substrate-vulnerability-scanner

Scan each pallet's dispatchable functions for the seven critical patterns: unchecked arithmetic, unwrap/expect panics, fixed weights on variable-cost operations, storage writes before validation, weak unsigned transaction validation, insecure randomness, and ensure_signed on privileged calls. Use ripgrep searches and benchmarking to confirm findings.

The critical ones are arithmetic overflow from direct operators wrapping in release mode, panics from unwrap or unchecked indexing that halt block production, incorrect weights enabling DoS spam, and bad origin checks letting any signed user execute privileged operations.

Yes, Substrate v0.9.25 introduced a transactional storage layer that automatically rolls back writes when a dispatch fails. On earlier versions, you must validate before writing or apply the manual #[transactional] attribute to prevent partial state changes.

RandomnessCollectiveFlip is vulnerable to validator collusion and manipulation, making it unsuitable for production. Use BABE randomness via pallet_babe::RandomnessFromOneEpochAgo and call random(subject) rather than random_seed() for per-call uniqueness.

Use ensure_root or custom origins like ForceOrigin for privileged operations such as emergency pauses, fee updates, or force transfers. Reserve ensure_signed for regular user-level operations, and remove sudo privileges before production launch.