cairo-vulnerability-scanner

Run pattern-based analysis over .cairo files checking for six known StarkNet vulnerability classes, then confirm findings with the Caracal static analyzer using commands like caracal detect src/. Each finding includes severity, location, and remediation code.

Key risks include felt252 arithmetic overflow and underflow, unchecked from_address in #[l1_handler] functions, L1-to-L2 address conversion failures, missing message cancellation, and signature replay without nonce or domain separation.

Yes, Caracal is Trail of Bits' static analyzer for Cairo and can be installed with pip install caracal. It supports detectors such as unchecked-felt252-arithmetic, unchecked-l1-handler-from, and missing-nonce-validation.

felt252 wraps modulo the StarkNet prime, so subtraction can underflow to a huge value and addition can overflow past the field prime. Use u128 or u256 for balances, which have built-in overflow protection, or add explicit bounds checks.

Automated pattern matching cannot verify business logic, economic incentives, or complex cross-contract interactions. Combine scanning with manual review, unit tests for each vulnerability scenario, and integration tests covering full L1-L2 roundtrip flows.