damlisk 0.0.1__py3-none-any.whl

damlisk/__init__.py

@@ -0,0 +1,21 @@
+from importlib.metadata import PackageNotFoundError
+from importlib.metadata import version as _version
+from pathlib import Path as _Path
+
+_hash_file = _Path(__file__).parent.joinpath("damlisk_git_commithash.txt")
+
+if _hash_file.exists():
+    with _hash_file.open() as fp:
+        __commit__ = fp.read()
+else:
+    __commit__ = "unknown"
+
+__version__: str
+try:
+    __version__ = _version("damlisk")
+except PackageNotFoundError:
+    from damlisk.version import version
+
+    __version__ = version
+
+__long_version__ = f"{__version__}+commit.{__commit__}"

damlisk/__main__.py

@@ -0,0 +1,7 @@
+#!/usr/bin/env python3
+# -*- coding: UTF-8 -*-
+
+from damlisk.cli.main import cli
+
+if __name__ == "__main__":
+    cli()

damlisk/cli/main.py

@@ -0,0 +1,130 @@
+import sys
+from pathlib import Path
+
+import click
+from loguru import logger
+
+from damlisk import __version__
+from damlisk.detectors.abstract_detector import AbstractDetector
+from damlisk.detectors.all_detectors import DETECTORS
+from damlisk.exceptions import DamliskException
+from damlisk.lf.dar import Dar
+from damlisk.lf.index import PackageIndex
+from damlisk.output.finding import Finding, Impact
+from damlisk.output.formats import render_json, render_text
+
+_TRACEBACK = click.option(
+    "--traceback", is_flag=True, help="Show a Python traceback on error instead of a short message."
+)
+_DAR_ARG = click.argument("dar_path", type=click.Path(exists=True, path_type=Path))
+_LEVELS = [i.name.lower() for i in Impact]
+
+
+def _split(value: str | None) -> set[str]:
+    return {item.strip() for item in (value or "").split(",") if item.strip()}
+
+
+def select_detectors(detect: str | None, exclude: str | None) -> list[type[AbstractDetector]]:
+    wanted, skipped = _split(detect), _split(exclude)
+    unknown = (wanted | skipped) - {d.ARGUMENT for d in DETECTORS}
+    if unknown:
+        raise click.BadParameter(f"unknown detector(s): {', '.join(sorted(unknown))}")
+    return [d for d in DETECTORS if d.ARGUMENT in (wanted or {d.ARGUMENT}) - skipped]
+
+
+def _load(dar_path: Path, traceback: bool) -> Dar:
+    try:
+        return Dar.load(dar_path)
+    except DamliskException as err:
+        if traceback:
+            raise
+        logger.error(str(err))
+        sys.exit(2)
+
+
+def _fails(findings: list[Finding], fail_on: str) -> bool:
+    return fail_on != "none" and any(
+        f.impact.rank <= Impact[fail_on.upper()].rank for f in findings
+    )
+
+
+@click.group(invoke_without_command=True)
+@click.version_option(__version__, "--version", "-V", prog_name="damlisk")
+@click.pass_context
+def cli(ctx: click.Context) -> None:
+    """Damlisk: static analyzer for Daml-LF packages (.dar)."""
+    if ctx.invoked_subcommand is None:
+        click.echo(ctx.get_help())
+
+
+@cli.command("scan")
+@_DAR_ARG
+@click.option("--detect", default=None, help="Comma-separated detectors to run (default: all).")
+@click.option("--exclude", default=None, help="Comma-separated detectors to skip.")
+@click.option("--json", "as_json", is_flag=True, help="Output findings as JSON.")
+@click.option(
+    "--pretty-json", "pretty", is_flag=True, help="Output JSON in pretty (indented) format."
+)
+@click.option(
+    "--fail-on",
+    type=click.Choice([*_LEVELS, "none"]),
+    default="none",
+    show_default=True,
+    help="Exit with code 1 if a finding of this impact or higher is reported.",
+)
+@_TRACEBACK
+def scan_cmd(
+    dar_path: Path,
+    detect: str | None,
+    exclude: str | None,
+    as_json: bool,
+    pretty: bool,
+    fail_on: str,
+    traceback: bool,
+) -> None:
+    """Run detectors over the main package of DAR_PATH."""
+    detectors = select_detectors(detect, exclude)
+    index = PackageIndex(_load(dar_path, traceback))
+    findings: list[Finding] = []
+    for det in detectors:
+        found = det(index).detect()
+        findings.extend(found)
+    if as_json or pretty:
+        click.echo(render_json(findings, pretty))
+    else:
+        click.echo(render_text(findings))
+    if _fails(findings, fail_on):
+        sys.exit(1)
+
+
+@cli.command("info")
+@_DAR_ARG
+@_TRACEBACK
+def info_cmd(dar_path: Path, traceback: bool) -> None:
+    """Show packages, Daml-LF versions and declarations of DAR_PATH."""
+    dar = _load(dar_path, traceback)
+    main, mods = dar.main, dar.main.modules
+    rows = (
+        ("main", f"{main.name} {main.version} (LF {main.lf_ver}) {main.pkg_id}"),
+        ("sdk", dar.sdk or "unknown"),
+        ("modules", len(mods)),
+        ("templates", sum(len(m.templates) for m in mods)),
+        ("choices", sum(len(t.choices) for m in mods for t in m.templates)),
+        ("interfaces", sum(len(m.interfaces) for m in mods)),
+        ("interface instances", len(main.extras.implements)),
+        ("exceptions", len(main.extras.exceptions)),
+        ("values", sum(len(m.values) for m in mods)),
+        ("packages", len(dar.packages)),
+    )
+    for label, value in rows:
+        click.echo(f"{label}: {value}")
+    packages = sorted(dar.packages, key=lambda p: (p.name, p.version))
+    for pkg in packages:
+        click.echo(f"  {pkg.name} {pkg.version} (LF {pkg.lf_ver})")
+
+
+@cli.command("list-detectors")
+def list_detectors_cmd() -> None:
+    """List available detectors."""
+    for d in DETECTORS:
+        click.echo(f"{d.ARGUMENT:<24} {d.IMPACT.value:<14} {d.CONFIDENCE.value:<8} {d.HELP}")

damlisk/detectors/abstract_detector.py

@@ -0,0 +1,49 @@
+from abc import ABC, abstractmethod
+from typing import ClassVar
+
+from dazl.damlast import daml_lf_1 as lf
+
+from damlisk.lf.flow import FieldFlow
+from damlisk.lf.index import PackageIndex
+from damlisk.output.finding import Confidence, Finding, Impact
+
+
+class AbstractDetector(ABC):
+    ARGUMENT: ClassVar[str] = ""
+    HELP: ClassVar[str] = ""
+    IMPACT: ClassVar[Impact] = Impact.INFORMATIONAL
+    CONFIDENCE: ClassVar[Confidence] = Confidence.HIGH
+    WIKI_TITLE: ClassVar[str] = ""
+    WIKI_DESCRIPTION: ClassVar[str] = ""
+    WIKI_EXPLOIT_SCENARIO: ClassVar[str] = ""
+    WIKI_RECOMMENDATION: ClassVar[str] = ""
+
+    def __init__(self, index: PackageIndex) -> None:
+        self.index = index
+
+    @abstractmethod
+    def _detect(self) -> list[Finding]: ...
+
+    def detect(self) -> list[Finding]:
+        return sorted(self._detect(), key=lambda f: (f.impact.rank, f.owner, f.line or 0))
+
+    def signers(self, flow: FieldFlow) -> dict[str, set[str]]:
+        """Return the signatory fields of every main-package template, by template owner."""
+        found = {}
+        tmpls = self.index.template_decls()
+        for tmpl in tmpls:
+            sigs = tmpl.template.signatories
+            if sigs is not None:
+                found[tmpl.owner] = flow.fields(sigs, tmpl.template.param)
+        return found
+
+    def finding(self, owner: str, message: str, loc: lf.Location | None) -> Finding:
+        return Finding(
+            check=self.ARGUMENT,
+            impact=self.IMPACT,
+            confidence=self.CONFIDENCE,
+            message=message,
+            package=self.index.dar.main.name,
+            owner=owner,
+            loc=loc,
+        )

damlisk/detectors/all_detectors.py

@@ -0,0 +1,74 @@
+from damlisk.detectors.abstract_detector import AbstractDetector
+from damlisk.detectors.assets.arbitrary_party import ArbitraryParty
+from damlisk.detectors.assets.stuck_asset import StuckAsset
+from damlisk.detectors.authorization.controller_arg import ControllerFromArgument
+from damlisk.detectors.authorization.delegated_leak import DelegatedLeak
+from damlisk.detectors.authorization.hardcoded_party import HardcodedParty
+from damlisk.detectors.authorization.over_disclosure import OverDisclosure
+from damlisk.detectors.authorization.unprotected_archive import UnprotectedArchive
+from damlisk.detectors.contracts.stale_fetch import StaleFetch
+from damlisk.detectors.contracts.unsafe_primitive import UnsafePrimitive
+from damlisk.detectors.contracts.untrusted_interface import UntrustedInterface
+from damlisk.detectors.hygiene.aborting_choice import AbortingChoice
+from damlisk.detectors.hygiene.boolean_cst import BooleanConstant
+from damlisk.detectors.hygiene.boolean_equal import BooleanEqual
+from damlisk.detectors.hygiene.debug_trace import DebugTrace
+from damlisk.detectors.hygiene.discarded_update import DiscardedUpdate
+from damlisk.detectors.hygiene.rtlo import Rtlo
+from damlisk.detectors.hygiene.tautological_compare import TautologicalCompare
+from damlisk.detectors.hygiene.unused_field import UnusedTemplateField
+from damlisk.detectors.loops.ledger_op_in_loop import LedgerOpInLoop
+from damlisk.detectors.loops.unbounded_input_loop import UnboundedInputLoop
+from damlisk.detectors.time.time_dependence import TimeDependence
+from damlisk.detectors.time.weak_randomness import WeakRandomness
+from damlisk.detectors.upgrade.sdk_version import SdkVersion
+from damlisk.detectors.validation.amount_tolerance import AmountTolerance
+from damlisk.detectors.validation.divide_multiply import DivideBeforeMultiply
+from damlisk.detectors.validation.hash_concat import HashConcatCollision
+from damlisk.detectors.validation.ignored_optional import IgnoredOptional
+from damlisk.detectors.validation.missing_amount import MissingAmountCheck
+from damlisk.detectors.validation.missing_ensure import MissingEnsure
+from damlisk.detectors.validation.nonconsuming_create import NonconsumingCreate
+from damlisk.detectors.validation.partial_function import PartialFunction
+from damlisk.detectors.validation.time_argument import TimeFromArgument
+from damlisk.detectors.validation.time_equality import TimeEquality
+from damlisk.detectors.validation.unchecked_fetch import UncheckedFetch
+from damlisk.detectors.validation.unconsumed_input import UnconsumedInput
+
+DETECTORS: tuple[type[AbstractDetector], ...] = (
+    BooleanConstant,
+    BooleanEqual,
+    ControllerFromArgument,
+    MissingAmountCheck,
+    UnusedTemplateField,
+    HardcodedParty,
+    PartialFunction,
+    DiscardedUpdate,
+    NonconsumingCreate,
+    UncheckedFetch,
+    TimeFromArgument,
+    AmountTolerance,
+    DivideBeforeMultiply,
+    UnconsumedInput,
+    AbortingChoice,
+    HashConcatCollision,
+    TimeEquality,
+    TautologicalCompare,
+    UnprotectedArchive,
+    MissingEnsure,
+    OverDisclosure,
+    UnsafePrimitive,
+    DebugTrace,
+    StuckAsset,
+    SdkVersion,
+    Rtlo,
+    DelegatedLeak,
+    UntrustedInterface,
+    ArbitraryParty,
+    TimeDependence,
+    WeakRandomness,
+    LedgerOpInLoop,
+    UnboundedInputLoop,
+    StaleFetch,
+    IgnoredOptional,
+)

damlisk/detectors/assets/arbitrary_party.py

@@ -0,0 +1,72 @@
+from damlisk.detectors.abstract_detector import AbstractDetector
+from damlisk.detectors.assets.stuck_asset import HOLDERS
+from damlisk.lf.flow import THIS, WHOLE, Assign, FieldFlow
+from damlisk.lf.index import ChoiceDecl, PackageIndex
+from damlisk.output.finding import Confidence, Finding, Impact
+
+
+def granted(
+    index: PackageIndex, flow: FieldFlow, decl: ChoiceDecl, signers: set[str]
+) -> list[Assign]:
+    """Return the assets a choice builds whose owner comes from an unchecked argument.
+
+    A controller who holds or signs the current contract already has the authority to move
+    it, so such a choice is not reported. Neither is an owner taken from the controller, a
+    compared argument or a fetched contract, nor a choice whose argument controller is
+    compared. A controller passed into an exercise pays from their own assets, so that
+    choice is skipped too.
+    """
+    choice = decl.choice
+    if decl.iface:
+        return []
+    ctrl = flow.fields(choice.controllers, decl.param)
+    if ctrl & (HOLDERS | signers):
+        return []
+    arg = choice.arg_binder.var
+    arg_ctrl = flow.fields(choice.controllers, arg)
+    usage = flow.fetch_usage(choice.update, arg, decl.param)
+    if arg_ctrl & (usage.compared | usage.called):
+        return []
+    if ctrl & flow.called(choice.update, decl.param):
+        return []
+    skipped = WHOLE | {THIS} | usage.compared | usage.fetched | arg_ctrl
+    found = []
+    for item in usage.assigned:
+        asset = item.template in index.templates and item.field in HOLDERS
+        if asset and item.source not in skipped:
+            found.append(item)
+    return sorted(found, key=lambda item: (item.source, item.field))
+
+
+class ArbitraryParty(AbstractDetector):
+    ARGUMENT = "value-to-arbitrary-party"
+    HELP = "Asset created for an owner from the choice argument by a non-owner controller"
+    IMPACT = Impact.HIGH
+    CONFIDENCE = Confidence.MEDIUM
+    WIKI_TITLE = "Value to arbitrary party"
+    WIKI_DESCRIPTION = (
+        "A choice creates an asset, a template with an `owner` or `holder` field, and sets that "
+        "field from the choice argument. Its controller neither holds nor signs the current "
+        "contract, so a party with no claim on the asset decides who receives it."
+    )
+    WIKI_EXPLOIT_SCENARIO = (
+        "`choice Transfer with requester; newOwner controller requester do create this with "
+        "owner = newOwner`: anyone who can see the asset moves it to any party."
+    )
+    WIKI_RECOMMENDATION = (
+        "Make the current owner or a signatory the controller, or check the new owner against "
+        "parties stored on the contract."
+    )
+
+    def _detect(self) -> list[Finding]:
+        """Report each choice that sends an asset to an owner taken from its argument."""
+        flow = FieldFlow(self.index.values)
+        signers = self.signers(flow)
+        findings = []
+        decls = self.index.choices()
+        for decl in decls:
+            items = granted(self.index, flow, decl, signers.get(decl.parent, set()))
+            for item in items:
+                message = f"{decl.owner}: argument `{item.source}` sets `{item.field}` of the asset"
+                findings.append(self.finding(decl.owner, message, decl.loc))
+        return findings

damlisk/detectors/assets/stuck_asset.py

@@ -0,0 +1,68 @@
+from damlisk.detectors.abstract_detector import AbstractDetector
+from damlisk.lf.flow import FieldFlow
+from damlisk.lf.index import ChoiceDecl, TemplateDecl
+from damlisk.output.finding import Confidence, Finding, Impact
+
+HOLDERS = frozenset({"owner", "holder"})
+
+
+def holder_fields(decl: TemplateDecl) -> set[str]:
+    """Return the `owner` and `holder` fields of a template."""
+    names = {field.field for field in decl.fields}
+    return names & HOLDERS
+
+
+def stuck(flow: FieldFlow, decl: TemplateDecl, choices: list[ChoiceDecl]) -> list[str]:
+    """Return the holder fields of a template when none controls a consuming choice.
+
+    `Archive` does not count: it is controlled by all signatories, not by the holder.
+    """
+    holders = holder_fields(decl)
+    if not holders:
+        return []
+    for choice in choices:
+        ch = choice.choice
+        if ch.consuming and ch.name != "Archive":
+            ctrl = flow.fields(ch.controllers, choice.param)
+            if ctrl & holders:
+                return []
+    return sorted(holders)
+
+
+class StuckAsset(AbstractDetector):
+    ARGUMENT = "stuck-asset"
+    HELP = "Asset its owner cannot move: no owner-controlled consuming choice"
+    IMPACT = Impact.MEDIUM
+    CONFIDENCE = Confidence.MEDIUM
+    WIKI_TITLE = "Stuck asset"
+    WIKI_DESCRIPTION = (
+        "A template with an `owner` or `holder` field has no consuming choice, other than "
+        "`Archive`, that this party controls. The holder cannot transfer, split or redeem the "
+        "asset alone; only other parties can move it."
+    )
+    WIKI_EXPLOIT_SCENARIO = (
+        "`template Holding with issuer; owner; amount` whose only choice is `Freeze` controlled "
+        "by the issuer: the owner holds the amount but can never transfer it, and the issuer "
+        "decides when, or whether, it moves."
+    )
+    WIKI_RECOMMENDATION = (
+        "Give the holder a consuming choice (`Transfer`, `Redeem`, `Split`) or document the "
+        "contract, often a rules contract, through which the holder moves the asset."
+    )
+
+    def _detect(self) -> list[Finding]:
+        """Report each template whose holder controls no consuming choice except `Archive`."""
+        flow = FieldFlow(self.index.values)
+        by_parent: dict[str, list[ChoiceDecl]] = {}
+        decls = self.index.choices()
+        for decl in decls:
+            by_parent.setdefault(decl.parent, []).append(decl)
+        findings = []
+        tmpls = self.index.template_decls()
+        for tmpl in tmpls:
+            fields = stuck(flow, tmpl, by_parent.get(tmpl.owner, []))
+            if fields:
+                names = ", ".join(f"`{name}`" for name in fields)
+                message = f"{tmpl.owner}: {names} controls no consuming choice except Archive"
+                findings.append(self.finding(tmpl.owner, message, tmpl.loc))
+        return findings

damlisk/detectors/authorization/controller_arg.py

@@ -0,0 +1,50 @@
+from damlisk.detectors.abstract_detector import AbstractDetector
+from damlisk.lf.flow import FieldFlow
+from damlisk.lf.index import ChoiceDecl
+from damlisk.output.finding import Confidence, Finding, Impact
+
+
+def unchecked_fields(flow: FieldFlow, decl: ChoiceDecl) -> list[str]:
+    choice = decl.choice
+    if decl.iface or not choice.consuming:
+        return []
+    party_ctrl = flow.fields(choice.controllers, decl.param)
+    if party_ctrl:
+        return []
+    arg = choice.arg_binder.var
+    arg_ctrl = flow.fields(choice.controllers, arg)
+    checked = flow.compared(choice.update, arg)
+    return sorted(arg_ctrl - checked)
+
+
+class ControllerFromArgument(AbstractDetector):
+    ARGUMENT = "controller-from-argument"
+    HELP = "Consuming choice controlled only by an unchecked choice argument"
+    IMPACT = Impact.HIGH
+    CONFIDENCE = Confidence.MEDIUM
+    WIKI_TITLE = "Controller taken from the choice argument"
+    WIKI_DESCRIPTION = (
+        "A consuming template choice whose controllers come only from choice argument fields, "
+        "and whose body never compares those fields: any party that can see the contract can "
+        "exercise it and archive or move the contract."
+    )
+    WIKI_EXPLOIT_SCENARIO = (
+        "`choice Transfer with requester : Party; newOwner : Party controller requester` lets an "
+        "observer pass itself as `requester` and transfer the asset to itself."
+    )
+    WIKI_RECOMMENDATION = (
+        "Control the choice by a contract party (`controller owner`), add a contract party as a "
+        'co-controller, or check the argument (`assertMsg "owner only" (requester == owner)`).'
+    )
+
+    def _detect(self) -> list[Finding]:
+        flow = FieldFlow(self.index.values)
+        findings = []
+        choices = self.index.choices()
+        for decl in choices:
+            fields = unchecked_fields(flow, decl)
+            if fields:
+                names = ", ".join(f"`{name}`" for name in fields)
+                message = f"{decl.owner}: controlled by unchecked argument {names}"
+                findings.append(self.finding(decl.owner, message, decl.loc))
+        return findings

damlisk/detectors/authorization/delegated_leak.py

@@ -0,0 +1,129 @@
+from dazl.damlast import daml_lf_1 as lf
+
+from damlisk.detectors.abstract_detector import AbstractDetector
+from damlisk.lf.builtins import is_int, is_numeric, is_party
+from damlisk.lf.flow import WHOLE, FieldFlow
+from damlisk.lf.index import ChoiceDecl, PackageIndex, TemplateDecl
+from damlisk.output.finding import Confidence, Finding, Impact
+
+WRAPPERS = (lf.PrimType.LIST, lf.PrimType.OPTIONAL)
+
+
+def party_or_amount(typ: lf.Type) -> bool:
+    """Return True for `Party`, `Numeric` and `Int`, also inside a list or `Optional`."""
+    if typ.prim is not None and typ.prim.prim in WRAPPERS and typ.prim.args:
+        typ = typ.prim.args[0]
+    return is_party(typ) or is_numeric(typ) or is_int(typ)
+
+
+def ensured(flow: FieldFlow, tmpl: TemplateDecl) -> set[str]:
+    """Return the fields of a template that its `ensure` clause reads."""
+    precond = tmpl.template.precond
+    if precond is None:
+        return set()
+    used = flow.fields(precond, tmpl.template.param)
+    return used - WHOLE
+
+
+class LeakCheck:
+    def __init__(self, index: PackageIndex) -> None:
+        """Collect the signatory and `ensure` fields of every template in the main package."""
+        self.index = index
+        self.flow = FieldFlow(index.values)
+        self.signers: dict[str, set[str]] = {}
+        self.ensures: dict[str, set[str]] = {}
+        tmpls = index.template_decls()
+        for tmpl in tmpls:
+            self.ensures[tmpl.owner] = ensured(self.flow, tmpl)
+            sigs = tmpl.template.signatories
+            if sigs is not None:
+                self.signers[tmpl.owner] = self.flow.fields(sigs, tmpl.template.param)
+
+    def risky(self, decl: ChoiceDecl, created: set[str]) -> set[str]:
+        """Return the party and amount argument fields not read by a created template's `ensure`."""
+        names = set()
+        fields = self.index.arg_fields(decl)
+        for field in fields:
+            if party_or_amount(field.type):
+                names.add(field.field)
+        for owner in created:
+            names -= self.ensures.get(owner, set())
+        return names
+
+    def cosigned(self, created: set[str], parties: set[str]) -> bool:
+        """Return True if a controller field is also a signatory field of a created template."""
+        for owner in created:
+            if self.signers.get(owner, set()) & parties:
+                return True
+        return False
+
+    def leaked(self, decl: ChoiceDecl) -> list[str]:
+        """Return the parties and amounts a non-signatory controller puts into a signed action.
+
+        The action counts as signed when it also carries contract data other than the
+        controller's own fields: a signatory party or a contract id the signatories stored.
+        Creates the controller signs too, and exercises the controller is passed into, act
+        on the controller's own behalf and are skipped. Arguments the choice compares or
+        bounds, and arguments that name the controller, are not reported.
+        """
+        choice = decl.choice
+        if decl.iface:
+            return []
+        flow = self.flow
+        update = choice.update
+        ctrl = flow.fields(choice.controllers, decl.param)
+        if ctrl & self.signers.get(decl.parent, set()):
+            return []
+        this_made = flow.created(update, decl.param)
+        this_call = flow.called(update, decl.param)
+        if not (this_made | this_call) - ctrl:
+            return []
+        arg = choice.arg_binder.var
+        arg_ctrl = flow.fields(choice.controllers, arg)
+        created = self.index.created_templates(update)
+        found: set[str] = set()
+        if not self.cosigned(created, ctrl | arg_ctrl):
+            found |= flow.created(update, arg)
+        arg_call = flow.called(update, arg)
+        if not (this_call & ctrl or arg_call & arg_ctrl):
+            found |= arg_call
+        checked = flow.compared(update, arg) | flow.ordered(update, arg)
+        risky = self.risky(decl, created)
+        return sorted((found & risky) - checked - arg_ctrl)
+
+
+class DelegatedLeak(AbstractDetector):
+    ARGUMENT = "delegated-authority-leak"
+    HELP = "Non-signatory controller passes parties or amounts into a create or exercise"
+    IMPACT = Impact.HIGH
+    CONFIDENCE = Confidence.MEDIUM
+    WIKI_TITLE = "Delegated authority leak"
+    WIKI_DESCRIPTION = (
+        "A choice runs with the authority of the contract signatories, but its controller is "
+        "not one of them. When the choice creates or exercises with parties or amounts taken "
+        "from the choice argument, the controller makes the signatories sign whatever "
+        "contract or exercise they choose."
+    )
+    WIKI_EXPLOIT_SCENARIO = (
+        "`signatory issuer; observer holder; nonconsuming choice Mint with value controller "
+        "holder do create Token with issuer; owner = holder; amount = value`: the holder mints "
+        "tokens of any amount, each signed by the issuer."
+    )
+    WIKI_RECOMMENDATION = (
+        "Take parties and amounts from contract fields the signatories agreed to, bound and "
+        "check every argument before it is used (`assertMsg`, `ensure`), or make a signatory "
+        "the controller."
+    )
+
+    def _detect(self) -> list[Finding]:
+        """Report each non-signatory choice that sends parties or amounts into a signed action."""
+        check = LeakCheck(self.index)
+        findings = []
+        decls = self.index.choices()
+        for decl in decls:
+            fields = check.leaked(decl)
+            if fields:
+                names = ", ".join(f"`{name}`" for name in fields)
+                message = f"{decl.owner}: argument {names} used with the signatories' authority"
+                findings.append(self.finding(decl.owner, message, decl.loc))
+        return findings