diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 488707b..145c676 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -15,7 +15,13 @@ jobs: with: targets: wasm32-unknown-unknown - uses: Swatinem/rust-cache@v2 + - name: Build Contracts + run: cargo build --target wasm32-unknown-unknown --release - name: Test sep41-token run: cargo test -p sep41-token - name: Test upgradeable run: cargo test -p upgradeable + - name: Run Security Audit + run: ./scripts/security_audit.sh + + diff --git a/scripts/security_audit.sh b/scripts/security_audit.sh new file mode 100755 index 0000000..3aa390c --- /dev/null +++ b/scripts/security_audit.sh @@ -0,0 +1,48 @@ +#!/bin/bash +set -e + +echo "Starting Soroban Wasm Security Audit..." + +if ! command -v find &> /dev/null; then + echo "Error: 'find' command is required." + exit 1 +fi + +WASM_COUNT=$(find target -name "*.wasm" 2>/dev/null | wc -l || echo 0) +if [ "$WASM_COUNT" -eq 0 ]; then + WASM_COUNT=$(find . -name "*.wasm" 2>/dev/null | wc -l || echo 0) +fi + +if [ "$WASM_COUNT" -eq 0 ]; then + echo "No Wasm files found. Please ensure the project is built before running the audit." + exit 0 +fi + +echo "Found Wasm files:" +find target -name "*.wasm" 2>/dev/null || find . -name "*.wasm" 2>/dev/null + +if command -v soroban-analyzer &> /dev/null; then + echo "Running soroban-analyzer..." + # SC2044 avoidance by using while read -r + (find target -name "*.wasm" 2>/dev/null || find . -name "*.wasm" 2>/dev/null) | while read -r file; do + if [ -n "$file" ]; then + echo "Analyzing $file..." + soroban-analyzer "$file" + fi + done +else + echo "Warning: 'soroban-analyzer' is not installed or available in PATH." + echo "Skipping dedicated Wasm static analysis." +fi + +echo "Checking for suspicious patterns in Rust source files..." + +if grep -rn "unsafe {" src/ contracts/ > /dev/null 2>&1; then + echo "Warning: 'unsafe' blocks found in source files. Please review for potential vulnerabilities." +fi + +if grep -rn "env.panic" src/ contracts/ > /dev/null 2>&1; then + echo "Warning: 'env.panic' usages found. Review panic conditions to prevent DoS or reentrancy issues." +fi + +echo "Security audit completed successfully." diff --git a/src/bridge/lib.rs b/src/bridge/src/lib.rs similarity index 100% rename from src/bridge/lib.rs rename to src/bridge/src/lib.rs diff --git a/src/liquidation/lib.rs b/src/liquidation/src/lib.rs similarity index 100% rename from src/liquidation/lib.rs rename to src/liquidation/src/lib.rs