b = target.hashFor("ab", "c");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.86",
+  "version": "2.4.87",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {