[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FJHMQQYJ3RQEWR4DPMSAMQ":3,"skill-same:01M6FJHMQQYJ3RQEWR4DPMSAMQ":49},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":24,"frontMatter":25,"refName":26,"commitSha":27,"skillDirectory":28,"forksCount":29,"repositoryHtmlUrl":30,"repositoryHomepageUrl":31,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M6FJHMQQYJ3RQEWR4DPMSAMQ","cairo-vulnerability-scanner",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fcairo-vulnerability-scanner\u002FSKILL.md",[],[18,19,20,21],"vulnerability","vulnerability scanner","scanner","cairo vulnerability scanner","2026-11-10 10:12:30",false,"# Cairo\u002FStarkNet Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan Cairo smart contracts on StarkNet for platform-specific security vulnerabilities related to arithmetic, cross-layer messaging, and cryptographic operations. This skill encodes 6 critical vulnerability patterns unique to Cairo\u002FStarkNet ecosystem.\n\n## 2. When to Use This Skill\n\n- Auditing StarkNet smart contracts (Cairo)\n- Reviewing L1-L2 bridge implementations\n- Pre-launch security assessment of StarkNet applications\n- Validating cross-layer message handling\n- Reviewing signature verification logic\n- Assessing L1 handler functions\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **Cairo files**: `.cairo`\n\n### Language\u002FFramework Markers\n```rust\n\u002F\u002F Cairo contract indicators\n#[contract]\nmod MyContract {\n    use starknet::ContractAddress;\n\n    #[storage]\n    struct Storage {\n        balance: LegacyMap\u003CContractAddress, felt252>,\n    }\n\n    #[external(v0)]\n    fn transfer(ref self: ContractState, to: ContractAddress, amount: felt252) {\n        \u002F\u002F Contract logic\n    }\n\n    #[l1_handler]\n    fn handle_deposit(ref self: ContractState, from_address: felt252, amount: u256) {\n        \u002F\u002F L1 message handler\n    }\n}\n\n\u002F\u002F Common patterns\nfelt252, u128, u256\nContractAddress, EthAddress\n#[external(v0)], #[l1_handler], #[constructor]\nget_caller_address(), get_contract_address()\nsend_message_to_l1_syscall\n```\n\n### Project Structure\n- `src\u002Fcontract.cairo` - Main contract implementation\n- `src\u002Flib.cairo` - Library modules\n- `tests\u002F` - Contract tests\n- `Scarb.toml` - Cairo project configuration\n\n### Tool Support\n- **Caracal**: Trail of Bits static analyzer for Cairo\n- Installation: `pip install caracal`\n- Usage: `caracal detect src\u002F`\n- **cairo-test**: Built-in testing framework\n- **Starknet Foundry**: Testing and development toolkit\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for Cairo files\n2. **Analyze each contract** for the 6 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check L1-L2 interactions** for messaging vulnerabilities\n\n---\n\n## 5. Example Output\n\nWhen vulnerabilities are found, you'll get a report like this:\n\n```\n=== CAIRO\u002FSTARKNET VULNERABILITY SCAN RESULTS ===\n\n\n---\n\n## 5. Vulnerability Patterns (6 Patterns)\n\nI check for 6 critical vulnerability patterns unique to Cairo\u002FStarknet. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Unchecked Arithmetic** ⚠️ CRITICAL - Integer overflow\u002Funderflow in felt252\n2. **Storage Collision** ⚠️ CRITICAL - Conflicting storage variable hashes\n3. **Missing Access Control** ⚠️ CRITICAL - No caller validation on sensitive functions\n4. **Improper Felt252 Boundaries** ⚠️ HIGH - Not validating felt252 range\n5. **Unvalidated Contract Address** ⚠️ HIGH - Using untrusted contract addresses\n6. **Missing Caller Validation** ⚠️ CRITICAL - No get_caller_address() checks\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify Cairo language and StarkNet framework\n2. Check Cairo version (Cairo 1.0+ vs legacy Cairo 0)\n3. Locate contract files (`src\u002F*.cairo`)\n4. Identify L1-L2 bridge contracts (if applicable)\n\n### Step 2: Arithmetic Safety Sweep\n```bash\n# Find felt252 usage in arithmetic\nrg \"felt252\" src\u002F | rg \"[-+*\u002F]\"\n\n# Find balance\u002Famount storage using felt252\nrg \"felt252\" src\u002F | rg \"balance|amount|total|supply\"\n\n# Should prefer u128, u256 instead\n```\n\n### Step 3: L1 Handler Analysis\nFor each `#[l1_handler]` function:\n- [ ] Validates `from_address` parameter\n- [ ] Checks address != zero\n- [ ] Has proper access control\n- [ ] Emits events for monitoring\n\n### Step 4: Signature Verification Review\nFor signature-based functions:\n- [ ] Includes nonce tracking\n- [ ] Nonce incremented after use\n- [ ] Domain separator includes chain ID and contract address\n- [ ] Cannot replay signatures\n\n### Step 5: L1-L2 Bridge Audit\nIf contract includes bridge functionality:\n- [ ] L1 validates address \u003C STARKNET_FIELD_PRIME\n- [ ] L1 implements message cancellation\n- [ ] L2 validates from_address in handlers\n- [ ] Symmetric access controls L1 ↔ L2\n- [ ] Test full roundtrip flows\n\n### Step 6: Static Analysis with Caracal\n```bash\n# Run Caracal detectors\ncaracal detect src\u002F\n\n# Specific detectors\ncaracal detect src\u002F --detectors unchecked-felt252-arithmetic\ncaracal detect src\u002F --detectors unchecked-l1-handler-from\ncaracal detect src\u002F --detectors missing-nonce-validation\n```\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Unchecked from_address in L1 Handler\n\n**Location**: `src\u002Fbridge.cairo:145-155` (handle_deposit function)\n\n**Description**:\nThe `handle_deposit` L1 handler function does not validate the `from_address` parameter. Any L1 contract can send messages to this function and mint tokens for arbitrary users, bypassing the intended L1 bridge access controls.\n\n**Vulnerable Code**:\n```rust\n\u002F\u002F bridge.cairo, line 145\n#[l1_handler]\nfn handle_deposit(\n    ref self: ContractState,\n    from_address: felt252,  \u002F\u002F Not validated!\n    user: ContractAddress,\n    amount: u256\n) {\n    let current_balance = self.balances.read(user);\n    self.balances.write(user, current_balance + amount);\n}\n```\n\n**Attack Scenario**:\n1. Attacker deploys malicious L1 contract\n2. Malicious contract calls `starknetCore.sendMessageToL2(l2Contract, selector, [attacker_address, 1000000])`\n3. L2 handler processes message without checking sender\n4. Attacker receives 1,000,000 tokens without depositing any funds\n5. Protocol suffers infinite mint vulnerability\n\n**Recommendation**:\nValidate `from_address` against authorized L1 bridge:\n```rust\n#[l1_handler]\nfn handle_deposit(\n    ref self: ContractState,\n    from_address: felt252,\n    user: ContractAddress,\n    amount: u256\n) {\n    \u002F\u002F Validate L1 sender\n    let authorized_l1_bridge = self.l1_bridge_address.read();\n    assert(from_address == authorized_l1_bridge, 'Unauthorized L1 sender');\n\n    let current_balance = self.balances.read(user);\n    self.balances.write(user, current_balance + amount);\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcairo\u002Funchecked_l1_handler_from\n- Caracal detector: `unchecked-l1-handler-from`\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Unchecked from_address in L1 handlers (infinite mint)\n- L1-L2 address conversion issues (funds to zero address)\n\n### High (Fix Before Deployment)\n- Felt252 arithmetic overflow\u002Funderflow (balance manipulation)\n- Missing signature replay protection (replay attacks)\n- L1-L2 message failure without cancellation (locked funds)\n\n### Medium (Address in Audit)\n- Overconstrained L1-L2 interactions (trapped funds)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n\n    #[test]\n    fn test_felt252_overflow() {\n        \u002F\u002F Test arithmetic edge cases\n    }\n\n    #[test]\n    #[should_panic]\n    fn test_unauthorized_l1_handler() {\n        \u002F\u002F Wrong from_address should fail\n    }\n\n    #[test]\n    fn test_signature_replay_protection() {\n        \u002F\u002F Same signature twice should fail\n    }\n}\n```\n\n### Integration Tests (with L1)\n```rust\n\u002F\u002F Test full L1-L2 flow\n#[test]\nfn test_deposit_withdraw_roundtrip() {\n    \u002F\u002F 1. Deposit on L1\n    \u002F\u002F 2. Wait for L2 processing\n    \u002F\u002F 3. Verify L2 balance\n    \u002F\u002F 4. Withdraw to L1\n    \u002F\u002F 5. Verify L1 balance restored\n}\n```\n\n### Caracal CI Integration\n```yaml\n# .github\u002Fworkflows\u002Fsecurity.yml\n- name: Run Caracal\n  run: |\n    pip install caracal\n    caracal detect src\u002F --fail-on high,critical\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcairo\u002F`\n- **Caracal**: https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fcaracal\n- **Cairo Documentation**: https:\u002F\u002Fbook.cairo-lang.org\u002F\n- **StarkNet Documentation**: https:\u002F\u002Fdocs.starknet.io\u002F\n- **OpenZeppelin Cairo Contracts**: https:\u002F\u002Fgithub.com\u002FOpenZeppelin\u002Fcairo-contracts\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing Cairo\u002FStarkNet audit:\n\n**Arithmetic Safety (HIGH)**:\n- [ ] No felt252 used for balances\u002Famounts (use u128\u002Fu256)\n- [ ] OR felt252 arithmetic has explicit bounds checking\n- [ ] Overflow\u002Funderflow scenarios tested\n\n**L1 Handler Security (CRITICAL)**:\n- [ ] ALL `#[l1_handler]` functions validate `from_address`\n- [ ] from_address compared against stored L1 contract address\n- [ ] Cannot bypass by deploying alternate L1 contract\n\n**L1-L2 Messaging (HIGH)**:\n- [ ] L1 bridge validates addresses \u003C STARKNET_FIELD_PRIME\n- [ ] L1 bridge implements message cancellation\n- [ ] L2 handlers check from_address\n- [ ] Symmetric validation rules L1 ↔ L2\n- [ ] Full roundtrip flows tested\n\n**Signature Security (HIGH)**:\n- [ ] Signatures include nonce tracking\n- [ ] Nonce incremented after each use\n- [ ] Domain separator includes chain ID and contract address\n- [ ] Signature replay tested and prevented\n- [ ] Cross-chain replay prevented\n\n**Tool Usage**:\n- [ ] Caracal scan completed with no critical findings\n- [ ] Unit tests cover all vulnerability scenarios\n- [ ] Integration tests verify L1-L2 flows\n- [ ] Testnet deployment tested before mainnet\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Ftrailofbits\u002Fskills\u002Fcairo-vulnerability-scanner",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill cairo-vulnerability-scanner",{"tool":41,"command":42},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill cairo-vulnerability-scanner",{"tool":44,"command":45},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill cairo-vulnerability-scanner","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fcairo-vulnerability-scanner\u002FSKILL.md",true,[],[50,64,74,83,89,96],{"skillNo":51,"name":52,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":60,"publishedAt":22},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[55],{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[61,62,63],"model","model hierarchy","model hierarchy skill",{"skillNo":65,"name":66,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":70,"publishedAt":22},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[69],{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},[71,72,73],"MCP","zoom","zoom mcp",{"skillNo":75,"name":76,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":22},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[80,81,82,72],"sdk","zoom apps sdk","apps",{"skillNo":84,"name":85,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":22},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[85],{"skillNo":90,"name":91,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":95,"publishedAt":22},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[94],{"categoryNo":56,"categoryName":57,"taxonomyType":58,"taxonomyTypeDesc":59},[91],{"skillNo":97,"name":98,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":22},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[98]]