Labels: bug, checks-crate
Crate: checks
Description
crates/checks/src/transfer.rs's GuardScan (lines ~56-116) sets found = true the moment it sees any ExprBinary comparing the from/to parameters, with no verification that the comparison appears inside an if/assert!/early-return that actually prevents the transfer:
if (left_is_from && right_is_to) || (left_is_to && right_is_from) {
self.found = true;
return;
}A no-op comparison assigned to an unused binding is enough to suppress the finding even though the actual transfer proceeds completely unguarded afterward:
pub fn transfer(env: Env, from: Address, to: Address, amount: i128) {
from.require_auth();
let _unused = from == to; // never acted on
do_actual_transfer(&env, &from, &to, amount); // self-transfer proceeds unguarded
}This is a distinct, more specific defect than the already-open #297 (severity mismatch).
Acceptance Criteria
Difficulty: intermediate
Labels: bug, checks-crate
Crate: checks
Description
crates/checks/src/transfer.rs'sGuardScan(lines ~56-116) setsfound = truethe moment it sees anyExprBinarycomparing thefrom/toparameters, with no verification that the comparison appears inside anif/assert!/early-return that actually prevents the transfer:A no-op comparison assigned to an unused binding is enough to suppress the finding even though the actual transfer proceeds completely unguarded afterward:
This is a distinct, more specific defect than the already-open #297 (severity mismatch).
Acceptance Criteria
from/tocomparison to be the condition of anif/assert!/require!(or similar control-flow-affecting construct) that can prevent the transfer, not merely present anywhere in the function.Difficulty: intermediate