cairo-vulnerability-scanner

The Cairo/StarkNet Vulnerability Scanner is a specialized security analysis skill designed for developers and auditors working within the StarkNet ecosystem. It performs a systematic review of Cairo smart contracts to identify platform-specific security flaws that are common in cross-layer blockchain applications. By leveraging static analysis tools like Caracal and manual code review patterns, this skill helps teams secure their protocols before deployment, ensuring that core logic involving felt252 arithmetic, L1-L2 bridge communication, and signature verification adheres to security best practices.

• Performs automated vulnerability detection for 6 critical patterns, including unchecked arithmetic, storage collisions, missing access controls, and improper felt252 boundaries.

• Validates cross-layer interaction logic, ensuring L1 handler functions correctly verify the from_address and implement robust cross-chain message handling.

• Checks for cryptographic security flaws such as signature replay vulnerabilities and improper nonce management in external contract calls.

• Provides actionable remediation guidance, including specific code-level fixes and security unit testing strategies for Cairo 1.0+ codebases.

• Integrates with the Cairo development lifecycle by analyzing standard Scarb.toml project structures and contract artifacts located in src/ directories.

• Use this skill during pre-launch security assessments to uncover vulnerabilities in complex L1-L2 bridge architectures.

• Requires local access to the codebase containing .cairo files. The skill may recommend installing supporting tooling such as the Caracal static analyzer.

• Expected output includes a structured vulnerability report identifying the file, location, description of the flaw, an attack scenario, and a recommended code patch.

• Effective for auditing components like #[l1_handler], #[external(v0)], and storage-heavy contracts relying on felt252, u128, or u256 types.

• Focuses on common StarkNet attack vectors like missing get_caller_address() validation and unsafe address conversion from L1.