Security tools
| Project | Language | Description |
|---|---|---|
| solray | Rust | Solidity source code explorer for manual review |
| ripfuzz | Rust | High-throughput, coverage-guided, mutational fuzzer for Solidity smart contracts |
| ripfuzz‑std | Solidity | ripfuzz standard library |
| cmdtest | Zig | Library to test any CLI |
Latest contributions
| Project | Language | Severity | Finding |
|---|---|---|---|
| Malda | Rust | Medium | get_proof_data_zkvm_input panics if chain_id=1 and l1_inclusion=true ↗ |
| DODO | Solidity | High | Invalid Check in GatewayCrossChain.claimRefund Allows Anyone To Claim Refunds Intended for Non-EVM Addresses ↗ |
| DODO | Solidity | High | Missing params.toToken == decoded.targetZRC20 Validation in GatewayCrossChain.onCall Allows Anyone to Drain Arbitrary decoded.targetZRC20 from GatewayCrossChain ↗ |
| DODO | Solidity | High | Empty swapData in GatewayTransferNative.onCall Bypasses Swap and Allows Draining of Arbitrary targetZRC20 ↗ |
| DODO | Solidity | High | GatewayCrossChain.onCall Swaps Arbitrary Contract's ZRC20 When swapDataZ.fromToken Mismatches Deposited zrc20 ↗ |