feat(security): add state-bound invariant & path-symmetry rules#30
Merged
Conversation
New vulnerability category #3 (State-Bound Invariants & Path Symmetry) covering the failure mode where a guard exists on one entrypoint but not on sibling entrypoints that mutate the same storage. Documented with the VeBetterDAO Navigator over-delegation incident as the worked example: a transfer-lock check stops outflow but does not bound how high the locked amount itself can be inscribed, so two write paths (delegate / increaseDelegation) without balance guards let users inscribe locked = 2x their balance. Procedure additions: - Pass 0 (Map paths and invariants) before existing 1/2/3. - State-Bound Invariants checklist. - Six new Security Review Questions (path-symmetry, direction, sequencing, boundaries, cross-contract assumptions, mid-action state transitions). - Adversarial Path Coverage in Tests section. SKILL.md trigger keywords extended (invariant, balance check, path symmetry, adversarial, edge cases) so the skill loads on these prompts. Renumbered existing categories #3-#9 to #4-#10 to make room. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Skill Security AuditScanned 75 file(s) — found 14 issue(s) across 5 file(s). 🔵 LOW (14)
|
Skill Size Report
Large reference files (>5.0K tok)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new vulnerability category and audit discipline to the smart-contract-development skill, motivated by the VeBetterDAO Navigator over-delegation incident (May 2026) where a user inscribed
delegated = 2× balanceover two transactions because the contract relied on a transfer lock to enforce an invariant the lock didn't actually bound.references/security.md, with the navigator incident as the worked example and a table of common shapes (delegation/balance, allocations/shares, borrow/collateral, stake/approval).Why
Path-symmetry gaps (a guard on one entrypoint but missing on sibling entrypoints mutating the same storage) are the most common high-severity finding pattern. The new rules force the reviewer/AI to enumerate inscription paths AND resource-modification paths for every invariant, instead of trusting "enforced elsewhere" comments without verifying the direction of the elsewhere's check.
Test plan
references/security.mdend-to-end; numbering 1–10 is consistentunlockedBalancecheck)🤖 Generated with Claude Code