chainlink-audit 0.1.0

package/dist/rules/automation.js

@@ -0,0 +1,102 @@
+import { extractFunctionBody, firstLineMatching, makeFinding } from "./helpers.js";
+function hasAutomation(content) {
+    return /(AutomationCompatibleInterface|KeeperCompatibleInterface|function\s+checkUpkeep\b|function\s+performUpkeep\b)/.test(content);
+}
+export const automationRules = [
+    {
+        metadata: {
+            ruleId: "CL-AUTO-001",
+            product: "automation",
+            severity: "high",
+            title: "Potential performUpkeep without condition revalidation",
+            description: "performUpkeep appears not to revalidate checkUpkeep conditions.",
+        },
+        scan(context) {
+            if (!hasAutomation(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "performUpkeep");
+            if (!body)
+                return [];
+            const revalidates = /(require|revert|UpkeepNotNeeded|checkUpkeep)/.test(body) &&
+                /(block\.timestamp|lastExecutedAt|interval|upkeepNeeded|balance|paused)/.test(body);
+            if (revalidates)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /performUpkeep/),
+                    title: this.metadata.title,
+                    description: "Potential issue: anyone can call performUpkeep, so it must independently validate that upkeep is still needed.",
+                    risk: "Attackers or stale Automation calls may trigger premature or invalid state transitions.",
+                    recommendation: "Revalidate all critical checkUpkeep conditions inside performUpkeep before changing state.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-AUTO-002",
+            product: "automation",
+            severity: "medium",
+            title: "Potential stale performData trust",
+            description: "performUpkeep decodes performData without an obvious freshness or consistency check.",
+        },
+        scan(context) {
+            if (!hasAutomation(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "performUpkeep");
+            if (!/abi\.decode\s*\(\s*performData/.test(body))
+                return [];
+            const validatesPerformData = /(StalePerformData|scheduledAt\s*==|nonce|epoch|deadline|lastExecutedAt|require|revert)/.test(body);
+            if (validatesPerformData)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /abi\.decode\s*\(\s*performData/),
+                    title: this.metadata.title,
+                    description: "Potential issue: performData generated earlier may be replayed after state conditions change.",
+                    risk: "Stale performData can execute the wrong task, skip newer state, or trigger duplicate work.",
+                    recommendation: "Bind performData to current state with a nonce, scheduled timestamp, epoch, or equivalent consistency check.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-AUTO-003",
+            product: "automation",
+            severity: "low",
+            title: "Potential missing pause or emergency control for upkeep",
+            description: "Automation-compatible logic has no obvious pause/emergency path.",
+        },
+        scan(context) {
+            if (!hasAutomation(context.content))
+                return [];
+            if (!/function\s+performUpkeep\b/.test(context.content))
+                return [];
+            const hasPause = /(Pausable|whenNotPaused|paused|pause\(|emergency|guardian)/i.test(context.content);
+            if (hasPause)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /performUpkeep|checkUpkeep/),
+                    title: this.metadata.title,
+                    description: "Potential issue: critical upkeep logic may not have an emergency stop mechanism.",
+                    risk: "A faulty upkeep or bad offchain configuration may continue changing state until code/configuration is upgraded.",
+                    recommendation: "Consider pause, guardian, or emergency controls for high-impact upkeep logic and document forwarder assumptions.",
+                }),
+            ];
+        },
+    },
+];

package/dist/rules/ccip.js

@@ -0,0 +1,163 @@
+import { countMatches, extractFunctionBody, firstLineMatching, makeFinding } from "./helpers.js";
+function ccipBody(content) {
+    return extractFunctionBody(content, "_ccipReceive") || extractFunctionBody(content, "ccipReceive");
+}
+function hasCcipReceiver(content) {
+    return /(function\s+_ccipReceive\b|function\s+ccipReceive\b|is\s+CCIPReceiver)/.test(content);
+}
+export const ccipRules = [
+    {
+        metadata: {
+            ruleId: "CL-CCIP-001",
+            product: "ccip",
+            severity: "high",
+            title: "Potential CCIP receive without source chain validation",
+            description: "_ccipReceive appears to lack sourceChainSelector validation.",
+        },
+        scan(context) {
+            if (!hasCcipReceiver(context.content))
+                return [];
+            const body = ccipBody(context.content) || context.content;
+            const validates = /sourceChainSelector/.test(body) && /(require|revert|allowed|trusted|allowlist)/i.test(body);
+            if (validates)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /(_ccipReceive|ccipReceive)/),
+                    title: this.metadata.title,
+                    description: "Potential issue: messages from unexpected source chains may be accepted.",
+                    risk: "Cross-chain spoofing or misrouted messages can trigger unauthorized state changes.",
+                    recommendation: "Validate message.sourceChainSelector against an explicit allowlist before decoding payloads or mutating state.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-002",
+            product: "ccip",
+            severity: "high",
+            title: "Potential CCIP receive without source sender validation",
+            description: "_ccipReceive appears to lack trusted sender validation.",
+        },
+        scan(context) {
+            if (!hasCcipReceiver(context.content))
+                return [];
+            const body = ccipBody(context.content) || context.content;
+            const validates = /(message\.sender|sender)/.test(body) && /(require|revert|allowed|trusted|allowlist)/i.test(body);
+            if (validates)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /(_ccipReceive|ccipReceive)/),
+                    title: this.metadata.title,
+                    description: "Potential issue: messages from untrusted source contracts may be accepted.",
+                    risk: "An attacker may spoof business instructions if sender validation is missing or incomplete.",
+                    recommendation: "Decode message.sender and validate it against the trusted sender for the specific source chain.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-003",
+            product: "ccip",
+            severity: "high",
+            title: "Potential missing CCIP router validation",
+            description: "Receiver entrypoint does not appear to validate msg.sender/router.",
+        },
+        scan(context) {
+            if (!hasCcipReceiver(context.content))
+                return [];
+            const validatesRouter = /msg\.sender\s*(!=|==)\s*(router|s_router|i_router|address\(router\))|InvalidRouter|onlyRouter/i.test(context.content);
+            if (validatesRouter || /is\s+CCIPReceiver/.test(context.content))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /(ccipReceive|_ccipReceive)/),
+                    title: this.metadata.title,
+                    description: "Potential issue: direct calls to the receiver may bypass CCIP router trust assumptions.",
+                    risk: "If the entrypoint is public/external and router validation is absent, fabricated messages may be processed.",
+                    recommendation: "Ensure only the expected CCIP router can invoke message handling, either through CCIPReceiver or explicit msg.sender checks.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-004",
+            product: "ccip",
+            severity: "medium",
+            title: "Potential unsafe CCIP payload decoding",
+            description: "Receiver decodes message data without obvious defensive checks.",
+        },
+        scan(context) {
+            if (!hasCcipReceiver(context.content))
+                return [];
+            const body = ccipBody(context.content) || context.content;
+            if (!/abi\.decode\s*\(\s*message\.data/.test(body))
+                return [];
+            const defensiveChecks = /(message\.data\.length|try\s+this|catch|InvalidPayload|Payload|version|schema)/i.test(body);
+            if (defensiveChecks)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /abi\.decode\s*\(\s*message\.data/),
+                    title: this.metadata.title,
+                    description: "Potential issue: malformed payloads may revert or be decoded under the wrong schema.",
+                    risk: "Unexpected decoding failures can block message processing or route invalid business instructions.",
+                    recommendation: "Validate payload schema/version/length or isolate decoding failures so they can be handled manually.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-005",
+            product: "ccip",
+            severity: "medium",
+            title: "Potential tightly coupled CCIP receiver logic",
+            description: "Receiver appears to execute business logic directly without an obvious graceful failure path.",
+        },
+        scan(context) {
+            if (!hasCcipReceiver(context.content))
+                return [];
+            const body = ccipBody(context.content);
+            if (!body)
+                return [];
+            const businessSignals = countMatches(body, [/transfer/i, /mint/i, /burn/i, /swap/i, /deposit/i, /withdraw/i, /credit/i, /call\s*\{/]);
+            const gracefulFailure = /(try|catch|failedMessages|manual|retry|recover|queue)/i.test(context.content);
+            if (businessSignals < 1 || gracefulFailure)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /(_ccipReceive|ccipReceive)/),
+                    title: this.metadata.title,
+                    description: "Potential issue: receiver business logic appears coupled to CCIP execution without a visible retry/manual path.",
+                    risk: "A revert in message handling may require manual execution or leave cross-chain state inconsistent.",
+                    recommendation: "Separate validation/decoding from business logic and add a tested graceful failure or manual recovery path where needed.",
+                }),
+            ];
+        },
+    },
+];

package/dist/rules/data-feeds.js

@@ -0,0 +1,127 @@
+import { firstLineMatching, hasAny, makeFinding } from "./helpers.js";
+export const dataFeedRules = [
+    {
+        metadata: {
+            ruleId: "CL-DF-001",
+            product: "data-feeds",
+            severity: "medium",
+            title: "Potential Data Feed read without freshness validation",
+            description: "latestRoundData() appears to be used without an obvious stale price check.",
+        },
+        scan(context) {
+            if (!/\.latestRoundData\s*\(/.test(context.content))
+                return [];
+            const hasFreshnessCheck = /updatedAt/.test(context.content) &&
+                /(block\.timestamp|maxStaleness|stale|heartbeat|updatedAt\s*!=\s*0)/i.test(context.content);
+            if (hasFreshnessCheck)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /\.latestRoundData\s*\(/),
+                    title: this.metadata.title,
+                    description: "Potential issue: the feed answer may be accepted even when updatedAt is zero or older than the intended heartbeat.",
+                    risk: "Stale oracle data can lead to incorrect pricing, unsafe liquidations, incorrect collateral valuation, or stale settlement.",
+                    recommendation: "Validate updatedAt != 0 and enforce a feed-specific max staleness threshold before using the answer.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-DF-002",
+            product: "data-feeds",
+            severity: "high",
+            title: "Potential missing positive answer check",
+            description: "latestRoundData() appears to be used without requiring answer > 0.",
+        },
+        scan(context) {
+            if (!/\.latestRoundData\s*\(/.test(context.content))
+                return [];
+            const hasPositiveAnswerCheck = hasAny(context.content, [
+                /answer\s*>\s*0/,
+                /price\s*>\s*0/,
+                /oracleAnswer\s*>\s*0/,
+                /InvalidOracleAnswer/,
+            ]);
+            if (hasPositiveAnswerCheck)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /\.latestRoundData\s*\(/),
+                    title: this.metadata.title,
+                    description: "Potential issue: a zero or negative feed answer may be cast to uint256 or used as a valid price.",
+                    risk: "Non-positive oracle answers can break accounting, cause reverts, or create extreme normalized prices after casting.",
+                    recommendation: "Require answer > 0 before casting or using the price.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-DF-003",
+            product: "data-feeds",
+            severity: "low",
+            title: "Possible hardcoded Data Feed decimals",
+            description: "Code appears to assume 8 feed decimals or scale by a hardcoded 1e10 factor.",
+        },
+        scan(context) {
+            if (!/(AggregatorV3Interface|latestRoundData|\.decimals\s*\()/i.test(context.content))
+                return [];
+            const hardcodedDecimals = /(1e8|10\s*\*\*\s*8|100000000|\*\s*1e10|1e10)/;
+            if (!hardcodedDecimals.test(context.content))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, hardcodedDecimals),
+                    title: this.metadata.title,
+                    description: "Potential issue: not all Chainlink feeds use the same decimals, and migrations can invalidate implicit assumptions.",
+                    risk: "Incorrect normalization can misprice assets by orders of magnitude.",
+                    recommendation: "Read feed.decimals() or document why the specific feed decimals are safe for this deployment.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-DF-004",
+            product: "data-feeds",
+            severity: "medium",
+            title: "Potential missing L2 sequencer uptime check",
+            description: "Repository appears to target L2 and use Data Feeds without an obvious Sequencer Uptime Feed check.",
+        },
+        scan(context) {
+            if (!context.repoSignals.targetsL2)
+                return [];
+            if (!/\.latestRoundData\s*\(/.test(context.content))
+                return [];
+            const hasSequencerCheck = /(SequencerUptime|sequencer|gracePeriod|L2Sequencer)/i.test(context.content);
+            if (hasSequencerCheck)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /\.latestRoundData\s*\(/),
+                    title: this.metadata.title,
+                    description: "Potential issue: L2 sequencer downtime can make recent-looking price data unsafe immediately after recovery.",
+                    risk: "Protocols may execute using stale or unfair prices around sequencer outages.",
+                    recommendation: "For L2 deployments, check the Chainlink Sequencer Uptime Feed and enforce a post-recovery grace period.",
+                }),
+            ];
+        },
+    },
+];

package/dist/rules/functions-cre.js

@@ -0,0 +1,93 @@
+import { firstLineMatching, hasAny, makeFinding } from "./helpers.js";
+function hasFunctions(content) {
+    return /(FunctionsClient|FunctionsRequest|sendRequest|fulfillRequest|DONHostedSecrets|sourceCode|secrets)/i.test(content);
+}
+export const functionsCreRules = [
+    {
+        metadata: {
+            ruleId: "CL-FN-001",
+            product: "functions-cre",
+            severity: "info",
+            title: "Chainlink Functions usage detected",
+            description: "Functions integration detected; migration and CRE considerations should be documented.",
+        },
+        scan(context) {
+            if (!hasFunctions(context.content))
+                return [];
+            if (/\bCRE\b|migration|sunset/i.test(context.content))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /(FunctionsClient|FunctionsRequest|sendRequest)/i),
+                    title: this.metadata.title,
+                    description: "Potential issue: legacy Functions assumptions may be undocumented.",
+                    risk: "Operational migration, DON behavior, billing, or maintenance assumptions may be missed during audit or deployment.",
+                    recommendation: "Add an explicit Functions/CRE migration note and document current Chainlink guidance for this integration.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-FN-002",
+            product: "functions-cre",
+            severity: "medium",
+            title: "Potential unsafe secrets or external API assumptions",
+            description: "Functions-style code appears to reference secrets or API calls without clear handling assumptions.",
+        },
+        scan(context) {
+            if (!hasFunctions(context.content))
+                return [];
+            const secretsOrApi = /(apiKey|secret|Authorization|fetch\s*\(|axios|http)/i.test(context.content);
+            const documented = /(DONHostedSecrets|encryptedSecrets|rateLimit|quota|throttle|secretVersion)/i.test(context.content);
+            if (!secretsOrApi || documented)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /(apiKey|secret|Authorization|fetch\s*\(|axios|http)/i),
+                    title: this.metadata.title,
+                    description: "Potential issue: secrets or external API limits may not be handled safely.",
+                    risk: "Leaked credentials, throttled APIs, or nondeterministic external responses can break request fulfillment.",
+                    recommendation: "Use supported encrypted/DON-hosted secrets and document API quotas, throttling, and failure behavior.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-FN-003",
+            product: "functions-cre",
+            severity: "low",
+            title: "Potential missing Functions timeout/error handling assumptions",
+            description: "Functions request/fulfillment flow lacks obvious timeout or error handling documentation.",
+        },
+        scan(context) {
+            if (!hasFunctions(context.content))
+                return [];
+            const handlesErrors = hasAny(context.content, [/err\b/i, /error/i, /timeout/i, /failed/i, /retry/i]);
+            if (handlesErrors)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /(sendRequest|fulfillRequest|Functions)/i),
+                    title: this.metadata.title,
+                    description: "Potential issue: request failure, timeout, or malformed response handling is not obvious.",
+                    risk: "Protocol state may remain unresolved or accept incomplete offchain results.",
+                    recommendation: "Document and test timeout, error, malformed response, and retry assumptions.",
+                }),
+            ];
+        },
+    },
+];

package/dist/rules/helpers.js

@@ -0,0 +1,43 @@
+export function firstLineMatching(lines, pattern) {
+    const index = lines.findIndex((line) => pattern.test(line));
+    return index === -1 ? 1 : index + 1;
+}
+export function hasAny(content, patterns) {
+    return patterns.some((pattern) => pattern.test(content));
+}
+export function extractFunctionBody(content, functionName) {
+    const match = new RegExp(`function\\s+${functionName}\\b`).exec(content);
+    if (!match)
+        return "";
+    const open = content.indexOf("{", match.index);
+    if (open === -1)
+        return "";
+    let depth = 0;
+    for (let index = open; index < content.length; index++) {
+        const char = content[index];
+        if (char === "{")
+            depth++;
+        if (char === "}")
+            depth--;
+        if (depth === 0)
+            return content.slice(open + 1, index);
+    }
+    return content.slice(open + 1);
+}
+export function countMatches(content, patterns) {
+    return patterns.reduce((count, pattern) => count + (pattern.test(content) ? 1 : 0), 0);
+}
+export function makeFinding(input) {
+    return {
+        ruleId: input.ruleId,
+        severity: input.severity,
+        confidence: input.confidence,
+        file: input.context.file,
+        line: input.line,
+        title: input.title,
+        description: input.description,
+        risk: input.risk,
+        recommendation: input.recommendation,
+        manualReviewRequired: input.manualReviewRequired ?? true,
+    };
+}

package/dist/rules/index.js

@@ -0,0 +1,12 @@
+import { automationRules } from "./automation.js";
+import { ccipRules } from "./ccip.js";
+import { dataFeedRules } from "./data-feeds.js";
+import { functionsCreRules } from "./functions-cre.js";
+import { vrfRules } from "./vrf.js";
+export const rules = [
+    ...dataFeedRules,
+    ...ccipRules,
+    ...vrfRules,
+    ...automationRules,
+    ...functionsCreRules,
+];

package/dist/rules/vrf.js

@@ -0,0 +1,99 @@
+import { countMatches, extractFunctionBody, firstLineMatching, makeFinding } from "./helpers.js";
+function hasVrf(content) {
+    return /(VRFConsumerBase|VRFCoordinator|function\s+fulfillRandomWords\b|requestRandomWords)/.test(content);
+}
+export const vrfRules = [
+    {
+        metadata: {
+            ruleId: "CL-VRF-001",
+            product: "vrf",
+            severity: "high",
+            title: "Potential VRF callback without requestId tracking",
+            description: "fulfillRandomWords appears to lack requestId validation.",
+        },
+        scan(context) {
+            if (!/function\s+fulfillRandomWords\b/.test(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "fulfillRandomWords") || context.content;
+            const validates = /requestId/.test(body) &&
+                /(pendingRequests|requestStatus|requests)\s*\[?\s*requestId/.test(context.content) &&
+                /(require|revert|UnknownRequest)/.test(body);
+            if (validates)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /fulfillRandomWords/),
+                    title: this.metadata.title,
+                    description: "Potential issue: unknown or duplicate VRF fulfillments may mutate state.",
+                    risk: "Incorrect request correlation can break fairness, overwrite randomness, or settle the wrong user/action.",
+                    recommendation: "Track request IDs before requesting randomness and reject unknown or duplicate fulfillments.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-VRF-002",
+            product: "vrf",
+            severity: "medium",
+            title: "Potential heavy or reverting VRF callback",
+            description: "fulfillRandomWords appears to contain business logic that may revert or exceed callback gas.",
+        },
+        scan(context) {
+            if (!/function\s+fulfillRandomWords\b/.test(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "fulfillRandomWords");
+            if (!body)
+                return [];
+            const riskySignals = countMatches(body, [/for\s*\(/, /while\s*\(/, /\.call\s*\(/, /\.transfer\s*\(/, /\.send\s*\(/, /require\s*\(/, /revert\s+/]);
+            if (riskySignals === 0)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /fulfillRandomWords/),
+                    title: this.metadata.title,
+                    description: "Potential issue: VRF callback contains logic that may revert, call externally, or become gas-heavy.",
+                    risk: "Failed VRF callbacks can block randomness delivery and leave protocol actions unresolved.",
+                    recommendation: "Keep fulfillRandomWords minimal, avoid external calls/unbounded loops, and test callback gas limits.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-VRF-003",
+            product: "vrf",
+            severity: "medium",
+            title: "Potential VRF request state not tracked",
+            description: "Randomness requests appear without obvious pre-fulfillment state tracking.",
+        },
+        scan(context) {
+            if (!/requestRandomWords\s*\(/.test(context.content))
+                return [];
+            const tracksBeforeFulfillment = /(pendingRequests|requestStatus|requests)\s*\[.*\]\s*=/.test(context.content);
+            if (tracksBeforeFulfillment)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /requestRandomWords\s*\(/),
+                    title: this.metadata.title,
+                    description: "Potential issue: request lifecycle state is not visibly committed when randomness is requested.",
+                    risk: "State may be manipulated between request and fulfillment or callbacks may not map to the intended action.",
+                    recommendation: "Store request metadata before or immediately after requesting randomness and validate it in the callback.",
+                }),
+            ];
+        },
+    },
+];