chainlink-audit 0.1.0 → 0.3.1

package/README.md

@@ -1,16 +1,23 @@
 # chainlink-audit
 
-Security CLI for detecting potential Chainlink integration risks in Solidity repositories.
+Security review CLI for flagging unverified Chainlink integration risk leads in Solidity repositories.
 
 ```bash
 npm install -g chainlink-audit
+chainlink-audit version
 chainlink-audit init
 chainlink-audit scan .
 chainlink-audit scan . --format markdown --out chainlink-report.md
 chainlink-audit scan . --format html --out chainlink-report.html
+chainlink-audit scan . --format sarif --out chainlink-report.sarif
+chainlink-audit triage chainlink-report.json --out triage.md
 ```
 
-Findings are heuristic leads for manual review, not confirmed vulnerabilities.
+Results are heuristic risk leads for manual review, not confirmed vulnerabilities. Potential impact reflects what could happen if the lead is real; it does not prove exploitability.
+
+Use `chainlink-audit triage <report.json>` to turn JSON scan output into a manual review checklist.
+
+Published package: https://www.npmjs.com/package/chainlink-audit
 
 See the repository README for full documentation:
 https://github.com/alva-p/chainlink-integration-audit-kit

package/dist/config.js

@@ -15,9 +15,10 @@ export function severityRank(severity) {
     }[severity];
 }
 export function parseOutputFormat(value) {
-    if (value === "text" || value === "json" || value === "markdown" || value === "html")
+    if (value === "text" || value === "json" || value === "markdown" || value === "html" || value === "sarif") {
         return value;
-    throw new Error(`Unsupported format "${value}". Use text, json, markdown, or html.`);
+    }
+    throw new Error(`Unsupported format "${value}". Use text, json, markdown, html, or sarif.`);
 }
 export function parseSeverity(value) {
     if (value === "info" || value === "low" || value === "medium" || value === "high")

package/dist/index.js

@@ -5,10 +5,12 @@ import { configFileName, loadConfig, parseOutputFormat, parseSeverity, writeDefa
 import { renderJson } from "./reporters/json.js";
 import { renderHtml } from "./reporters/html.js";
 import { renderMarkdown } from "./reporters/markdown.js";
+import { renderSarif } from "./reporters/sarif.js";
 import { renderText } from "./reporters/text.js";
+import { renderTriageMarkdown } from "./reporters/triage.js";
 import { rules } from "./rules/index.js";
 import { scanPath } from "./scanner.js";
-const version = "0.1.0";
+const version = "0.3.0";
 function render(format, result) {
     if (format === "json")
         return renderJson(result);
@@ -16,17 +18,19 @@ function render(format, result) {
         return renderMarkdown(result);
     if (format === "html")
         return renderHtml(result);
+    if (format === "sarif")
+        return renderSarif(result);
     return renderText(result);
 }
 const program = new Command();
 program
     .name("chainlink-audit")
-    .description("CLI-first scanner for potential Chainlink integration risks in Solidity repositories.")
+    .description("CLI-first audit assistant for unverified Chainlink integration risk leads.")
     .version(version);
 program
     .command("scan")
     .argument("<path>", "Solidity file or repository path to scan")
-    .option("--format <format>", "Output format: text, json, markdown, html")
+    .option("--format <format>", "Output format: text, json, markdown, html, sarif")
     .option("--min-severity <severity>", "Minimum severity: info, low, medium, high")
     .option("--out <file>", "Write report to a file instead of stdout")
     .action(async (targetPath, options) => {
@@ -53,6 +57,33 @@ program
         process.exitCode = 2;
     }
 });
+program
+    .command("triage")
+    .argument("<report.json>", "JSON report produced by chainlink-audit scan --format json")
+    .option("--out <file>", "Write triage markdown to a file instead of stdout")
+    .description("Convert a JSON scan report into a manual triage checklist")
+    .action(async (reportPath, options) => {
+    try {
+        const raw = await fs.readFile(reportPath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed.findings) || typeof parsed.targetPath !== "string") {
+            throw new Error("Input does not look like a chainlink-audit JSON report");
+        }
+        const output = renderTriageMarkdown(parsed);
+        if (options.out) {
+            await fs.writeFile(options.out, `${output}\n`, "utf8");
+        }
+        else {
+            console.log(output);
+        }
+        process.exitCode = 0;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`chainlink-audit: ${message}`);
+        process.exitCode = 2;
+    }
+});
 program.command("init").description(`Create ${configFileName} with recommended defaults`).action(async () => {
     try {
         await writeDefaultConfig();
@@ -73,7 +104,7 @@ program.command("init").description(`Create ${configFileName} with recommended d
 program.command("rules").description("List available MVP rules").action(() => {
     for (const rule of rules) {
         const metadata = rule.metadata;
-        console.log(`${metadata.ruleId} [${metadata.severity}] ${metadata.product} - ${metadata.title}`);
+        console.log(`${metadata.ruleId} [${metadata.severity} potential impact] ${metadata.product} - ${metadata.title}`);
     }
 });
 program.command("version").description("Print CLI version").action(() => {

package/dist/reporters/html.js

@@ -18,13 +18,14 @@ function findingCard(finding) {
             <h3>${escapeHtml(finding.title)}</h3>
           </div>
           <div class="badges">
-            <span class="badge severity">${escapeHtml(finding.severity)}</span>
-            <span class="badge confidence">${escapeHtml(finding.confidence)} confidence</span>
+            <span class="badge severity">${escapeHtml(finding.severity)} potential impact</span>
+            <span class="badge confidence">${escapeHtml(finding.confidence)} detection confidence</span>
           </div>
         </header>
         <dl class="meta">
           <div><dt>Location</dt><dd>${escapeHtml(finding.file)}:${finding.line}</dd></div>
           <div><dt>Manual Review</dt><dd>${finding.manualReviewRequired ? "Required" : "Optional"}</dd></div>
+          <div><dt>Confirmed Vulnerability</dt><dd>No</dd></div>
         </dl>
         <section>
           <h4>Description</h4>
@@ -46,7 +47,7 @@ export function renderHtml(result) {
     const generatedAt = new Date().toISOString();
     const findings = result.findings.length > 0
         ? result.findings.map(findingCard).join("\n")
-        : '<section class="empty">No potential Chainlink integration issues found by MVP rules. Manual review still required.</section>';
+        : '<section class="empty">No Chainlink integration risk leads found by MVP rules. Manual review still required.</section>';
     return `<!doctype html>
 <html lang="en">
 <head>
@@ -325,22 +326,23 @@ export function renderHtml(result) {
     <header class="hero">
       <p class="eyebrow">Chainlink Audit Kit</p>
       <h1>Chainlink Integration Audit Report</h1>
-      <p class="subtitle">Potential Chainlink integration risks detected by heuristic MVP rules. Findings require manual review and are not confirmed vulnerabilities.</p>
+      <p class="subtitle">Unverified Chainlink integration risk leads detected by heuristic MVP rules. Potential impact is not confirmed exploitability.</p>
     </header>
 
     <section class="summary" aria-label="Scan summary">
       <div class="summary-card"><span>Target</span><strong>${escapeHtml(result.targetPath)}</strong></div>
       <div class="summary-card"><span>Solidity Files</span><strong>${result.scannedFiles}</strong></div>
       <div class="summary-card"><span>Products</span><strong>${escapeHtml(products)}</strong></div>
-      <div class="summary-card"><span>Findings</span><strong>${result.findings.length}</strong></div>
-      <div class="summary-card"><span>Minimum Severity</span><strong>${escapeHtml(result.config.minSeverity)}</strong></div>
+      <div class="summary-card"><span>Unverified Leads</span><strong>${result.findings.length}</strong></div>
+      <div class="summary-card"><span>Confirmed Vulnerabilities</span><strong>0</strong></div>
+      <div class="summary-card"><span>Minimum Potential Impact</span><strong>${escapeHtml(result.config.minSeverity)}</strong></div>
       <div class="summary-card"><span>Excluded Paths</span><strong>${escapeHtml(excludedPaths)}</strong></div>
     </section>
 
-    <p class="note">This report is designed for audit triage. Validate each lead against source code, deployment configuration, and protocol assumptions before disclosure or remediation.</p>
+    <p class="note">This report is designed for audit triage. Validate each lead against source code, deployment configuration, and protocol assumptions before disclosure or remediation. High potential impact does not mean a confirmed or exploitable vulnerability.</p>
 
     <section>
-      <h2>Findings</h2>
+      <h2>Risk Leads</h2>
       <div class="findings">
 ${findings}
       </div>

package/dist/reporters/markdown.js

@@ -8,20 +8,21 @@ export function renderMarkdown(result) {
         `- Target: \`${result.targetPath}\``,
         `- Solidity files scanned: ${result.scannedFiles}`,
         `- Detected Chainlink products: ${products}`,
-        `- Minimum severity: ${result.config.minSeverity}`,
+        `- Minimum potential impact: ${result.config.minSeverity}`,
         `- Excluded paths: ${result.config.exclude.length > 0 ? result.config.exclude.join(", ") : "none"}`,
-        `- Findings: ${result.findings.length}`,
+        `- Unverified leads: ${result.findings.length}`,
+        `- Confirmed vulnerabilities: 0`,
         "",
-        "This report contains potential issues produced by heuristic MVP rules. Findings require manual review before disclosure or remediation.",
+        "This report contains unverified risk leads produced by heuristic MVP rules. Potential impact is not confirmed exploitability. Validate each lead manually before disclosure or remediation.",
         "",
     ];
     if (result.findings.length === 0) {
-        lines.push("## Findings", "", "No potential Chainlink integration issues found by MVP rules.");
+        lines.push("## Risk Leads", "", "No Chainlink integration risk leads found by MVP rules.");
         return lines.join("\n");
     }
-    lines.push("## Findings", "");
+    lines.push("## Risk Leads", "");
     for (const finding of result.findings) {
-        lines.push(`### ${finding.ruleId}: ${finding.title}`, "", `- Severity: ${finding.severity}`, `- Confidence: ${finding.confidence}`, `- Location: \`${finding.file}:${finding.line}\``, `- Manual review required: ${finding.manualReviewRequired ? "yes" : "no"}`, "", "#### Description", "", finding.description, "", "#### Risk", "", finding.risk, "", "#### Recommendation", "", finding.recommendation, "");
+        lines.push(`### ${finding.ruleId}: ${finding.title}`, "", `- Potential impact: ${finding.severity}`, `- Detection confidence: ${finding.confidence}`, `- Location: \`${finding.file}:${finding.line}\``, `- Manual review required: ${finding.manualReviewRequired ? "yes" : "no"}`, `- Confirmed vulnerability: no`, "", "#### Description", "", finding.description, "", "#### Risk", "", finding.risk, "", "#### Recommendation", "", finding.recommendation, "");
     }
     return lines.join("\n");
 }

package/dist/reporters/sarif.js

@@ -0,0 +1,105 @@
+import { rules } from "../rules/index.js";
+function normalizeUri(value) {
+    return value.split("\\").join("/");
+}
+function sarifLevel(severity) {
+    if (severity === "high")
+        return "error";
+    if (severity === "info")
+        return "note";
+    return "warning";
+}
+function resultMessage(finding) {
+    return [
+        `Unverified risk lead. Potential impact: ${finding.severity}. Detection confidence: ${finding.confidence}.`,
+        "",
+        finding.description,
+        "",
+        `Risk: ${finding.risk}`,
+        "",
+        `Recommendation: ${finding.recommendation}`,
+        "",
+        `Manual review required: ${finding.manualReviewRequired ? "yes" : "no"}. Confirmed vulnerability: no.`,
+    ].join("\n");
+}
+export function renderSarif(result) {
+    const ruleMetadata = new Map(rules.map((rule) => [rule.metadata.ruleId, rule.metadata]));
+    const sarif = {
+        version: "2.1.0",
+        $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "chainlink-audit",
+                        informationUri: "https://github.com/alva-p/chainlink-integration-audit-kit",
+                        rules: rules.map((rule) => ({
+                            id: rule.metadata.ruleId,
+                            name: rule.metadata.title,
+                            shortDescription: {
+                                text: rule.metadata.title,
+                            },
+                            fullDescription: {
+                                text: rule.metadata.description,
+                            },
+                            help: {
+                                text: `${rule.metadata.description}\n\nProduct: ${rule.metadata.product}. Potential impact: ${rule.metadata.severity}. Results are unverified risk leads and require manual review.`,
+                                markdown: `${rule.metadata.description}\n\n**Product:** ${rule.metadata.product}\n\n**Potential impact:** ${rule.metadata.severity}\n\nResults are unverified risk leads and require manual review.`,
+                            },
+                            properties: {
+                                product: rule.metadata.product,
+                                potentialImpact: rule.metadata.severity,
+                            },
+                        })),
+                    },
+                },
+                automationDetails: {
+                    id: "chainlink-audit/",
+                },
+                invocations: [
+                    {
+                        executionSuccessful: true,
+                        properties: {
+                            targetPath: result.targetPath,
+                            scannedFiles: result.scannedFiles,
+                            detectedProducts: result.products,
+                            minimumPotentialImpact: result.config.minSeverity,
+                            excludedPaths: result.config.exclude,
+                        },
+                    },
+                ],
+                results: result.findings.map((finding) => {
+                    const metadata = ruleMetadata.get(finding.ruleId);
+                    return {
+                        ruleId: finding.ruleId,
+                        ruleIndex: rules.findIndex((rule) => rule.metadata.ruleId === finding.ruleId),
+                        level: sarifLevel(finding.severity),
+                        message: {
+                            text: resultMessage(finding),
+                        },
+                        locations: [
+                            {
+                                physicalLocation: {
+                                    artifactLocation: {
+                                        uri: normalizeUri(finding.file),
+                                    },
+                                    region: {
+                                        startLine: finding.line,
+                                    },
+                                },
+                            },
+                        ],
+                        properties: {
+                            potentialImpact: finding.severity,
+                            detectionConfidence: finding.confidence,
+                            product: metadata?.product,
+                            manualReviewRequired: finding.manualReviewRequired,
+                            confirmedVulnerability: false,
+                        },
+                    };
+                }),
+            },
+        ],
+    };
+    return JSON.stringify(sarif, null, 2);
+}

package/dist/reporters/text.js

@@ -5,22 +5,23 @@ export function renderText(result) {
         `Target: ${result.targetPath}`,
         `Solidity files scanned: ${result.scannedFiles}`,
         `Detected Chainlink products: ${products}`,
-        `Minimum severity: ${result.config.minSeverity}`,
+        `Minimum potential impact: ${result.config.minSeverity}`,
         `Excluded paths: ${result.config.exclude.length > 0 ? result.config.exclude.join(", ") : "none"}`,
-        `Findings: ${result.findings.length}`,
+        `Unverified leads: ${result.findings.length}`,
     ].join("\n");
     if (result.findings.length === 0) {
-        return `${header}\n\nNo potential Chainlink integration issues found by MVP rules. Manual review still required.`;
+        return `${header}\n\nNo Chainlink integration risk leads found by MVP rules. Manual review still required.`;
     }
     const findings = result.findings
         .map((finding) => [
-        `[${finding.severity.toUpperCase()}] ${finding.ruleId} - ${finding.title}`,
-        `  Confidence: ${finding.confidence}`,
+        `[${finding.severity.toUpperCase()} POTENTIAL IMPACT] ${finding.ruleId} - ${finding.title}`,
+        `  Detection confidence: ${finding.confidence}`,
         `  Location: ${finding.file}:${finding.line}`,
         `  Description: ${finding.description}`,
         `  Risk: ${finding.risk}`,
         `  Recommendation: ${finding.recommendation}`,
         `  Manual review required: ${finding.manualReviewRequired ? "yes" : "no"}`,
+        "  Confirmed vulnerability: no",
     ].join("\n"))
         .join("\n\n");
     return `${header}\n\n${findings}`;

package/dist/reporters/triage.js

@@ -0,0 +1,55 @@
+function severityRank(finding) {
+    return {
+        info: 0,
+        low: 1,
+        medium: 2,
+        high: 3,
+    }[finding.severity];
+}
+function checkbox(label) {
+    return `- [ ] ${label}`;
+}
+export function renderTriageMarkdown(result) {
+    const products = result.products.length > 0 ? result.products.join(", ") : "none detected";
+    const findings = [...result.findings].sort((a, b) => {
+        const severityCompare = severityRank(b) - severityRank(a);
+        if (severityCompare !== 0)
+            return severityCompare;
+        const confidenceCompare = b.confidence.localeCompare(a.confidence);
+        if (confidenceCompare !== 0)
+            return confidenceCompare;
+        return a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId);
+    });
+    const lines = [
+        "# Chainlink Audit Triage",
+        "",
+        "## Summary",
+        "",
+        `- Target: \`${result.targetPath}\``,
+        `- Solidity files scanned: ${result.scannedFiles}`,
+        `- Detected Chainlink products: ${products}`,
+        `- Unverified leads: ${findings.length}`,
+        "- Confirmed vulnerabilities: 0",
+        "",
+        "This triage file is for manual audit review. A high potential-impact lead is not a confirmed vulnerability.",
+        "",
+        "## Review Status Legend",
+        "",
+        checkbox("True positive"),
+        checkbox("False positive"),
+        checkbox("Accepted risk"),
+        checkbox("Needs more context"),
+        checkbox("Not reportable"),
+        "",
+        "## Leads",
+        "",
+    ];
+    if (findings.length === 0) {
+        lines.push("No unverified risk leads were found by the current rule set.", "");
+        return lines.join("\n");
+    }
+    for (const finding of findings) {
+        lines.push(`### ${finding.ruleId}: ${finding.title}`, "", `- Potential impact: ${finding.severity}`, `- Detection confidence: ${finding.confidence}`, `- Location: \`${finding.file}:${finding.line}\``, "- Confirmed vulnerability: no", "", "#### Manual Status", "", checkbox("True positive"), checkbox("False positive"), checkbox("Accepted risk"), checkbox("Needs more context"), checkbox("Not reportable"), "", "#### Reviewer Notes", "", "- Evidence:", "- Exploitability:", "- Impact:", "- Recommendation:", "- Disclosure path:", "", "#### Scanner Context", "", `- Description: ${finding.description}`, `- Risk: ${finding.risk}`, `- Recommendation: ${finding.recommendation}`, "");
+    }
+    return lines.join("\n");
+}

package/dist/rules/ccip.js

@@ -1,10 +1,126 @@
 import { countMatches, extractFunctionBody, firstLineMatching, makeFinding } from "./helpers.js";
 function ccipBody(content) {
-    return extractFunctionBody(content, "_ccipReceive") || extractFunctionBody(content, "ccipReceive");
+    return [extractFunctionBody(content, "ccipReceive"), extractFunctionBody(content, "_ccipReceive")].filter(Boolean).join("\n");
+}
+function ccipHeader(content) {
+    const match = /function\s+(_ccipReceive|ccipReceive)\b[^{;]*/.exec(content);
+    return match?.[0] ?? "";
 }
 function hasCcipReceiver(content) {
     return /(function\s+_ccipReceive\b|function\s+ccipReceive\b|is\s+CCIPReceiver)/.test(content);
 }
+function isCcipBaseReceiver(content) {
+    if (/interface\s+\w*I?Any2EVMMessageReceiver\b/.test(content))
+        return true;
+    if (/interface\s+\w+\s*{[\s\S]*function\s+ccipReceive\b[^{]*;/.test(content))
+        return true;
+    if (/abstract\s+contract\s+\w*CCIPReceiver\b/.test(content))
+        return true;
+    if (/function\s+_ccipReceive\b[^{;]*internal[^{;]*virtual\s*;/.test(content))
+        return true;
+    // Guard stub: ccipReceive body is only a revert — intentional "not a receiver" pattern (e.g. EVM2EVMOffRamp)
+    const ccipReceiveBody = extractFunctionBody(content, "ccipReceive");
+    if (ccipReceiveBody) {
+        const bodyTrimmed = ccipReceiveBody.trim();
+        if (/^\s*revert\s*\(\s*\)\s*;\s*$/.test(bodyTrimmed) ||
+            /^\s*revert\s+\w[\w.]*\s*\([^)]*\)\s*;\s*$/.test(bodyTrimmed))
+            return true;
+    }
+    return false;
+}
+function inheritsCcipReceiver(content) {
+    return /\bis\s+[\s\S{]*\bCCIPReceiver(Upgradeable)?\b/.test(content);
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractParentNames(content) {
+    const match = /\bcontract\s+\w+\s+is\s+([\w\s,]+?)(?:\{|$)/m.exec(content);
+    if (!match)
+        return [];
+    return match[1].split(",").map((s) => s.trim()).filter(Boolean);
+}
+function inheritsViaCcipReceiver(content, repoSignals) {
+    const parents = extractParentNames(content);
+    return parents.some((parent) => {
+        const parentPattern = new RegExp(`\\b(?:abstract\\s+)?contract\\s+${escapeRegExp(parent)}\\b`);
+        const parentFile = repoSignals.files.find((f) => parentPattern.test(f.content));
+        return parentFile ? inheritsCcipReceiver(parentFile.content) : false;
+    });
+}
+function delegatedCcipContent(body, repoSignals) {
+    const match = /\b([A-Z][A-Za-z0-9_]*)\s*\.\s*([A-Za-z0-9_]*ccipReceive|processCcipReceive)\s*\(/i.exec(body);
+    if (!match)
+        return body;
+    const [, libraryOrContractName, functionName] = match;
+    const typePattern = new RegExp(`\\b(library|contract)\\s+${escapeRegExp(libraryOrContractName)}\\b`);
+    const functionPattern = new RegExp(`\\bfunction\\s+${escapeRegExp(functionName)}\\b`);
+    const delegate = repoSignals.files.find((file) => typePattern.test(file.content) && functionPattern.test(file.content));
+    return delegate ? `${body}\n${delegate.content}` : body;
+}
+function stripEmitLines(body) {
+    return body
+        .split("\n")
+        .filter((line) => !/\bemit\b/.test(line))
+        .join("\n");
+}
+function validatesSourceChain(content, body) {
+    const header = ccipHeader(content);
+    // Strip event emissions before checking: sourceChainSelector that only appears in emit
+    // calls (e.g. for logging) must not suppress the finding.
+    const bodyWithoutEmits = stripEmitLines(body);
+    const directValidation = /(sourceChainSelector|ccipSelectorToChainId)/.test(bodyWithoutEmits) &&
+        /(require|revert|allowed|trusted|allowlist|supportedNetworks|UnsupportedNetwork)/i.test(body);
+    const modifierValidation = /(validChain|allowlisted|allowlist|trusted|onlyAllowlisted)[^{;]*(sourceChainSelector|\.sourceChainSelector)/i.test(header);
+    return directValidation || modifierValidation;
+}
+function validatesSourceSender(content, body) {
+    const header = ccipHeader(content);
+    // Strip event emissions before checking: sender that only appears in emit
+    // calls must not suppress the finding.
+    const bodyWithoutEmits = stripEmitLines(body);
+    const directValidation = /(message\.sender|data\.sender|sender)/.test(bodyWithoutEmits) &&
+        /(require|revert|allowed|trusted|allowlist|Unauthorized)/i.test(body);
+    const modifierValidation = /(validSender|trustedSender|allowlistedSender|onlyAllowlisted|allowlisted|allowlist|trusted)[^{;]*(message\.sender|\.sender|sender)/i.test(header);
+    return directValidation || modifierValidation;
+}
+function hasBusinessMutation(body) {
+    return (countMatches(body, [
+        /transfer/i,
+        /mint/i,
+        /burn/i,
+        /swap/i,
+        /deposit/i,
+        /withdraw/i,
+        /credit/i,
+        /call\s*\{/,
+        /\[[^\]]+\]\s*(\+\+|--|\+=|-=|=)/,
+        /\b(push|pop)\s*\(/,
+    ]) > 0);
+}
+function hasMessageIdTracking(content, body) {
+    if (!/(messageId|\.messageId)/.test(body))
+        return false;
+    return /(processed|received|executed|consumed|handled|seen|replay|duplicate|messageDetail|failedMessages|messageIdTo)/i.test(content);
+}
+function hasTokenPoolSender(content) {
+    return (/function\s+lockOrBurn\b/.test(content) &&
+        /(Pool\.LockOrBurnInV1|LockOrBurnInV1|is\s+[\w\s,]*TokenPool)/.test(content));
+}
+function hasTokenPoolReceiver(content) {
+    return (/function\s+releaseOrMint\b/.test(content) &&
+        /(Pool\.ReleaseOrMintInV1|ReleaseOrMintInV1|is\s+[\w\s,]*TokenPool)/.test(content));
+}
+function isTokenPoolBase(content) {
+    if (/abstract\s+contract\s+\w*TokenPool\b/.test(content))
+        return true;
+    if (/interface\s+\w*(TokenPool|IPool)\b/.test(content))
+        return true;
+    // Abstract contracts that inherit from a TokenPool base (e.g. BurnMintTokenPoolAbstract is BurnMintTokenPool)
+    if (/abstract\s+contract\s+\w+\s+is\s+[\w\s,]*TokenPool\b/.test(content))
+        return true;
+    return false;
+}
 export const ccipRules = [
     {
         metadata: {
@@ -17,9 +133,11 @@ export const ccipRules = [
         scan(context) {
             if (!hasCcipReceiver(context.content))
                 return [];
+            if (isCcipBaseReceiver(context.content))
+                return [];
             const body = ccipBody(context.content) || context.content;
-            const validates = /sourceChainSelector/.test(body) && /(require|revert|allowed|trusted|allowlist)/i.test(body);
-            if (validates)
+            const validationContent = `${ccipHeader(context.content)}\n${delegatedCcipContent(body, context.repoSignals)}`;
+            if (validatesSourceChain(context.content, validationContent))
                 return [];
             return [
                 makeFinding({
@@ -47,9 +165,11 @@ export const ccipRules = [
         scan(context) {
             if (!hasCcipReceiver(context.content))
                 return [];
+            if (isCcipBaseReceiver(context.content))
+                return [];
             const body = ccipBody(context.content) || context.content;
-            const validates = /(message\.sender|sender)/.test(body) && /(require|revert|allowed|trusted|allowlist)/i.test(body);
-            if (validates)
+            const validationContent = `${ccipHeader(context.content)}\n${delegatedCcipContent(body, context.repoSignals)}`;
+            if (validatesSourceSender(context.content, validationContent))
                 return [];
             return [
                 makeFinding({
@@ -77,8 +197,12 @@ export const ccipRules = [
         scan(context) {
             if (!hasCcipReceiver(context.content))
                 return [];
-            const validatesRouter = /msg\.sender\s*(!=|==)\s*(router|s_router|i_router|address\(router\))|InvalidRouter|onlyRouter/i.test(context.content);
-            if (validatesRouter || /is\s+CCIPReceiver/.test(context.content))
+            if (isCcipBaseReceiver(context.content))
+                return [];
+            const body = ccipBody(context.content) || context.content;
+            const validationContent = `${ccipHeader(context.content)}\n${delegatedCcipContent(body, context.repoSignals)}`;
+            const validatesRouter = /msg\.sender\s*(!=|==)\s*(router|s_router|i_router|address\(router\))|InvalidRouter|onlyRouter|NotCcipRouter|_msgSender\(\)\s*!=\s*address\([^)]*ccipRouter/i.test(validationContent);
+            if (validatesRouter || inheritsCcipReceiver(context.content) || inheritsViaCcipReceiver(context.content, context.repoSignals))
                 return [];
             return [
                 makeFinding({
@@ -106,6 +230,8 @@ export const ccipRules = [
         scan(context) {
             if (!hasCcipReceiver(context.content))
                 return [];
+            if (isCcipBaseReceiver(context.content))
+                return [];
             const body = ccipBody(context.content) || context.content;
             if (!/abi\.decode\s*\(\s*message\.data/.test(body))
                 return [];
@@ -138,6 +264,8 @@ export const ccipRules = [
         scan(context) {
             if (!hasCcipReceiver(context.content))
                 return [];
+            if (isCcipBaseReceiver(context.content))
+                return [];
             const body = ccipBody(context.content);
             if (!body)
                 return [];
@@ -160,4 +288,178 @@ export const ccipRules = [
             ];
         },
     },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-006",
+            product: "ccip",
+            severity: "medium",
+            title: "Potential CCIP token amount indexing without length check",
+            description: "Receiver appears to index destTokenAmounts without an obvious length check.",
+        },
+        scan(context) {
+            if (!hasCcipReceiver(context.content))
+                return [];
+            if (isCcipBaseReceiver(context.content))
+                return [];
+            const body = ccipBody(context.content) || context.content;
+            const indexesTokenAmounts = /(?:message\.|any2EvmMessage\.)?destTokenAmounts\s*\[\s*\d+\s*\]/.test(body) ||
+                /(?:tokenAmounts|destTokenAmounts)\s*\[\s*\d+\s*\]/.test(body);
+            if (!indexesTokenAmounts)
+                return [];
+            const checksLength = /(?:destTokenAmounts|tokenAmounts)\.length/.test(body) ||
+                /(InvalidTokenAmounts|InvalidTokenAmount|NoToken|ExpectedToken|UnexpectedToken)/i.test(body);
+            if (checksLength)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /(?:destTokenAmounts|tokenAmounts)\s*\[/),
+                    title: this.metadata.title,
+                    description: "Potential issue: malformed or unexpected CCIP token payloads may revert before business logic can handle them.",
+                    risk: "Assuming at least one token amount can cause message processing failure or inconsistent recovery behavior.",
+                    recommendation: "Validate destTokenAmounts.length and expected token addresses/amounts before indexing token amounts.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-007",
+            product: "ccip",
+            severity: "medium",
+            title: "Potential CCIP receiver without messageId idempotency tracking",
+            description: "Mutating receiver logic does not show obvious messageId replay or idempotency tracking.",
+        },
+        scan(context) {
+            if (!hasCcipReceiver(context.content))
+                return [];
+            if (isCcipBaseReceiver(context.content))
+                return [];
+            const body = ccipBody(context.content);
+            if (!body)
+                return [];
+            if (!hasBusinessMutation(body))
+                return [];
+            if (hasMessageIdTracking(context.content, body))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /(_ccipReceive|ccipReceive)/),
+                    title: this.metadata.title,
+                    description: "Potential issue: repeated or retried CCIP messages may execute mutating business logic more than once.",
+                    risk: "Without idempotency tracking, replay-like operational scenarios or manual execution flows can duplicate state changes.",
+                    recommendation: "Track processed messageId values or design receiver logic to be explicitly idempotent before mutating state.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-008",
+            product: "ccip",
+            severity: "high",
+            title: "Potential CCIP Token Pool lockOrBurn without _validateLockOrBurn",
+            description: "lockOrBurn override does not appear to call _validateLockOrBurn.",
+        },
+        scan(context) {
+            if (!hasTokenPoolSender(context.content))
+                return [];
+            if (isTokenPoolBase(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "lockOrBurn");
+            if (!body)
+                return [];
+            if (/_validateLockOrBurn\s*\(/.test(body))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /function\s+lockOrBurn\b/),
+                    title: this.metadata.title,
+                    description: "Potential issue: lockOrBurn may skip rate limit and chain allowlist enforcement.",
+                    risk: "Omitting _validateLockOrBurn bypasses CCIP-enforced rate limits and supported-chain checks, enabling unrestricted token locking or burning.",
+                    recommendation: "Call _validateLockOrBurn(lockOrBurnIn) at the start of every lockOrBurn override before executing custom logic.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-009",
+            product: "ccip",
+            severity: "high",
+            title: "Potential CCIP Token Pool releaseOrMint without _validateReleaseOrMint",
+            description: "releaseOrMint override does not appear to call _validateReleaseOrMint.",
+        },
+        scan(context) {
+            if (!hasTokenPoolReceiver(context.content))
+                return [];
+            if (isTokenPoolBase(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "releaseOrMint");
+            if (!body)
+                return [];
+            if (/_validateReleaseOrMint\s*\(/.test(body))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /function\s+releaseOrMint\b/),
+                    title: this.metadata.title,
+                    description: "Potential issue: releaseOrMint may skip offRamp caller verification and rate limit enforcement.",
+                    risk: "Omitting _validateReleaseOrMint allows arbitrary callers to trigger token minting or release, bypassing CCIP trust boundaries.",
+                    recommendation: "Call _validateReleaseOrMint(releaseOrMintIn) at the start of every releaseOrMint override before minting or releasing tokens.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-010",
+            product: "ccip",
+            severity: "medium",
+            title: "Potential unsafe CCIP Token Pool sourcePoolData decoding",
+            description: "releaseOrMint decodes sourcePoolData without obvious defensive checks.",
+        },
+        scan(context) {
+            if (!hasTokenPoolReceiver(context.content))
+                return [];
+            if (isTokenPoolBase(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "releaseOrMint");
+            if (!body)
+                return [];
+            if (!/abi\.decode\s*\(\s*(?:releaseOrMintIn\.)?sourcePoolData/.test(body))
+                return [];
+            const defensiveChecks = /(sourcePoolData\.length|try\s+this|catch|InvalidSourcePoolData|InvalidPayload|schema|version)/i.test(body);
+            if (defensiveChecks)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /abi\.decode\s*\(\s*(?:releaseOrMintIn\.)?sourcePoolData/),
+                    title: this.metadata.title,
+                    description: "Potential issue: malformed or unexpected sourcePoolData may cause releaseOrMint to revert and block token delivery.",
+                    risk: "If sourcePoolData schema changes across an upgrade or pool version, decoding failures can permanently brick in-flight transfers.",
+                    recommendation: "Validate sourcePoolData length or schema before decoding, or isolate decode failures so they can be handled without reverting the entire transfer.",
+                }),
+            ];
+        },
+    },
 ];

package/dist/scanner.js

@@ -78,7 +78,7 @@ function detectProducts(files) {
     const allContent = files.map((file) => file.content).join("\n");
     if (/(AggregatorV3Interface|latestRoundData|IChainlinkAggregator)/.test(allContent))
         products.add("data-feeds");
-    if (/(CCIPReceiver|Any2EVMMessage|IRouterClient|_ccipReceive|ccipReceive|sourceChainSelector)/.test(allContent))
+    if (/(CCIPReceiver|Any2EVMMessage|IRouterClient|_ccipReceive|ccipReceive|sourceChainSelector|TokenPool|LockOrBurnInV1|ReleaseOrMintInV1|_validateLockOrBurn|_validateReleaseOrMint)/.test(allContent))
         products.add("ccip");
     if (/(VRFConsumerBase|VRFCoordinator|fulfillRandomWords|requestRandomWords)/.test(allContent))
         products.add("vrf");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "chainlink-audit",
-  "version": "0.1.0",
-  "description": "Security CLI for detecting potential Chainlink integration risks in Solidity repositories.",
+  "version": "0.3.1",
+  "description": "Security review CLI for flagging unverified Chainlink integration risk leads in Solidity repositories.",
   "license": "MIT",
   "type": "module",
   "keywords": [