chainlink-audit 0.3.0 → 0.3.1

package/dist/rules/ccip.js

@@ -10,10 +10,23 @@ function hasCcipReceiver(content) {
     return /(function\s+_ccipReceive\b|function\s+ccipReceive\b|is\s+CCIPReceiver)/.test(content);
 }
 function isCcipBaseReceiver(content) {
-    return (/interface\s+\w*I?Any2EVMMessageReceiver\b/.test(content) ||
-        /interface\s+\w+\s*{[\s\S]*function\s+ccipReceive\b[^{]*;/.test(content) ||
-        /abstract\s+contract\s+\w*CCIPReceiver\b/.test(content) ||
-        /function\s+_ccipReceive\b[^{;]*internal[^{;]*virtual\s*;/.test(content));
+    if (/interface\s+\w*I?Any2EVMMessageReceiver\b/.test(content))
+        return true;
+    if (/interface\s+\w+\s*{[\s\S]*function\s+ccipReceive\b[^{]*;/.test(content))
+        return true;
+    if (/abstract\s+contract\s+\w*CCIPReceiver\b/.test(content))
+        return true;
+    if (/function\s+_ccipReceive\b[^{;]*internal[^{;]*virtual\s*;/.test(content))
+        return true;
+    // Guard stub: ccipReceive body is only a revert — intentional "not a receiver" pattern (e.g. EVM2EVMOffRamp)
+    const ccipReceiveBody = extractFunctionBody(content, "ccipReceive");
+    if (ccipReceiveBody) {
+        const bodyTrimmed = ccipReceiveBody.trim();
+        if (/^\s*revert\s*\(\s*\)\s*;\s*$/.test(bodyTrimmed) ||
+            /^\s*revert\s+\w[\w.]*\s*\([^)]*\)\s*;\s*$/.test(bodyTrimmed))
+            return true;
+    }
+    return false;
 }
 function inheritsCcipReceiver(content) {
     return /\bis\s+[\s\S{]*\bCCIPReceiver(Upgradeable)?\b/.test(content);
@@ -21,6 +34,20 @@ function inheritsCcipReceiver(content) {
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function extractParentNames(content) {
+    const match = /\bcontract\s+\w+\s+is\s+([\w\s,]+?)(?:\{|$)/m.exec(content);
+    if (!match)
+        return [];
+    return match[1].split(",").map((s) => s.trim()).filter(Boolean);
+}
+function inheritsViaCcipReceiver(content, repoSignals) {
+    const parents = extractParentNames(content);
+    return parents.some((parent) => {
+        const parentPattern = new RegExp(`\\b(?:abstract\\s+)?contract\\s+${escapeRegExp(parent)}\\b`);
+        const parentFile = repoSignals.files.find((f) => parentPattern.test(f.content));
+        return parentFile ? inheritsCcipReceiver(parentFile.content) : false;
+    });
+}
 function delegatedCcipContent(body, repoSignals) {
     const match = /\b([A-Z][A-Za-z0-9_]*)\s*\.\s*([A-Za-z0-9_]*ccipReceive|processCcipReceive)\s*\(/i.exec(body);
     if (!match)
@@ -31,16 +58,28 @@ function delegatedCcipContent(body, repoSignals) {
     const delegate = repoSignals.files.find((file) => typePattern.test(file.content) && functionPattern.test(file.content));
     return delegate ? `${body}\n${delegate.content}` : body;
 }
+function stripEmitLines(body) {
+    return body
+        .split("\n")
+        .filter((line) => !/\bemit\b/.test(line))
+        .join("\n");
+}
 function validatesSourceChain(content, body) {
     const header = ccipHeader(content);
-    const directValidation = /(sourceChainSelector|ccipSelectorToChainId)/.test(body) &&
+    // Strip event emissions before checking: sourceChainSelector that only appears in emit
+    // calls (e.g. for logging) must not suppress the finding.
+    const bodyWithoutEmits = stripEmitLines(body);
+    const directValidation = /(sourceChainSelector|ccipSelectorToChainId)/.test(bodyWithoutEmits) &&
         /(require|revert|allowed|trusted|allowlist|supportedNetworks|UnsupportedNetwork)/i.test(body);
     const modifierValidation = /(validChain|allowlisted|allowlist|trusted|onlyAllowlisted)[^{;]*(sourceChainSelector|\.sourceChainSelector)/i.test(header);
     return directValidation || modifierValidation;
 }
 function validatesSourceSender(content, body) {
     const header = ccipHeader(content);
-    const directValidation = /(message\.sender|data\.sender|sender)/.test(body) &&
+    // Strip event emissions before checking: sender that only appears in emit
+    // calls must not suppress the finding.
+    const bodyWithoutEmits = stripEmitLines(body);
+    const directValidation = /(message\.sender|data\.sender|sender)/.test(bodyWithoutEmits) &&
         /(require|revert|allowed|trusted|allowlist|Unauthorized)/i.test(body);
     const modifierValidation = /(validSender|trustedSender|allowlistedSender|onlyAllowlisted|allowlisted|allowlist|trusted)[^{;]*(message\.sender|\.sender|sender)/i.test(header);
     return directValidation || modifierValidation;
@@ -64,6 +103,24 @@ function hasMessageIdTracking(content, body) {
         return false;
     return /(processed|received|executed|consumed|handled|seen|replay|duplicate|messageDetail|failedMessages|messageIdTo)/i.test(content);
 }
+function hasTokenPoolSender(content) {
+    return (/function\s+lockOrBurn\b/.test(content) &&
+        /(Pool\.LockOrBurnInV1|LockOrBurnInV1|is\s+[\w\s,]*TokenPool)/.test(content));
+}
+function hasTokenPoolReceiver(content) {
+    return (/function\s+releaseOrMint\b/.test(content) &&
+        /(Pool\.ReleaseOrMintInV1|ReleaseOrMintInV1|is\s+[\w\s,]*TokenPool)/.test(content));
+}
+function isTokenPoolBase(content) {
+    if (/abstract\s+contract\s+\w*TokenPool\b/.test(content))
+        return true;
+    if (/interface\s+\w*(TokenPool|IPool)\b/.test(content))
+        return true;
+    // Abstract contracts that inherit from a TokenPool base (e.g. BurnMintTokenPoolAbstract is BurnMintTokenPool)
+    if (/abstract\s+contract\s+\w+\s+is\s+[\w\s,]*TokenPool\b/.test(content))
+        return true;
+    return false;
+}
 export const ccipRules = [
     {
         metadata: {
@@ -145,7 +202,7 @@ export const ccipRules = [
             const body = ccipBody(context.content) || context.content;
             const validationContent = `${ccipHeader(context.content)}\n${delegatedCcipContent(body, context.repoSignals)}`;
             const validatesRouter = /msg\.sender\s*(!=|==)\s*(router|s_router|i_router|address\(router\))|InvalidRouter|onlyRouter|NotCcipRouter|_msgSender\(\)\s*!=\s*address\([^)]*ccipRouter/i.test(validationContent);
-            if (validatesRouter || inheritsCcipReceiver(context.content))
+            if (validatesRouter || inheritsCcipReceiver(context.content) || inheritsViaCcipReceiver(context.content, context.repoSignals))
                 return [];
             return [
                 makeFinding({
@@ -303,4 +360,106 @@ export const ccipRules = [
             ];
         },
     },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-008",
+            product: "ccip",
+            severity: "high",
+            title: "Potential CCIP Token Pool lockOrBurn without _validateLockOrBurn",
+            description: "lockOrBurn override does not appear to call _validateLockOrBurn.",
+        },
+        scan(context) {
+            if (!hasTokenPoolSender(context.content))
+                return [];
+            if (isTokenPoolBase(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "lockOrBurn");
+            if (!body)
+                return [];
+            if (/_validateLockOrBurn\s*\(/.test(body))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /function\s+lockOrBurn\b/),
+                    title: this.metadata.title,
+                    description: "Potential issue: lockOrBurn may skip rate limit and chain allowlist enforcement.",
+                    risk: "Omitting _validateLockOrBurn bypasses CCIP-enforced rate limits and supported-chain checks, enabling unrestricted token locking or burning.",
+                    recommendation: "Call _validateLockOrBurn(lockOrBurnIn) at the start of every lockOrBurn override before executing custom logic.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-009",
+            product: "ccip",
+            severity: "high",
+            title: "Potential CCIP Token Pool releaseOrMint without _validateReleaseOrMint",
+            description: "releaseOrMint override does not appear to call _validateReleaseOrMint.",
+        },
+        scan(context) {
+            if (!hasTokenPoolReceiver(context.content))
+                return [];
+            if (isTokenPoolBase(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "releaseOrMint");
+            if (!body)
+                return [];
+            if (/_validateReleaseOrMint\s*\(/.test(body))
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "medium",
+                    line: firstLineMatching(context.lines, /function\s+releaseOrMint\b/),
+                    title: this.metadata.title,
+                    description: "Potential issue: releaseOrMint may skip offRamp caller verification and rate limit enforcement.",
+                    risk: "Omitting _validateReleaseOrMint allows arbitrary callers to trigger token minting or release, bypassing CCIP trust boundaries.",
+                    recommendation: "Call _validateReleaseOrMint(releaseOrMintIn) at the start of every releaseOrMint override before minting or releasing tokens.",
+                }),
+            ];
+        },
+    },
+    {
+        metadata: {
+            ruleId: "CL-CCIP-010",
+            product: "ccip",
+            severity: "medium",
+            title: "Potential unsafe CCIP Token Pool sourcePoolData decoding",
+            description: "releaseOrMint decodes sourcePoolData without obvious defensive checks.",
+        },
+        scan(context) {
+            if (!hasTokenPoolReceiver(context.content))
+                return [];
+            if (isTokenPoolBase(context.content))
+                return [];
+            const body = extractFunctionBody(context.content, "releaseOrMint");
+            if (!body)
+                return [];
+            if (!/abi\.decode\s*\(\s*(?:releaseOrMintIn\.)?sourcePoolData/.test(body))
+                return [];
+            const defensiveChecks = /(sourcePoolData\.length|try\s+this|catch|InvalidSourcePoolData|InvalidPayload|schema|version)/i.test(body);
+            if (defensiveChecks)
+                return [];
+            return [
+                makeFinding({
+                    context,
+                    ruleId: this.metadata.ruleId,
+                    severity: this.metadata.severity,
+                    confidence: "low",
+                    line: firstLineMatching(context.lines, /abi\.decode\s*\(\s*(?:releaseOrMintIn\.)?sourcePoolData/),
+                    title: this.metadata.title,
+                    description: "Potential issue: malformed or unexpected sourcePoolData may cause releaseOrMint to revert and block token delivery.",
+                    risk: "If sourcePoolData schema changes across an upgrade or pool version, decoding failures can permanently brick in-flight transfers.",
+                    recommendation: "Validate sourcePoolData length or schema before decoding, or isolate decode failures so they can be handled without reverting the entire transfer.",
+                }),
+            ];
+        },
+    },
 ];

package/dist/scanner.js

@@ -78,7 +78,7 @@ function detectProducts(files) {
     const allContent = files.map((file) => file.content).join("\n");
     if (/(AggregatorV3Interface|latestRoundData|IChainlinkAggregator)/.test(allContent))
         products.add("data-feeds");
-    if (/(CCIPReceiver|Any2EVMMessage|IRouterClient|_ccipReceive|ccipReceive|sourceChainSelector)/.test(allContent))
+    if (/(CCIPReceiver|Any2EVMMessage|IRouterClient|_ccipReceive|ccipReceive|sourceChainSelector|TokenPool|LockOrBurnInV1|ReleaseOrMintInV1|_validateLockOrBurn|_validateReleaseOrMint)/.test(allContent))
         products.add("ccip");
     if (/(VRFConsumerBase|VRFCoordinator|fulfillRandomWords|requestRandomWords)/.test(allContent))
         products.add("vrf");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chainlink-audit",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Security review CLI for flagging unverified Chainlink integration risk leads in Solidity repositories.",
   "license": "MIT",
   "type": "module",