Skip to content

missing-zero-address-check's SENSITIVE_NAMES requires an exact function-name match — no prefix/substring matching #370

Description

@unrealtim-tech

Labels: enhancement, checks-crate, good first issue
Crate: checks

Description
crates/checks/src/zero_address.rs (lines ~16-25, ~106-109) matches sensitive function names with SENSITIVE_NAMES.contains(&fn_name.as_str()) — an exact string match against a fixed list (set_owner, set_admin, initialize, init, transfer_ownership, update_admin, set_manager, set_operator). Common real-world variants like set_owner_v2, initialize_admin, try_set_admin, or set_operator_address never match and are silently skipped, even when they accept an unguarded Address and write it to storage.

Closed issue #30 already established prefix-matching precedent for the (different) admin-detection check; this check never received the equivalent treatment.

Acceptance Criteria

  • Match function names by prefix/substring against SENSITIVE_NAMES (or otherwise fuzzy-match), consistent with unprotected-admin's approach.
  • Add tests for at least one prefixed/suffixed variant of a sensitive name.

Difficulty: beginner

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions