Knowledge Base
Detectors, exploits, attack patterns, and remediation guides for EVM, Solana, and Zero-Knowledge contracts.
Reading an article requires a Sigvex account.
Access Control Bypass
Maintained by Sigvex Team Reviewed
How attackers exploit missing or improper access restrictions on critical functions — responsible for over $1.3 billion in DeFi losses including the largest hack in history.
Admin Key Management
Maintained by Sigvex Team Reviewed
Detects unsafe admin key handling including hardcoded keys, missing validation, and single points of failure.
Anchor Constraint Bypass
Maintained by Sigvex Team Reviewed
Detects missing or incomplete Anchor account constraint validation that could allow unauthorized account substitution.
Anchor Upgrade Security
Maintained by Sigvex Team Reviewed
Detects unsafe Anchor program upgrade patterns and missing security controls.
Arbitrary Cross-Program Invocation
Maintained by Sigvex Team Reviewed
Detects cross-program invocations (CPI) where the target program ID is user-controlled and not validated, allowing attackers to redirect calls to malicious programs.
Arbitrary ERC-20 Transfer
Maintained by Sigvex Team Reviewed
Detects ERC-20 transfer and transferFrom calls where the recipient or amount is user-controlled without access control, enabling token theft.
Arbitrary External Calls
Maintained by Sigvex Team Reviewed
Detects external calls to user-controlled addresses without validation, enabling attackers to redirect execution to malicious contracts.
Arbitrary Jump
Maintained by Sigvex Team Reviewed
Detects JUMP or JUMPI instructions where the destination is derived from user input, enabling control-flow hijacking.
Arbitrary Storage Write
Maintained by Sigvex Team Reviewed
Detects functions that write to storage slots determined by user-controlled input, enabling attackers to overwrite any state variable.
Bridge Message Manipulation
Maintained by Sigvex Team Reviewed
How attackers forge, replay, or bypass cross-chain bridge messages to mint unauthorized assets — responsible for over $1.2 billion in losses across the bridge ecosystem.
Bridge Security Vulnerabilities
Maintained by Sigvex Team Reviewed
Detects vulnerabilities in cross-chain bridge implementations including missing message verification, replay attack exposure, unauthorized relay functions, weak finality assumptions, and protocol-specific issues in a major cross-chain messaging protocol, Axelar, and Hyperlane integrations.
Close Account Drain
Maintained by Sigvex Team Reviewed
Detects account closure patterns that leave residual lamports accessible to the program or allow the account to be drained without proper authorization.
Conditional Storage Collision
Maintained by Sigvex Team Reviewed
Detects storage slot collisions in proxy contracts that occur only under specific execution paths or conditions, leading to intermittent state corruption.
Conditional Validation Bypass
Maintained by Sigvex Team Reviewed
Detects security validations placed inside conditional branches that can be bypassed through alternate execution paths.
CPI Authority Downgrade
Maintained by Sigvex Team Reviewed
Detects privileged accounts being passed to unvalidated programs via CPI, enabling authority hijacking.
CPI Return Value Forgery
Maintained by Sigvex Team Reviewed
Detects CPI return data used for critical operations without independent on-chain state verification.
CPI Signer Simulation
Maintained by Sigvex Team Reviewed
Detects false signer claims in cross-program invocations where accounts were not actually signed in the original transaction.
Critical Program ID Validation
Maintained by Sigvex Team Reviewed
Detects CPI calls to critical system programs without explicit address validation.
Cross-Function Reentrancy
Maintained by Sigvex Team Reviewed
Detects reentrancy attacks that exploit multiple functions sharing the same state, where an attacker re-enters a different function before the original call completes its state updates.
Cross-Template Constraint Gap
Maintained by Sigvex Team Reviewed
Detects signals wired between template instances where the constraint chain is broken, leaving inter-template data flows unconstrained.
Decimal Mismatch
Maintained by Sigvex Team Reviewed
Detects arithmetic operations that mix values with different decimal precision without normalization, causing massive over- or under-payments.
DeFi Reentrancy
Maintained by Sigvex Team Reviewed
Detects DeFi-specific reentrancy patterns where external calls occur before state updates in vault, lending, and staking operations.
Flash Loan and Governance Attack Chains
Maintained by Sigvex Team Reviewed
How a flash loan combines with a governance or pricing weakness into a single-transaction takeover, and which Sigvex detectors report each link of the chain.
Flash Loan Attack Vector
Maintained by Sigvex Team Reviewed
Detects protocol patterns that are susceptible to flash loan price manipulation — specifically, reliance on on-chain spot prices that can be manipulated within a single transaction.
Flash Loan Validation
Maintained by Sigvex Team Reviewed
Detects missing repayment validation in flash loan patterns, allowing borrowers to avoid repaying borrowed funds.
Governance Attacks
Maintained by Sigvex Team Reviewed
Detects vulnerabilities in DAO governance mechanisms including flash loan-based voting, timelock bypass, quorum manipulation, delegation exploits, treasury drain, and emergency action abuse.
Immutable Violation
Maintained by Sigvex Team Reviewed
Detects modifications to storage variables that should be immutable, including constructor-set values modified by public functions and view-named functions that write to storage.
Incorrect Constructor
Maintained by Sigvex Team Reviewed
Detects initialization functions that were intended as constructors but became callable public functions due to naming errors in Solidity 0.4.x contracts.
Instruction Sender Validation
Maintained by Sigvex Team Reviewed
Detects missing validation that the transaction sender has authority for privileged operations.
Lamport Drain
Maintained by Sigvex Team Reviewed
Detects unauthorized lamport transfers where an account's SOL balance is transferred without proper signer, key, or owner authorization checks.
Liquidity Manipulation
Maintained by Sigvex Team Reviewed
Detects liquidity pool manipulation vulnerabilities.
Mint Authority Abuse
Maintained by Sigvex Team Reviewed
Detects token minting operations without proper mint authority validation, enabling unauthorized token supply inflation.
Missing Owner Check
Maintained by Sigvex Team Reviewed
Detects account data reads where the account's program owner is not verified, allowing attackers to pass maliciously crafted accounts with arbitrary data.
Missing Signer Check
Maintained by Sigvex Team Reviewed
Detects privileged operations — lamport transfers and account data writes — performed without verifying that the involved account has signed the transaction.
Missing Slippage Bounds on Swaps
Maintained by Sigvex Team Reviewed
Why a swap with no minimum-output bound is the standard sandwich target, and how Sigvex reports the missing bound as part of its MEV coverage.
Native Program Authority
Maintained by Sigvex Team Reviewed
Detects missing authority validation when invoking Solana native programs.
Oracle Manipulation
Maintained by Sigvex Team Reviewed
How attackers manipulate price oracles to exploit lending protocols, inflate collateral, and drain DeFi platforms — the most costly attack class in DeFi history.
Oracle Manipulation
Maintained by Sigvex Team Reviewed
Detects smart contracts that rely on manipulable on-chain price sources, such as DEX spot prices or single-source price feeds, without time-weighted averaging.
PDA Signer Seed Extraction
Maintained by Sigvex Team Reviewed
Detects PDA signer seeds that can be extracted or predicted by attackers, enabling PDA authority bypass.
Private Input Unchecked
Maintained by Sigvex Team Reviewed
Detects Noir private (witness) inputs of type Field that are not referenced in any assertion, allowing the prover to set them to arbitrary values.
Prover-Controlled Loop Bound
Maintained by Sigvex Team Reviewed
Detects loop iteration bounds that depend on unconstrained signal values, allowing the prover to choose how many iterations execute.
Read-Only Reentrancy
Maintained by Sigvex Team Reviewed
Detects view functions that read shared state mid-execution of a mutating call, allowing attackers to observe and exploit inconsistent intermediate state without modifying it.
Reentrancy
Maintained by Sigvex Team Reviewed
Detects functions that transfer Ether or call external contracts before completing state updates, allowing attackers to recursively re-enter and drain funds.
Reentrancy Attack
Maintained by Sigvex Team Reviewed
How attackers exploit external calls that execute before state updates to recursively drain funds from smart contracts.
Signer Authority Role
Maintained by Sigvex Team Reviewed
Detects privileged operations with signer checks but no authority role validation, allowing any signer to execute admin actions.
SPL Governance Attack
Maintained by Sigvex Team Reviewed
Detects missing safeguards in governance implementations that enable proposal manipulation and flash governance attacks.
SPL Token Delegation Overflow
Maintained by Sigvex Team Reviewed
Detects integer overflow vulnerabilities in token delegation amount calculations.
SPL Token Mint Authority
Maintained by Sigvex Team Reviewed
Detects mint authority vulnerabilities including missing validation and unlimited minting.
Storage Collision
Maintained by Sigvex Team Reviewed
Detects proxy storage layout collisions where the implementation contract's variables overlap with the proxy contract's administrative slots, enabling state corruption and privilege escalation.
Sysvar Account Spoofing
Maintained by Sigvex Team Reviewed
Detects programs reading sysvar data from accounts without validating the account key matches the canonical sysvar address.
Token Balance Invariant
Maintained by Sigvex Team Reviewed
Detects token operations that violate balance invariants such as mint without supply update or burn without supply decrease.
Token Decimal Mismatch
Maintained by Sigvex Team Reviewed
Detects token transfers and swaps with mismatched decimals without proper conversion.
Unchecked Call Target
Maintained by Sigvex Team Reviewed
Detects external calls where the target address is user-controlled and not validated against known-safe addresses, enabling call redirection attacks.
Unchecked Fee/Rent Math
Maintained by Sigvex Team Reviewed
Detects unchecked arithmetic in fee and rent calculations that can overflow or underflow, leading to fund loss.
Unchecked Subtraction
Maintained by Sigvex Team Reviewed
Detects subtraction operations without underflow protection that can wrap around to a large value, bypassing balance checks and enabling fund theft.
Unconnected Component Inputs
Maintained by Sigvex Team Reviewed
Detects component instantiations where outputs are read but inputs are not wired, leaving the sub-circuit unconstrained and enabling proof forgery.
Unconstrained Call Return Unchecked
Maintained by Sigvex Team Reviewed
Detects Noir constrained functions that call an unconstrained function returning a value and never assert on the result, letting a prover-chosen value flow into the proof.
Unconstrained Divisor
Maintained by Sigvex Team Reviewed
Detects Circom divisions whose divisor signal appears in no constraint at all, giving a malicious prover full control over the divisor and the result.
Unconstrained Output
Maintained by Sigvex Team Reviewed
Detects circuit output signals that lack any constraining assignment or explicit constraint, allowing the prover to set outputs to arbitrary values.
Unconstrained Output Relation in Noir Circuits
Maintained by Sigvex Team Reviewed
Flags Noir functions that return a value derived from private inputs without any assertion binding the output to those inputs.
Unconstrained Public Input
Maintained by Sigvex Team Reviewed
Detects public input signals that are used in computations but never appear in any constraint, enabling the prover to forge the claimed public input value.
Under-Constrained Signal
Maintained by Sigvex Team Reviewed
Detects signals assigned via unconstrained assignment without any corresponding constraint, allowing the prover to set them to arbitrary values.
Uninitialized UUPS Proxy
Maintained by Sigvex Team Reviewed
Detects UUPS upgradeable proxy contracts where the implementation contract is deployed without calling the initializer, leaving the proxy's ownership and upgrade authority unset.
Unprotected Ether Withdrawal
Maintained by Sigvex Team Reviewed
Detects functions that transfer Ether without verifying the caller's authorization, allowing anyone to drain the contract's ETH balance.
Unsafe Comparison
Maintained by Sigvex Team Reviewed
Detects comparison operators used in unconstrained assignments, producing prover-controlled boolean values with no verifier check.
Unsafe Delegatecall
Maintained by Sigvex Team Reviewed
Detects delegatecall operations where the target address is user-controlled or loaded from storage without authorization, enabling complete contract takeover.
Vault Manipulation
Maintained by Sigvex Team Reviewed
Detects unauthorized vault state modifications and missing invariant checks in DeFi vault operations.
Vault Rounding
Maintained by Sigvex Team Reviewed
Detects rounding direction errors in ERC-4626 vault share calculations that allow attackers to extract value through precision manipulation.
Wrapped Token Parity
Maintained by Sigvex Team Reviewed
Detects missing wrapped token supply vs collateral parity validation.
AA Storage Access Violations
Maintained by Sigvex Team Reviewed
Detects banned opcodes and storage access violations in ERC-4337 validation phase that cause bundler rejection.
Access Control
Maintained by Sigvex Team Reviewed
Detects missing or improperly implemented access controls on privileged functions, allowing unauthorized callers to execute restricted operations.
Account Abstraction (ERC-4337)
Maintained by Sigvex Team Reviewed
Detects security issues in ERC-4337 account abstraction implementations including validation phase violations, paymaster abuse, and bundler manipulation.
Account Alias Attack (Role Confusion)
Maintained by Sigvex Team Reviewed
Detects when the same account is passed in multiple positions with incompatible role requirements, enabling an attacker to bypass security checks through role confusion.
Account Close Balance Check
Maintained by Sigvex Team Reviewed
Detects incomplete account close operations where lamports are drained but account data is not zeroed, enabling account resurrection attacks.
Account Close Discriminator
Maintained by Sigvex Team Reviewed
Detects account closes without discriminator zeroing, enabling resurrection attacks.
Account Close Reopen Race
Maintained by Sigvex Team Reviewed
Detects race conditions from account close/reopen between transactions.
Account Executable Flag
Maintained by Sigvex Team Reviewed
Detects missing executable flag validation before using accounts as program IDs in cross-program invocations.
Account Index Bounds
Maintained by Sigvex Team Reviewed
Detects account array access without bounds validation, a vulnerability that appears in 30% of recent Solana audit findings.
Account Iterator Bounds
Maintained by Sigvex Team Reviewed
Detects unsafe iteration over account arrays without bounds validation, which can lead to out-of-bounds panics or buffer overflows.
Account Layout Version
Maintained by Sigvex Team Reviewed
Detects account deserialization without version validation, which can cause silent data corruption when account structures are upgraded.
Account List Size
Maintained by Sigvex Team Reviewed
Detects missing account list size validation for programs that expect a fixed number of accounts.
Account Owner Chain
Maintained by Sigvex Team Reviewed
Detects account owner validation issues across CPI boundaries where ownership assumptions break after cross-program invocations.
Account Realloc Corruption
Maintained by Sigvex Team Reviewed
Detects account reallocation data corruption vulnerabilities.
Account Reallocation
Maintained by Sigvex Team Reviewed
Detects unsafe account reallocation patterns that can corrupt data.
Account Resurrection
Maintained by Sigvex Team Reviewed
Detects accounts that could be resurrected after closure via PDA re-derivation.
Account Type Confusion
Maintained by Sigvex Team Reviewed
Detects accounts used in conflicting roles or deserialized as the wrong type, enabling attackers to substitute one account type for another.
Account Use After Close
Maintained by Sigvex Team Reviewed
Detects reads or writes to accounts after they are logically closed.
Account Verification Chain
Maintained by Sigvex Team Reviewed
Detects incomplete account verification chains where accounts undergo partial validation, allowing attackers to bypass security checks.
Address Lookup Table Poisoning
Maintained by Sigvex Team Reviewed
Detects unsafe use of Address Lookup Tables without authority validation, allowing attackers to substitute malicious accounts.
Anchor Constraint TOCTOU
Maintained by Sigvex Team Reviewed
Detects Time-of-Check-Time-of-Use vulnerabilities in Anchor constraint validation.
Anchor Discriminator Validation
Maintained by Sigvex Team Reviewed
Detects missing or incorrect Anchor discriminator validation.
Anchor IDL Mismatch
Maintained by Sigvex Team Reviewed
Detects inconsistencies between Anchor IDL and program implementation.
Anchor Init/Close Patterns
Maintained by Sigvex Team Reviewed
Detects unsafe account initialization and closing patterns in Anchor programs.
Assembly Analysis
Maintained by Sigvex Team Reviewed
Detects dangerous opcodes, unchecked calls, unsafe memory access, and unguarded arithmetic inside inline assembly blocks.
Assert Violation
Maintained by Sigvex Team Reviewed
Detects reachable assert() statements that indicate invariant violations and potential logic bugs in smart contracts.
Atomic State Update
Maintained by Sigvex Team Reviewed
Detects non-atomic multi-step state updates where intermediate consistency checks are missing between storage writes.
Authority Chain Validation
Maintained by Sigvex Team Reviewed
Detects multi-hop CPI authority chains where delegated signing authority is not validated at each intermediate hop, allowing an attacker to abuse implicitly inherited authority from a PDA signer.
Balance Accounting Mismatch
Maintained by Sigvex Team Reviewed
Detects contracts that assume transfer amounts equal the actual balance change, failing to account for fee-on-transfer, rebasing, or deflationary tokens.
Batch Operation Atomicity
Maintained by Sigvex Team Reviewed
Detects batch operations that lack atomicity guarantees, allowing partial execution failures to leave the contract in an inconsistent state.
Bit Shift Overflow
Maintained by Sigvex Team Reviewed
Detects unsafe bit shift operations where the shift amount is user-controlled or exceeds the operand width, causing silent data loss.
Bump Seed Brute Force
Maintained by Sigvex Team Reviewed
Detects user-controlled bump seeds in PDA derivation without validation against canonical values.
Bump Seed Canonicalization
Maintained by Sigvex Team Reviewed
Detects PDA operations using potentially non-canonical bump seeds via create_program_address, which can enable PDA collision and address confusion attacks.
Business Logic Error
Maintained by Sigvex Team Reviewed
Detects violations of protocol-specific invariants — conditions that must always hold true for the protocol to operate correctly — including incorrect reward calculations, fee logic, and state transition rules.
Cairo Reentrancy (Checks-Effects-Interactions)
Maintained by Sigvex Team Reviewed
Detects Cairo functions that write storage after an external call, leaving the contract open to reentrancy through a violated checks-effects-interactions ordering.
Callback State Mutation
Maintained by Sigvex Team Reviewed
Detects state mutations after external calls that may trigger callbacks, violating the Checks-Effects-Interactions pattern.
Centralization Risks
Maintained by Sigvex Team Reviewed
Detects excessive owner privileges, single points of failure, and centralization patterns that enable rug pulls or administrative abuse.
Compressed NFT Validation
Maintained by Sigvex Team Reviewed
Detects Bubblegum/compressed NFT Merkle proof and authority vulnerabilities.
Compute Exhaustion
Maintained by Sigvex Team Reviewed
Detects resource issues that could exhaust Solana compute unit budget.
Conditional Ownership Bypass
Maintained by Sigvex Team Reviewed
Detects ownership checks that can be bypassed through conditional logic, allowing unauthorized access.
Constructor State
Maintained by Sigvex Team Reviewed
Detects improper state initialization in constructors of upgradeable contracts where state is invisible to proxies.
Controlled Array Length
Maintained by Sigvex Team Reviewed
Detects unbounded dynamic arrays that can grow without limit, enabling denial-of-service through gas exhaustion on iteration.
CPI Account List Mismatch
Maintained by Sigvex Team Reviewed
Detects CPI calls without proper account list validation, enabling privilege escalation.
CPI Cycle Detection
Maintained by Sigvex Team Reviewed
Detects circular cross-program invocation patterns that could cause infinite loops or resource exhaustion.
CPI Data Tampering
Maintained by Sigvex Team Reviewed
Detects CPI calls with potentially tampered instruction data from untrusted sources.
CPI in Loop Denial of Service
Maintained by Sigvex Team Reviewed
Detects CPI calls inside loops that can cause compute exhaustion and denial of service.
CPI Program ID Validation
Maintained by Sigvex Team Reviewed
Detects Cross-Program Invocations where the target program account key is not verified against the expected program ID, allowing an attacker to substitute a malicious program that accepts the same instruction format.
CPI Signer Propagation
Maintained by Sigvex Team Reviewed
Detects unsafe signer propagation in nested CPI calls without re-validation.
CREATE2 Collision
Maintained by Sigvex Team Reviewed
Detects CREATE2 deployments where salt values can be predicted or brute-forced, enabling address collision attacks.
Critical Truncation
Maintained by Sigvex Team Reviewed
Detects integer truncation in security-critical operations including lamport transfers, account storage, and access control.
Cross-Account Relationship Validation
Maintained by Sigvex Team Reviewed
Detects missing validation of relationships between related accounts in CPI operations.
Cross-Contract Taint Flow
Maintained by Sigvex Team Reviewed
Detects tainted data flowing from untrusted external calls into security-critical operations like access control checks or transfer amounts.
Cross-Program Reinit
Maintained by Sigvex Team Reviewed
Detects accounts used after CPI without re-validating initialization state.
Dangerous Delegatecall
Maintained by Sigvex Team Reviewed
Detects delegatecall patterns where user-controlled input can specify the target address or data, potentially redirecting execution to a malicious contract.
Diamond Collision
Maintained by Sigvex Team Reviewed
Detects storage slot collisions between facets in EIP-2535 diamond proxy contracts, where independent facets may unknowingly share storage locations.
Disconnected Component
Maintained by Sigvex Team Reviewed
Detects component instances that are declared but never wired: no input is driven and no output is read, so the sub-circuit's constraints float free of the parent.
Division by Zero
Maintained by Sigvex Team Reviewed
Detects division and modulo operations where the divisor may be zero, causing transaction reverts that lock funds or enable denial of service.
Division by Zero
Maintained by Sigvex Team Reviewed
Detects division and modulo operations where the divisor may be zero, causing runtime panics and DoS vulnerabilities.
Division by Zero Risk
Maintained by Sigvex Team Reviewed
Detects divisions and modulo operations where the divisor has no non-zero binding, yielding undefined witness behaviour exploitable by the prover.
DoS Compute Exhaustion
Maintained by Sigvex Team Reviewed
Detects potential denial-of-service via unbounded compute unit consumption.
DoS with Failed Call
Maintained by Sigvex Team Reviewed
Detects denial of service vulnerabilities where external calls in loops lack error handling, allowing one failed call to block entire batch operations.
Double Constraining Assignment
Maintained by Sigvex Team Reviewed
Detects a signal assigned with the constraining operator more than once on the same execution path, a construct the compiler rejects and that is usually 'fixed' by dropping a constraint.
Durable Nonce Manipulation
Maintained by Sigvex Team Reviewed
Detects missing validation when interacting with durable nonce accounts, enabling replay attacks or transaction reordering.
Ed25519 Signature Malleability
Maintained by Sigvex Team Reviewed
Detects Ed25519 signature verification without canonical signature checks, allowing signature malleability attacks.
EIP-7702 Delegation
Maintained by Sigvex Team Reviewed
Detects vulnerabilities in EIP-7702 delegation targets where EOAs temporarily delegate to smart contract code.
Empty Code Detection
Maintained by Sigvex Team Reviewed
Detects external calls to user-controlled addresses without verifying that the target has deployed code, where silent success masks failed interactions.
ERC-1155 Standard Violations
Maintained by Sigvex Team Reviewed
Detects ERC-1155 contracts missing receiver callbacks, batch array-length validation, ERC-165 support, or required functions.
ERC-1271 Signature Verification
Maintained by Sigvex Team Reviewed
Detects insecure ERC-1271 contract signature verification including missing magic value checks, reentrancy during verification, and gas griefing.
ERC-6900 Modular Account
Maintained by Sigvex Team Reviewed
Detects security issues in modular smart account implementations including plugin validation gaps, execution hook bypass, and module isolation failures.
ERC-721 Standard Violations
Maintained by Sigvex Team Reviewed
Detects ERC-721 contracts missing required functions, safe-transfer callbacks, ERC-165 support, or zero-address checks.
EXTCODESIZE Bypass
Maintained by Sigvex Team Reviewed
Detects access control checks using EXTCODESIZE that can be bypassed by calling from a contract's constructor, where code size is zero.
Fee-on-Transfer
Maintained by Sigvex Team Reviewed
Detects contracts that assume the received token amount equals the transferred amount, failing to account for fee-on-transfer tokens.
Feedback Loop
Maintained by Sigvex Team Reviewed
Detects circular signal dependencies in circuit constraints that prevent deterministic witness generation.
Field Overflow
Maintained by Sigvex Team Reviewed
Detects arithmetic that may wrap the finite field prime, producing field-correct but semantically wrong results for circuits modelling bounded integers.
Field Overflow Exponentiation
Maintained by Sigvex Team Reviewed
Detects exponentiation in circuit assignments, where a modest exponent is enough for the result to wrap around the field modulus and the constrained form is usually not expressible at all.
Field Underflow Negation
Maintained by Sigvex Team Reviewed
Detects witness-only negation of a signal, where the result is a field element near the modulus rather than a negative number, and no range constraint pins what the prover may put there.
Field Underflow Subtraction
Maintained by Sigvex Team Reviewed
Detects unconstrained subtractions between signals where the result may wrap around the field modulus, turning a small negative difference into an enormous value.
Flash Loan Attack
Maintained by Sigvex Team Reviewed
How attackers use uncollateralized flash loans to manipulate prices, exploit protocol logic, and drain funds within a single transaction.
Function Selector Collision
Maintained by Sigvex Team Reviewed
Detects functions with colliding 4-byte selectors that can cause incorrect function dispatch or proxy confusion.
Gas Griefing
Maintained by Sigvex Team Reviewed
Detects external calls that forward insufficient gas or allow callers to specify gas amounts that cause downstream operations to fail.
Hash Collision
Maintained by Sigvex Team Reviewed
Detects hash collision vulnerabilities in cryptographic operations including weak algorithms, truncated hashes, and merkle proof misuse.
Implicit Instruction Ordering
Maintained by Sigvex Team Reviewed
Detects implicit instruction ordering dependencies not enforced on all control flow paths, enabling authorization bypass through path-selective attacks.
Incorrect Exponent
Maintained by Sigvex Team Reviewed
Detects confusion between the XOR operator (^) and exponentiation (**) in Solidity arithmetic expressions.
Initializer Reentrancy
Maintained by Sigvex Team Reviewed
Detects proxy initializer functions that make external calls before setting the initialized flag, enabling re-initialization attacks.
Input Validation
Maintained by Sigvex Team Reviewed
Detects missing validation of user-controlled inputs including instruction parameters, account data fields, and system call results in Solana programs.
Instruction Data Length
Maintained by Sigvex Team Reviewed
Detects missing instruction data length validation before unpacking, the most common source of runtime panics in Solana programs.
Instruction Index Validation
Maintained by Sigvex Team Reviewed
Detects hardcoded instruction index comparisons that can be bypassed by attackers who control transaction structure.
Instruction Introspection
Maintained by Sigvex Team Reviewed
Detects unsafe instruction introspection with missing bounds or length validation when accessing transaction instructions via sysvar.
Instruction Verification Pattern
Maintained by Sigvex Team Reviewed
Detects incorrect ordering of validation checks and sensitive operations, where state modifications or CPIs occur before authorization.
Insufficient Data Length Check
Maintained by Sigvex Team Reviewed
Detects account data access without sufficient length validation, which can cause buffer overflows or runtime panics.
Insufficient Lamport Balance
Maintained by Sigvex Team Reviewed
Detects lamport operations without sufficient balance validation.
Integer Overflow
Maintained by Sigvex Team Reviewed
Detects arithmetic operations that may overflow or underflow, producing incorrect values that can lead to fund theft or unexpected behavior.
Integer Overflow (SVM)
Maintained by Sigvex Team Reviewed
Detects unchecked arithmetic operations on user-controlled values in Solana programs that may overflow or underflow, enabling fund manipulation.
Integer Truncation
Maintained by Sigvex Team Reviewed
Detects unsafe integer type casts that may truncate data, causing loss of significant bits and security vulnerabilities.
L2 Rollup Vulnerabilities
Maintained by Sigvex Team Reviewed
Detects Layer 2-specific vulnerabilities including sequencer dependency, L1-L2 message replay, and gas price oracle manipulation.
Lamport Conservation
Maintained by Sigvex Team Reviewed
Detects lamport conservation violations where balances are not properly maintained.
Lamport Token Confusion
Maintained by Sigvex Team Reviewed
Detects confusion between native SOL (lamports) and SPL token operations leading to incorrect value calculations.
Lamport Underflow
Maintained by Sigvex Team Reviewed
Detects lamport transfers that may exceed available balance, causing underflow, account closure, or rent-exempt violations.
Locked Ether
Maintained by Sigvex Team Reviewed
Detects contracts that can receive ETH but have no code path that sends it out, permanently trapping funds.
Loop Gas Exhaustion
Maintained by Sigvex Team Reviewed
Detects loops without proper iteration bounds where the count can be influenced by external input, causing DoS via block gas limit exhaustion.
LP Token Inflation
Maintained by Sigvex Team Reviewed
Detects AMM and DEX liquidity pool contracts vulnerable to first-depositor inflation attacks where an attacker manipulates the share price to steal from subsequent depositors.
Memory Expansion DoS
Maintained by Sigvex Team Reviewed
Detects unbounded memory allocation patterns that can cause out-of-gas denial of service attacks.
Merkle Proof Verification
Maintained by Sigvex Team Reviewed
Detects insecure Merkle proof verification patterns vulnerable to second preimage attacks and proof malleability.
Metadata Authority Transfer
Maintained by Sigvex Team Reviewed
Detects unsafe metadata authority transfers without proper verification of the new authority.
Metamorphic Contract
Maintained by Sigvex Team Reviewed
Detects contracts that can be destroyed and redeployed at the same address with different code using CREATE2 and SELFDESTRUCT.
MEV Vulnerabilities
Maintained by Sigvex Team Reviewed
Detects transaction ordering dependencies exploitable by miners and MEV searchers, including sandwich attacks, frontrunning, and backrunning patterns.
MEV Vulnerabilities
Maintained by Sigvex Team Reviewed
Detects MEV and transaction ordering vulnerabilities in Solana programs.
Missing Assert
Maintained by Sigvex Team Reviewed
Detects Noir constrained functions that accept parameters but contain no assertion, so the function proves nothing about the values it was given.
Missing Deadline
Maintained by Sigvex Team Reviewed
Detects DEX and AMM swap operations that lack transaction deadline validation, allowing pending transactions to execute at stale prices.
Missing Empty Account Check
Maintained by Sigvex Team Reviewed
Detects account initialization without validating the account is empty first.
Missing Storage Gap
Maintained by Sigvex Team Reviewed
Detects upgradeable contracts that lack reserved storage gaps, risking storage collisions when new state variables are added in future versions.
msg.value in Loop
Maintained by Sigvex Team Reviewed
Detects msg.value used inside loops where the same ETH value is counted multiple times, enabling fund theft or accounting errors.
Multi-Hop CPI
Maintained by Sigvex Team Reviewed
Detects dangerous multi-hop cross-program invocation chains.
Multi-Sig Validation
Maintained by Sigvex Team Reviewed
Detects multi-signature validation issues including weak thresholds, missing signer verification, and replay vulnerabilities.
Native Discriminator Validation
Maintained by Sigvex Team Reviewed
Detects native programs deserializing account data without discriminator checks.
NFT Creator Verification
Maintained by Sigvex Team Reviewed
Detects missing creator signature verification in NFT metadata operations.
Noir Circuit Detectors
Maintained by Sigvex Team Reviewed
A family of checks for Noir-specific hazards: unconstrained functions, oracle responses, Brillig escapes, and assertion dependencies on mutable state.
Nondeterministic Conditional
Maintained by Sigvex Team Reviewed
Detects if/else logic inside unconstrained assignments, where the prover can take either branch without any constraint enforcing the condition.
Nondeterministic Control Flow
Maintained by Sigvex Team Reviewed
Detects ternary and conditional expressions inside unconstrained assignments, where the prover chooses which branch produces the witness value.
Nondeterministic Division in Noir Circuits
Maintained by Sigvex Team Reviewed
Flags division in Noir functions where the quotient is an unconstrained witness and the divisor is never validated.
Nondeterministic Witness
Maintained by Sigvex Team Reviewed
Detects nondeterministic operators on the right-hand side of `<--` assignments where no constraint later rebinds the result.
Off-By-One
Maintained by Sigvex Team Reviewed
Detects off-by-one errors in loop boundaries that can lead to skipped elements or out-of-bounds array access.
Oracle Data Freshness
Maintained by Sigvex Team Reviewed
Detects oracle price usage without staleness validation.
Payable Fallback
Maintained by Sigvex Team Reviewed
Detects contracts with payable fallback or receive functions that accept ETH without proper handling or access control.
PDA Bump Seed Reuse
Maintained by Sigvex Team Reviewed
Detects reuse of the same bump seed value across multiple PDA derivations.
PDA Ownership Validation
Maintained by Sigvex Team Reviewed
Detects PDA usage without ownership validation, allowing unauthorized access.
PDA Seed Collision
Maintained by Sigvex Team Reviewed
Detects PDA derivations with weak seed patterns that could collide with other PDAs or system addresses, enabling account hijacking.
PDA Seed Validation
Maintained by Sigvex Team Reviewed
Detects incorrect PDA seed derivation patterns including wrong order, missing seeds, and non-deterministic sources.
PDA System Collision
Maintained by Sigvex Team Reviewed
Detects PDA derivations with weak entropy that could collide with system program addresses.
PDA User-Controlled Seeds
Maintained by Sigvex Team Reviewed
Detects user-controlled input used in PDA seeds without validation, enabling arbitrary PDA derivation.
PDA Validation
Maintained by Sigvex Team Reviewed
Detects Program Derived Addresses that are used without verifying their seeds and bump, allowing attackers to substitute counterfeit PDAs.
Permit Frontrunning
Maintained by Sigvex Team Reviewed
Detects ERC-2612 permit implementations where nonce mismanagement enables frontrunning attacks on gasless approvals.
Permit Vulnerabilities
Maintained by Sigvex Team Reviewed
Detects ERC-2612 permit implementation issues including front-running, nonce manipulation, and deadline bypass.
Precision Errors
Maintained by Sigvex Team Reviewed
Detects division-before-multiplication and rounding errors in financial calculations that cause systematic fund loss or enable economic attacks through precision manipulation.
Precision Errors
Maintained by Sigvex Team Reviewed
Detects precision loss and rounding errors in DeFi financial calculations.
Price Impact
Maintained by Sigvex Team Reviewed
Detects large swaps without price impact validation.
Program Upgrade Risks
Maintained by Sigvex Team Reviewed
Detects security risks in upgradeable Solana programs including authority validation issues.
Quadratic Constraint Composition
Maintained by Sigvex Team Reviewed
Detects R1CS quadratic constraints where both multiplicative factors contain only unconstrained signals, breaking proof soundness.
Readonly CPI Write Bypass
Maintained by Sigvex Team Reviewed
Detects readonly accounts forwarded to CPI calls that may bypass write locks.
Rebasing Token
Maintained by Sigvex Team Reviewed
Detects contracts that interact with rebasing tokens (like stETH or AMPL) without accounting for balance changes that occur outside of explicit transfers.
Remaining Accounts Injection
Maintained by Sigvex Team Reviewed
Detects use of ctx.remaining_accounts in privileged operations without ownership and discriminator validation, allowing attackers to inject malicious accounts that bypass Anchor's type system.
Rent Collection Exploit
Maintained by Sigvex Team Reviewed
Detects rent collection exploit patterns and missing rent-exempt checks.
Rent Exempt Initialization
Maintained by Sigvex Team Reviewed
Detects account data writes before rent-exempt funding.
Rent Exempt Reallocation
Maintained by Sigvex Team Reviewed
Detects account reallocations without rent-exemption lamport adjustments.
Rent Withdrawal Balance
Maintained by Sigvex Team Reviewed
Detects partial lamport withdrawals without rent-exemption balance checks.
Reserve Manipulation
Maintained by Sigvex Team Reviewed
Detects AMM and DEX contracts vulnerable to reserve manipulation via direct balance inflation, enabling attackers to skew prices or drain liquidity.
Reward and Incentive Manipulation
Maintained by Sigvex Team Reviewed
Detects vulnerabilities in staking, yield farming, and reward distribution functions that allow attackers to inflate reward claims through flash loans, timestamp manipulation, or division-before-multiplication precision loss.
Role-Based Access Control
Maintained by Sigvex Team Reviewed
Detects role-based access control vulnerabilities including missing role checks, escalation risks, and hardcoded permissions.
RTLO Unicode
Maintained by Sigvex Team Reviewed
Detects right-to-left override Unicode characters used in Trojan Source attacks to disguise malicious code as benign.
Sandwich Attack
Maintained by Sigvex Team Reviewed
Detects DEX swap functions vulnerable to sandwich attacks where missing slippage and deadline protections allow value extraction by MEV searchers.
Secondary Signer Validation
Maintained by Sigvex Team Reviewed
Detects accounts with identity validation (CheckKey) but missing signer validation (CheckSigner), allowing authorization bypass.
Selfdestruct Usage
Maintained by Sigvex Team Reviewed
Detects use of the selfdestruct opcode, which can permanently destroy a contract and forcibly send its Ether balance to an arbitrary address.
Semantic Reentrancy
Maintained by Sigvex Team Reviewed
Detects reentrancy vulnerabilities arising from semantic state inconsistencies rather than direct balance manipulation.
Short Address Attack
Maintained by Sigvex Team Reviewed
Detects ERC-20 transfer functions vulnerable to short address attacks where truncated addresses cause the amount parameter to be left-shifted.
Sign Extension Overflow
Maintained by Sigvex Team Reviewed
Detects unsafe sign extension in type conversions between signed and unsigned integers, where negative values become large positive numbers.
Signal Mutation in Loop
Maintained by Sigvex Team Reviewed
Detects self-referential signal mutation inside loops, where prover-controlled iteration counts allow arbitrary final values.
Signal Reuse
Maintained by Sigvex Team Reviewed
Detects signals assigned more than once, including silent unconstrained overwrites that bypass constraint generation.
Signature Replay
Maintained by Sigvex Team Reviewed
Detects signature verification without chain ID, contract address, nonce, or deadline binding, allowing valid signatures to be reused across transactions, chains, or contracts.
Signature Replay
Maintained by Sigvex Team Reviewed
Detects signature verification without nonce or deadline replay protection, allowing valid signatures to be reused across multiple transactions.
Signature Verification
Maintained by Sigvex Team Reviewed
Detects improper ECDSA signature verification patterns including missing checks, incorrect hash construction, and unsafe recovery.
Slippage Protection
Maintained by Sigvex Team Reviewed
Detects missing slippage protection in token swap operations.
SPL Token Account Close
Maintained by Sigvex Team Reviewed
Detects unsafe account close operations including non-empty accounts and rent drain attacks.
SPL Token Account Validation
Maintained by Sigvex Team Reviewed
Detects missing validation in SPL token operations including ownership, mint, and authority checks.
SPL Token ATA Validation
Maintained by Sigvex Team Reviewed
Detects improper Associated Token Account usage including wrong ATA, missing derivation validation, and mint mismatch.
SPL Token Authority Confusion
Maintained by Sigvex Team Reviewed
Detects confusion between token account authorities (owner, delegate, close authority, mint authority, freeze authority).
SPL Token Close Authority Bypass
Maintained by Sigvex Team Reviewed
Detects token account closure without validating the close_authority field.
SPL Token Delegation Security
Maintained by Sigvex Team Reviewed
Detects unsafe token delegation patterns including unlimited approvals and missing revocation.
SPL Token Freeze Burn Validation
Maintained by Sigvex Team Reviewed
Detects unsafe freeze and burn operations with missing authority validation or balance checks.
SPL Token Transfer Hooks
Maintained by Sigvex Team Reviewed
Detects transfer hook vulnerabilities including bypass, reentrancy, and missing validation.
Stack Depth Violation
Maintained by Sigvex Team Reviewed
Detects stack and CPI depth limit violations in Solana programs.
Stale Account Data After CPI
Maintained by Sigvex Team Reviewed
Detects use of cached account data after CPI without reload, leading to stale reads.
Stale Off-Chain Aggregated Price Feed
Maintained by Sigvex Team Reviewed
Detects contracts that consume off-chain aggregated oracle data without verifying that the price is recent, allowing protocols to operate on outdated prices during network disruptions.
Storage Layout Versioning
Maintained by Sigvex Team Reviewed
Detects storage layout changes during proxy upgrades that could corrupt existing state, including reordered variables and changed types.
Storage Write Removal Before Conditional Termination
Maintained by Sigvex Team Reviewed
Flags contracts compiled with Solidity 0.8.13 through 0.8.16 where the Yul optimizer can drop a storage write that precedes a conditional return or stop.
Swap Validation
Maintained by Sigvex Team Reviewed
Detects missing validation in token swap operations.
Sysvar Substitution
Maintained by Sigvex Team Reviewed
Detects unverified sysvar account usage that could allow attackers to substitute fake system data.
Template Misuse
Maintained by Sigvex Team Reviewed
Detects incorrect template instantiation patterns including unused outputs, parameter mismatches, and unconstrained component output reads.
the Metaplex Token Metadata program Authority Bypass
Maintained by Sigvex Team Reviewed
Detects missing update authority verification in canonical NFT metadata operations.
Token Account Ownership
Maintained by Sigvex Team Reviewed
Detects missing account ownership validation before cross-program invocations, allowing attackers to pass fake token accounts.
Token Account Spoofing
Maintained by Sigvex Team Reviewed
Detects token account spoofing and aliasing vulnerabilities where fake token accounts can be substituted.
Token Extension Security
Maintained by Sigvex Team Reviewed
Detects Token-2022 extension security misconfigurations.
Token Hook Reentrancy
Maintained by Sigvex Team Reviewed
Detects reentrancy through ERC-777, ERC-1155, and ERC-4626 token callback hooks where state updates occur after hook-triggering transfers.
Token-2022 Confidential
Maintained by Sigvex Team Reviewed
Detects Token-2022 confidential transfer vulnerabilities.
Token-2022 Extensions
Maintained by Sigvex Team Reviewed
Detects Token-2022 extension vulnerabilities including transfer hooks, fees, and confidential transfers.
Token-2022 Immutable Owner
Maintained by Sigvex Team Reviewed
Detects Token-2022 Immutable Owner extension validation issues.
Token-2022 Transfer Fee Bypass
Maintained by Sigvex Team Reviewed
Detects token transfers that do not account for Token-2022 transfer fees.
Transient Storage Clearing Helper Collision
Maintained by Sigvex Team Reviewed
Flags contracts compiled with Solidity 0.8.28 through 0.8.33 using the IR pipeline, where a shared zeroing helper can confuse persistent and transient storage on delete.
Trivial Constraint
Maintained by Sigvex Team Reviewed
Detects tautological constraints that are always satisfied regardless of signal values, providing no security guarantee.
TWAP Oracle Manipulation
Maintained by Sigvex Team Reviewed
Detects time-weighted average price oracle implementations vulnerable to multi-block manipulation or insufficient observation windows.
Type Cosplay (Discriminator Spoofing)
Maintained by Sigvex Team Reviewed
Detects account data deserialization that reads past the discriminator prefix without first validating it, allowing attackers to pass accounts of a different type.
Unassigned Output
Maintained by Sigvex Team Reviewed
Detects output signals that are declared but never assigned, leaving the value undefined and open to proof forgery.
Unchecked Array Bounds
Maintained by Sigvex Team Reviewed
Detects array accesses without bounds validation, enabling out-of-bounds reads/writes that corrupt storage or cause unexpected reverts.
Unchecked Component
Maintained by Sigvex Team Reviewed
Detects component instances whose inputs or outputs are never wired into the enclosing R1CS, leaving the component's internal constraints disconnected from the proof.
Unchecked CPI Return Value
Maintained by Sigvex Team Reviewed
Detects CPI calls without return value validation, allowing silent failures.
Unchecked Deserialization
Maintained by Sigvex Team Reviewed
Detects unchecked deserialization of account data that may panic on malformed input.
Unchecked ERC-20
Maintained by Sigvex Team Reviewed
Detects ERC-20 token operations whose boolean return values are not checked, allowing silent transfer failures.
Unchecked External Call Return Value
Maintained by Sigvex Team Reviewed
Detects external calls whose boolean return value is not checked, allowing silent failures that leave the contract in an inconsistent state.
Unconstrained Component Output Read
Maintained by Sigvex Team Reviewed
A planned Circom check for parent templates that copy a sub-component's output with the witness-only operator; the identifier is registered but no analysis emits it yet, and the pattern is currently surfaced by neighbouring detectors.
Unconstrained Return Value
Maintained by Sigvex Team Reviewed
Detects Noir unconstrained functions that return a value, inventorying every place where a prover-chosen result can enter the circuit unless a caller asserts on it.
Uninitialized Account
Maintained by Sigvex Team Reviewed
Detects usage of uninitialized accounts before proper initialization.
Uninitialized Storage
Maintained by Sigvex Team Reviewed
Detects storage variables and struct pointers used before initialization, where default zero values may cause unexpected behavior.
Unsafe Callback
Maintained by Sigvex Team Reviewed
Detects external callback hooks that execute untrusted code without proper validation, gas limits, or reentrancy protection.
Unsafe Downcasting
Maintained by Sigvex Team Reviewed
Detects type casts that silently truncate values when converting from a larger to a smaller integer type.
Vault Inflation Attack (ERC-4626 First Depositor)
Maintained by Sigvex Team Reviewed
Detects ERC-4626 tokenized vault implementations that are vulnerable to the first-depositor share price inflation attack, where an attacker manipulates the share price to cause subsequent depositors to receive zero shares.
veToken Governance
Maintained by Sigvex Team Reviewed
Detects vulnerabilities in vote-escrowed token governance systems including flash-vote attacks, lock manipulation, and decay bypass.
Voting Power Manipulation
Maintained by Sigvex Team Reviewed
Detects governance voting power manipulation vulnerabilities.
Weak Randomness
Maintained by Sigvex Team Reviewed
Detects use of predictable on-chain values — blockhash, block.timestamp, block.prevrandao — as sources of randomness, which miners or validators can manipulate.
Weak Randomness
Maintained by Sigvex Team Reviewed
Detects Solana programs that derive randomness from predictable on-chain sources such as clock timestamps, slot numbers, or account hashes.
Witness Complexity
Maintained by Sigvex Team Reviewed
Detects unconstrained witness expressions that combine several nondeterministic operations, where the constraint set is unlikely to fully rebind the result.
Wrapped Native Token Confusion
Maintained by Sigvex Team Reviewed
Detects contracts that conflate WETH and native ETH handling, causing stuck funds or incorrect transfer logic.
Zero Copy Deserialization
Maintained by Sigvex Team Reviewed
Detects unsafe zero-copy deserialization patterns that can lead to memory corruption.
AA Signature Audit
Maintained by Sigvex Team Reviewed
Detects signature vulnerabilities in account abstraction implementations including missing chain ID, replay across accounts, and malleability.
Anchor Space Allocation
Maintained by Sigvex Team Reviewed
Detects incorrect space allocation in Anchor account initialization.
Array Deletion Index
Maintained by Sigvex Team Reviewed
Detects unsafe array element deletion that leaves stale indices or gaps, corrupting data structures that depend on contiguous arrays.
Array Length Assumption
Maintained by Sigvex Team Reviewed
Detects parallel array operations that assume equal lengths without validation, risking out-of-bounds access or incomplete processing.
Blob Data Dependency
Maintained by Sigvex Team Reviewed
Detects contracts that depend on EIP-4844 blob data availability, which is only guaranteed for a limited time window.
Borsh Length DoS
Maintained by Sigvex Team Reviewed
Detects unbounded Borsh Vec/String length prefix usage that can cause DoS.
Bytecode Size Limit
Maintained by Sigvex Team Reviewed
Detects contracts approaching or exceeding the EIP-170 24KB bytecode size limit, which prevents deployment.
Cairo External Without Validation
Maintained by Sigvex Team Reviewed
Detects external, state-mutating Cairo functions that accept parameters but contain no assertions, trusting arbitrary caller-supplied input.
Cairo Unchecked Division
Maintained by Sigvex Team Reviewed
Detects division in Cairo functions where the divisor is not asserted non-zero, risking transaction aborts and surprising quotients under field semantics.
Cairo Unchecked Felt Arithmetic
Maintained by Sigvex Team Reviewed
Detects felt252 arithmetic in state-changing Cairo functions that has no bounding assertion and may wrap silently around the Starknet field prime.
Calls in Loop
Maintained by Sigvex Team Reviewed
Detects external calls inside loops that can cause denial-of-service when any single call reverts or the loop exceeds the block gas limit.
Clock Account Spoofing
Maintained by Sigvex Team Reviewed
Detects programs that read time data from unvalidated accounts instead of the canonical Clock sysvar, enabling timestamp manipulation.
Clock Staleness
Maintained by Sigvex Team Reviewed
Detects Clock sysvar usage in financial logic without staleness bounds, exploitable after network halts.
Compute Budget Injection
Maintained by Sigvex Team Reviewed
Detects hardcoded compute budget assumptions vulnerable to injection.
Constraint Degree Overflow
Maintained by Sigvex Team Reviewed
Detects constraint expressions whose multiplicative degree exceeds the proof system's gate degree, forcing expansion or breaking compilation.
Cross-Contract Consistency
Maintained by Sigvex Team Reviewed
Detects cross-account state consistency issues.
Default Visibility
Maintained by Sigvex Team Reviewed
Detects functions and state variables with implicit visibility that may unintentionally be public.
Denial of Service
Maintained by Sigvex Team Reviewed
Detects patterns that allow attackers to permanently block contract execution, including unbounded loops, push-payment patterns, and external call failures in critical paths.
Deprecated Functions
Maintained by Sigvex Team Reviewed
Detects usage of deprecated Solidity functions and constructs that may be removed in future compiler versions.
Deserialization Endianness
Maintained by Sigvex Team Reviewed
Detects potential endianness mismatches in data deserialization.
Divide Before Multiply
Maintained by Sigvex Team Reviewed
Detects arithmetic expressions where division precedes multiplication, causing precision loss from integer truncation.
Dropped Side Effects on .selector Access
Maintained by Sigvex Team Reviewed
Flags contracts compiled with Solidity 0.6.2 through 0.8.20 on the legacy pipeline, where side effects of an expression before .selector could be silently discarded.
Duplicate Mutable Accounts
Maintained by Sigvex Team Reviewed
Detects when the same account is passed at multiple positions in an instruction where both references are mutable, creating aliasing bugs and undefined behavior.
Emergency Pause
Maintained by Sigvex Team Reviewed
Detects missing or vulnerable emergency pause mechanisms in Solana programs.
ERC-165 Interface Spoofing
Maintained by Sigvex Team Reviewed
Detects contracts that falsely claim ERC-165 interface support, enabling type confusion attacks in routers, marketplaces, and bridges.
ERC-20 Approve Race
Maintained by Sigvex Team Reviewed
Detects ERC-20 approve functions vulnerable to the front-running race condition where a spender can spend both old and new allowances.
ERC-20 Standard Violations
Maintained by Sigvex Team Reviewed
Detects deviations from the ERC-20 token standard including missing return values, incorrect event signatures, and non-standard behavior.
Field Overflow Deep Multiplication
Maintained by Sigvex Team Reviewed
Detects assignments that multiply enough signals together for the product to exceed the field modulus, so a value the circuit treats as an integer silently wraps.
Front-Running
Maintained by Sigvex Team Reviewed
Detects transactions where the outcome depends on call ordering, enabling miners or other users to manipulate execution order for profit.
Hardcoded Gas Values
Maintained by Sigvex Team Reviewed
Detects hardcoded gas stipends and gas limits that break when EVM gas costs change across hard forks or L2 environments.
Hash Collision
Maintained by Sigvex Team Reviewed
Detects abi.encodePacked usage with multiple dynamic types that can produce hash collisions via data concatenation ambiguity.
Improper Error Handling
Maintained by Sigvex Team Reviewed
Detects silently ignored errors or improper error propagation in Solana programs.
Incorrect Comparison
Maintained by Sigvex Team Reviewed
Detects comparison operators that are likely wrong — using = instead of ==, > instead of >=, or comparing incompatible types.
Inheritance Order
Maintained by Sigvex Team Reviewed
Detects diamond inheritance patterns, conflicting overrides, and overlapping modifier chains that C3 linearization can resolve unexpectedly.
Instruction Data Parsing Edge Cases
Maintained by Sigvex Team Reviewed
Detects unsafe instruction data parsing patterns that may cause panics or errors with malformed data.
Keccak256 Optimizer Result Reuse
Maintained by Sigvex Team Reviewed
Flags contracts compiled with Solidity below 0.8.3 where the optimizer can reuse a keccak256 result across two differing input lengths that round to the same 32-byte multiple.
Lamport Dust
Maintained by Sigvex Team Reviewed
Detects lamport dust exploitation vulnerabilities in Solana programs.
Missing Input Validation
Maintained by Sigvex Team Reviewed
Detects functions that accept user-supplied parameters and use them in sensitive operations without sufficient bounds checking, type validation, or access control enforcement.
Missing Range Check
Maintained by Sigvex Team Reviewed
Detects signals consumed by bit-width-sensitive components without a preceding range constraint, enabling silent overflow of comparators and bit decompositions.
Missing Zero Address Validation
Maintained by Sigvex Team Reviewed
Detects functions that accept address parameters without checking for the zero address, risking permanent fund loss.
Mixed Assignment Types
Maintained by Sigvex Team Reviewed
Detects a signal assigned with both the witness-only operator and the constraining operator in the same template, which usually means one branch of a conditional forgot its constraint.
NFT Metadata Validation
Maintained by Sigvex Team Reviewed
Detects NFT metadata validation issues.
Non-Anchor Discriminator
Maintained by Sigvex Team Reviewed
Detects missing instruction discrimination in non-Anchor Solana programs.
Oracle Manipulation
Maintained by Sigvex Team Reviewed
Detects Solana programs that rely on unvalidated or manipulable price oracle data, enabling attackers to trigger liquidations, drain vaults, or manipulate DeFi calculations.
Outdated Compiler
Maintained by Sigvex Team Reviewed
Detects contracts compiled with Solidity versions affected by published compiler advisories, using bytecode metadata for version evidence.
Parameter Count Mismatch
Maintained by Sigvex Team Reviewed
A planned Circom check for component instantiations whose argument count does not match the template's parameter list; the identifier is registered but no analysis emits it yet.
PDA Path Confusion
Maintained by Sigvex Team Reviewed
Detects PDA derivations without program-specific namespace seeds, risking cross-program collisions.
Readonly Misuse
Maintained by Sigvex Team Reviewed
Detects semantic misuse of readonly accounts.
Rent Exempt Epoch Transition
Maintained by Sigvex Team Reviewed
Detects cached rent-exempt minimum balances that become stale across epoch transitions.
Requirement Violation
Maintained by Sigvex Team Reviewed
Detects functions where require/assert conditions can be violated through specific input combinations or state manipulation.
Returnbomb
Maintained by Sigvex Team Reviewed
Detects external calls vulnerable to returnbomb attacks where a malicious callee returns excessive data to cause out-of-gas reverts.
Royalty Bypass
Maintained by Sigvex Team Reviewed
Detects NFT marketplace and token contracts where ERC-2981 royalty payments can be circumvented through wrapper contracts or direct transfers.
Secp256k1 Signature Malleability
Maintained by Sigvex Team Reviewed
Detects Secp256k1 signature verification without canonicalization checks.
Signal Aliasing
Maintained by Sigvex Team Reviewed
Detects redundant equality constraints that create signal aliases without adding security, potentially masking missing constraints.
Signal as Array Index
Maintained by Sigvex Team Reviewed
Detects array accesses indexed by an unconstrained signal, giving the prover a free choice of which element is read.
Signature Malleability
Maintained by Sigvex Team Reviewed
Detects ECDSA signature verification that fails to check s-value bounds, v-value validity, or zero-address returns from ecrecover.
Solidity Calldata Re-encoding Miscompilations
Maintained by Sigvex Team Reviewed
Flags contracts compiled with Solidity versions affected by the 2022 ABI-encoder calldata re-encoding bugs that can corrupt forwarded calldata.
SPL Token Compliance
Maintained by Sigvex Team Reviewed
Detects SPL Token standard compliance violations.
SPL Token Delegation Chain Depth
Maintained by Sigvex Team Reviewed
Detects excessive delegation chain depth that increases attack surface and complexity.
SPL Token Metadata Validation
Maintained by Sigvex Team Reviewed
Detects metadata validation issues including missing PDA checks, update authority verification, and URI validation.
State Leakage Intermediate
Maintained by Sigvex Team Reviewed
Detects intermediate signals computed with an unconstrained assignment that have no constraint path to any output, so the verifier never sees their value.
Sysvar Cache Staleness
Maintained by Sigvex Team Reviewed
Detects stale sysvar data usage across blocks beyond Clock.
Tautological Compare
Maintained by Sigvex Team Reviewed
Detects comparisons that are always true or always false due to type constraints, rendering conditional logic dead.
the Metaplex Token Metadata program Compliance
Maintained by Sigvex Team Reviewed
Detects the Metaplex Token Metadata program metadata standard compliance violations.
Timelock Operations
Maintained by Sigvex Team Reviewed
Detects timelock bypass vulnerabilities, missing delays for critical operations, and timestamp validation issues.
Timestamp Dependence
Maintained by Sigvex Team Reviewed
Detects reliance on block.timestamp for time-sensitive logic where validator manipulation of the timestamp by up to ~15 seconds can influence outcomes.
Timestamp Dependency
Maintained by Sigvex Team Reviewed
Detects dangerous dependencies on block timestamps in security-critical logic including access control and randomness.
Token Init Race
Maintained by Sigvex Team Reviewed
Detects token account initialization race conditions.
Transaction Size DoS
Maintained by Sigvex Team Reviewed
Detects unbounded account lists in CPI that can cause transaction size DoS.
tx.origin Authentication
Maintained by Sigvex Team Reviewed
Detects use of tx.origin for authentication or access control, which allows phishing attacks to bypass authorization checks.
Typographical Error
Maintained by Sigvex Team Reviewed
Detects bytecode patterns left by operator typos: =+ instead of +=, identity assignments, and consecutive operations that cancel out.
Unsafe Deserialization
Maintained by Sigvex Team Reviewed
Detects potentially unsafe account data access patterns without bounds checking.
Unsafe Field Downcast in Noir Circuits
Maintained by Sigvex Team Reviewed
Flags Noir functions that convert a Field input to a smaller integer type without a range check that prevents silent truncation.
Unused Component Output
Maintained by Sigvex Team Reviewed
Detects components whose inputs are wired but whose outputs are never read or constrained, so a check computes an answer that nothing enforces.
Unused Signals
Maintained by Sigvex Team Reviewed
Detects declared signals that never appear in any constraint or assignment, indicating dead code or incomplete circuit logic.
Variable Shadowing
Maintained by Sigvex Team Reviewed
Detects local variables or inherited state variables that shadow declarations in parent contracts, causing confusion about which variable is accessed.
Weak PDA Entropy
Maintained by Sigvex Team Reviewed
Detects PDA derivations with weak seed entropy, enabling prediction and front-running attacks.
Write After Write
Maintained by Sigvex Team Reviewed
Detects redundant storage writes where a variable is written twice without an intervening read, wasting gas and potentially indicating logic errors.
Zero Amount Operation
Maintained by Sigvex Team Reviewed
Detects token operations that may accept zero amounts without explicit validation.
Cairo Narrow Int Return
Maintained by Sigvex Team Reviewed
Detects Cairo functions that take a felt252 input and return a narrow integer type without a range check, exposing a denial-of-service surface on out-of-range inputs.
Compute Budget Accounting
Maintained by Sigvex Team Reviewed
Detects loops and recursive call patterns that consume compute units without bounds or budget checks, causing unpredictable mid-execution transaction failures.
Dead Signal
Maintained by Sigvex Team Reviewed
Detects intermediate signals that are declared but never assigned, leaving a witness slot with no defined value and, usually, a check that was never wired in.
Ether Balance Assumption
Maintained by Sigvex Team Reviewed
Detects contracts that assume their ETH balance equals the sum of deposits, ignoring forcibly sent ETH via selfdestruct or coinbase transactions.
External State Mutation
Maintained by Sigvex Team Reviewed
A baseline informational hint marking every external, non-view Cairo entrypoint that can change contract state, so reviewers can confirm checks-effects-interactions ordering.
Floating Pragma
Maintained by Sigvex Team Reviewed
Detects contracts compiled with a floating pragma version that may produce different bytecode across compiler versions.
Frozen Account Operations
Maintained by Sigvex Team Reviewed
Detects token operations performed without checking if the account is frozen.
Hardcoded System Program Address
Maintained by Sigvex Team Reviewed
Detects hardcoded system program addresses instead of using named constants for program IDs.
Hardcoded Sysvar Address
Maintained by Sigvex Team Reviewed
Detects hardcoded sysvar addresses instead of using proper sysvar::id() derivation functions.
Missing Events
Maintained by Sigvex Team Reviewed
Detects critical state-changing operations that do not emit events, reducing transparency and making off-chain monitoring impossible.
Missing Rent Check
Maintained by Sigvex Team Reviewed
Detects potential rent exemption issues from lamport transfers.
Missing Writable Check
Maintained by Sigvex Team Reviewed
Detects account modifications performed without verifying the is_writable flag, allowing read-only accounts to be silently corrupted or causing runtime errors.
Program Interface Compliance
Maintained by Sigvex Team Reviewed
Detects program interface compliance issues.
Readonly Account Mutation
Maintained by Sigvex Team Reviewed
Detects attempts to modify accounts that have been verified as readonly.
Rent Epoch Validation
Maintained by Sigvex Team Reviewed
Detects improper rent epoch validation and handling.
Unchecked Arithmetic
Maintained by Sigvex Team Reviewed
Detects unchecked arithmetic operations that could silently overflow or underflow in SVM programs.
Unused Intermediate Signal
Maintained by Sigvex Team Reviewed
Detects intermediate signals that are assigned but never read by any later assignment or constraint, which points at dead computation or a comparison that was never written.
Dead Code
Maintained by Sigvex Team Reviewed
Detects unreachable code paths and unused internal functions that increase bytecode size and may indicate logic errors.
Gas Optimization
Maintained by Sigvex Team Reviewed
Identifies repeated storage reads of the same slot within a function that could be cached in memory to save gas.
Incomplete Analysis Missing Template
Maintained by Sigvex Team Reviewed
Reports a template that the circuit instantiates but the analysed source never defines, so part of the constraint system was not examined and an empty findings list must not be read as a clean one.
Private Data Exposure
Maintained by Sigvex Team Reviewed
Detects contracts storing sensitive data in private or internal state variables, which remain readable on-chain despite the visibility modifier.
Unused Variables
Maintained by Sigvex Team Reviewed
Detects storage slots that are written but never read and local variables assigned but never used, indicating dead state or incomplete logic.
AA Signature Audit Remediation
Maintained by Sigvex Team Reviewed
Bind smart-account signatures to the EntryPoint-provided userOpHash so they cannot be replayed across chains or accounts.
AA Storage Access Violations Remediation
Maintained by Sigvex Team Reviewed
Keep ERC-4337 validation free of banned opcodes and non-associated storage so bundlers can safely simulate the operation.
Access Control Bypass Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates missing access control by calling privileged functions from an unauthorized address and checking for storage mutations.
Access Control Remediation
Maintained by Sigvex Team Reviewed
How to implement proper access controls on privileged functions using ownership patterns, role-based access, and multi-signature authorization.
Account Abstraction (ERC-4337) Remediation
Maintained by Sigvex Team Reviewed
Keep ERC-4337 validation free of banned opcodes and unrestricted storage, and verify signatures against the EntryPoint userOpHash.
Account Close Balance Check Remediation
Maintained by Sigvex Team Reviewed
How to fix incomplete account close operations that leave data intact after draining lamports.
Account Close Discriminator Remediation
Maintained by Sigvex Team Reviewed
How to fix missing discriminator zeroing on account close.
Account Close Reopen Race Remediation
Maintained by Sigvex Team Reviewed
How to fix TOCTOU race conditions from account close/reopen between transactions.
Account Executable Flag Remediation
Maintained by Sigvex Team Reviewed
How to fix missing executable flag validation before cross-program invocations.
Account Index Bounds Remediation
Maintained by Sigvex Team Reviewed
How to fix account array access without bounds validation.
Account Iterator Bounds Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe iteration over account arrays without bounds validation.
Account Layout Version Remediation
Maintained by Sigvex Team Reviewed
How to fix account deserialization that lacks version validation.
Account List Size Remediation
Maintained by Sigvex Team Reviewed
How to fix missing account list size validation for fixed account layouts.
Account Owner Chain Remediation
Maintained by Sigvex Team Reviewed
How to fix stale owner validation across CPI boundaries.
Account Realloc Corruption Remediation
Maintained by Sigvex Team Reviewed
How to fix account reallocation data corruption vulnerabilities.
Account Reallocation Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe account reallocation patterns.
Account Resurrection Remediation
Maintained by Sigvex Team Reviewed
How to fix account resurrection vulnerabilities from PDA re-derivation.
Account Type Confusion Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates account type confusion vulnerabilities in Solana programs by simulating an attack that passes a wrong account type to an instruction, bypassing type-based access controls.
Account Type Confusion Remediation
Maintained by Sigvex Team Reviewed
How to validate account discriminators and use the account-validation framework's typed account system to prevent attackers from substituting accounts of the wrong type.
Account Use After Close Remediation
Maintained by Sigvex Team Reviewed
How to fix use-after-close vulnerabilities in Solana programs.
Account Verification Chain Remediation
Maintained by Sigvex Team Reviewed
How to fix incomplete account verification chains by adding missing validation checks.
Address Lookup Table Poisoning Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe Address Lookup Table usage by validating table authority and loaded addresses.
Admin Key Management Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe admin key handling, hardcoded keys, and single points of failure.
Anchor Constraint Bypass Remediation
Maintained by Sigvex Team Reviewed
How to fix missing or insufficient Anchor account constraints that allow unauthorized account substitution.
Anchor Constraint TOCTOU Remediation
Maintained by Sigvex Team Reviewed
How to fix TOCTOU race conditions in an account-validation framework constraints.
Anchor Discriminator Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing Anchor discriminator validation.
Anchor IDL Mismatch Remediation
Maintained by Sigvex Team Reviewed
How to fix Anchor IDL and program implementation mismatches.
Anchor Init/Close Patterns Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe Anchor init and close patterns.
Anchor Space Allocation Remediation
Maintained by Sigvex Team Reviewed
How to fix incorrect Anchor space allocation.
Anchor Upgrade Security Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe an account-validation framework program upgrade patterns.
API/Off-Chain Data Manipulation Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates off-chain data trust vulnerabilities where contracts accept external API data without signature verification, freshness checks, or redundancy — enabling data injection, replay attacks, and single-point-of-failure exploits.
API/Off-Chain Data Remediation
Maintained by Sigvex Team Reviewed
How to secure contracts that consume off-chain data by requiring cryptographic signatures, freshness timestamps, and multiple independent sources to prevent data injection and replay attacks.
Arbitrary CPI Remediation
Maintained by Sigvex Team Reviewed
How to validate cross-program invocation targets to prevent attackers from redirecting CPI calls to malicious programs.
Arbitrary ERC-20 Transfer Remediation
Maintained by Sigvex Team Reviewed
Add access control to functions that move a contract's tokens so callers cannot redirect the balance to themselves.
Arbitrary Jump Remediation
Maintained by Sigvex Team Reviewed
How to eliminate control-flow hijacking by never deriving a JUMP destination from user input — use structured dispatch instead of computed jumps.
Arbitrary Storage Write Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates arbitrary storage write vulnerabilities by simulating user-controlled SSTORE operations targeting critical storage slots including the owner address.
Arbitrary Storage Write Remediation
Maintained by Sigvex Team Reviewed
Stop user-controlled storage slots by writing only through mappings and arrays under access control.
Arbitrary Storage Write Remediation
Maintained by Sigvex Team Reviewed
How to eliminate arbitrary storage write vulnerabilities by removing user-controlled assembly SSTORE operations, using Solidity mappings, and enforcing slot allowlists for unavoidable inline assembly.
Arithmetic Overflow Exploit Generator
Maintained by Sigvex Team Reviewed
Exploit generator that validates unchecked arithmetic vulnerabilities in Solana programs where integer overflow or underflow in token balance calculations allows fund theft or state corruption.
Arithmetic Overflow Remediation
Maintained by Sigvex Team Reviewed
How to prevent integer overflow and underflow in Solana programs by replacing unchecked arithmetic with checked methods and safe intermediate widening.
Array Deletion Index Remediation
Maintained by Sigvex Team Reviewed
Remove storage array elements with swap-and-pop so no zero-value gap is left behind for later iterations.
Array Length Assumption Remediation
Maintained by Sigvex Team Reviewed
Require parallel array parameters to have equal lengths before iterating over them together.
Assembly Analysis Remediation
Maintained by Sigvex Team Reviewed
Make inline assembly memory-safe, bound returndata copies, and add overflow guards that Solidity would otherwise provide.
Assert Violation Remediation
Maintained by Sigvex Team Reviewed
Validate external inputs with require() and reserve assert() for invariants that should never be false.
Balance Accounting Mismatch Remediation
Maintained by Sigvex Team Reviewed
How to record the amount actually received by measuring the balance delta, so fee-on-transfer and rebasing tokens can't desync your books.
Batch Operation Atomicity Remediation
Maintained by Sigvex Team Reviewed
How to make batch functions behave predictably: choose all-or-nothing or per-item isolation deliberately, and never silently skip.
Bit Shift Overflow Remediation
Maintained by Sigvex Team Reviewed
How to avoid zeroed results from oversized shifts by bounding the shift amount.
Blob Dependency Remediation
Maintained by Sigvex Team Reviewed
How to use EIP-4844 blob data safely by committing to it on-chain and respecting the ~18-day availability window.
Borsh Length DoS Remediation
Maintained by Sigvex Team Reviewed
How to fix unbounded Borsh length prefix DoS vulnerabilities.
Breaking Flash Loan and Governance Attack Chains
Maintained by Sigvex Team Reviewed
How to remove more than one link from a chained exploit, so that borrowed capital plus a live-state read can no longer compose into a single-transaction takeover.
Bridge Message Manipulation Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates cross-chain bridge vulnerabilities including message replay, cross-chain replay, and Nomad-style uninitialized state exploitation.
Bridge Message Remediation
Maintained by Sigvex Team Reviewed
How to secure cross-chain bridge message processing by implementing nonce-based replay protection, chain ID binding, explicit state initialization, and validator threshold requirements.
Bump Seed Brute Force Remediation
Maintained by Sigvex Team Reviewed
How to fix user-controlled bump seeds in PDA derivation.
Bump Seed Canonicalization Remediation
Maintained by Sigvex Team Reviewed
How to ensure PDA derivation uses the canonical bump seed from find_program_address rather than create_program_address with an attacker-supplied bump.
Bytecode Size Limit Remediation
Maintained by Sigvex Team Reviewed
How to bring an oversized contract under the EIP-170 24,576-byte limit with modularization and the diamond pattern.
Cairo External Without Validation Remediation
Maintained by Sigvex Team Reviewed
How to add caller and input validation to external, state-mutating Cairo functions so they no longer trust arbitrary caller-supplied data.
Calls in Loop Remediation
Maintained by Sigvex Team Reviewed
How to stop one failing recipient from blocking everyone by removing external calls from loops with the pull-payment pattern.
Centralization Risks Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates centralization risk findings by classifying the specific privilege type and documenting the trust assumptions and attack scenarios enabled by single-owner control.
Centralization Risks Remediation
Maintained by Sigvex Team Reviewed
How to reduce centralization risk through timelocks, multi-signature wallets, on-chain governance, and hard-coded parameter caps that protect users from compromised or malicious admins.
Clock Account Spoofing Remediation
Maintained by Sigvex Team Reviewed
How to prevent spoofed Clock sysvar accounts from manipulating time-dependent program logic.
Clock Staleness Remediation
Maintained by Sigvex Team Reviewed
How to fix Clock sysvar usage in financial logic to prevent post-halt exploitation.
Close Account Drain Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates close account drain vulnerabilities in Solana programs where accounts are improperly closed, allowing an attacker to steal the rent lamports or reuse the account after closure.
Close Account Drain Remediation
Maintained by Sigvex Team Reviewed
How to safely close Solana accounts by zeroing data, verifying authority, and using the account-validation framework's close constraint to prevent rent lamport theft.
Compressed NFT Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix compressed NFT Merkle proof and authority vulnerabilities.
Compute Budget Accounting Remediation
Maintained by Sigvex Team Reviewed
How to make compute costs predictable by bounding loops, batching with cursors, and checking remaining compute units before expensive operations.
Compute Budget Injection Remediation
Maintained by Sigvex Team Reviewed
How to fix hardcoded compute budget assumptions.
Compute Exhaustion Remediation
Maintained by Sigvex Team Reviewed
How to fix compute unit budget exhaustion issues.
Conditional Ownership Bypass Remediation
Maintained by Sigvex Team Reviewed
How to fix ownership checks that can be bypassed through conditional logic.
Conditional Storage Collision Remediation
Maintained by Sigvex Team Reviewed
How to prevent path-dependent storage slot collisions between a proxy and its implementation by anchoring administrative state in standard EIP-1967 slots.
Conditional Validation Bypass Remediation
Maintained by Sigvex Team Reviewed
How to ensure security validations execute unconditionally on all paths to critical operations.
Constraint Degree Overflow Remediation
Maintained by Sigvex Team Reviewed
How to fix constraints that exceed the R1CS quadratic degree limit by decomposing into intermediate signals.
Controlled Array Length Remediation
Maintained by Sigvex Team Reviewed
How to prevent unbounded-array gas DoS by capping growth and avoiding whole-array iteration.
CPI Account List Mismatch Remediation
Maintained by Sigvex Team Reviewed
How to fix CPI calls with unvalidated account lists.
CPI Authority Downgrade Remediation
Maintained by Sigvex Team Reviewed
How to prevent privileged accounts from being delegated to unvalidated programs via cross-program invocations.
CPI Cycle Remediation
Maintained by Sigvex Team Reviewed
How to fix circular CPI patterns that cause infinite loops or depth limit failures.
CPI Data Tampering Remediation
Maintained by Sigvex Team Reviewed
How to fix CPI calls with unvalidated instruction data from untrusted sources.
CPI in Loop DOS Remediation
Maintained by Sigvex Team Reviewed
How to fix CPI calls inside loops that can exhaust compute budget.
CPI Reentrancy Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates Cross-Program Invocation (CPI) reentrancy vulnerabilities in Solana programs by simulating a malicious program that re-enters the victim program during a CPI callback before state is updated.
CPI Return Value Forgery Remediation
Maintained by Sigvex Team Reviewed
How to prevent forged CPI return data from influencing critical program operations.
CPI Signer Propagation Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe signer propagation in nested CPI calls.
CPI Signer Simulation Remediation
Maintained by Sigvex Team Reviewed
How to prevent false signer claims in cross-program invocations by validating signer status before CPI calls.
CREATE2 Collision Remediation
Maintained by Sigvex Team Reviewed
How to keep CREATE2 deployments safe by using unpredictable salts and never trusting a redeployable address.
Critical Program ID Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing validation of critical system program IDs before CPI.
Critical Truncation Remediation
Maintained by Sigvex Team Reviewed
How to fix integer truncation in lamport transfers, account storage, and access control.
Cross-Account Relationship Remediation
Maintained by Sigvex Team Reviewed
How to fix missing relationship validation between related accounts.
Cross-Chain Balance Inconsistency Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates cross-chain bridge balance inconsistency vulnerabilities including replay attacks, non-atomic operations, weak proof verification, and finality exploits that allow token supply inflation on the destination chain.
Cross-Chain Balance Inconsistency Remediation
Maintained by Sigvex Team Reviewed
How to eliminate cross-chain bridge balance vulnerabilities by implementing proof deduplication, deep finality requirements, Merkle proof verification, and the lock-and-mint pattern.
Cross-Chain Oracle Inconsistency Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates cross-chain oracle inconsistency vulnerabilities including L2 sequencer downtime, oracle price lag between chains, and missing the off-chain aggregator sequencer uptime feed checks.
Cross-Chain Oracle Inconsistency Remediation
Maintained by Sigvex Team Reviewed
How to eliminate cross-chain oracle vulnerabilities by adding L2 sequencer uptime checks, grace period enforcement, and cross-source price deviation validation before reading any off-chain aggregated price feed on L2 networks.
Cross-Contract Consistency Remediation
Maintained by Sigvex Team Reviewed
How to fix cross-account state consistency issues.
Cross-Contract Taint Remediation
Maintained by Sigvex Team Reviewed
How to stop untrusted external-call return values from steering access control, transfers, or storage keys.
Cross-Function Reentrancy Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates cross-function reentrancy vulnerabilities where shared state is inconsistent across multiple functions during an external call.
Cross-Function Reentrancy Remediation
Maintained by Sigvex Team Reviewed
How to prevent cross-function reentrancy by applying the Checks-Effects-Interactions pattern and reentrancy guards to all functions sharing the same state.
Cross-Program Reinit Remediation
Maintained by Sigvex Team Reviewed
How to prevent account re-initialization through cross-program sequences by re-validating discriminators, owners, and version fields after every CPI.
Cross-Template Constraint Gap Remediation
Maintained by Sigvex Team Reviewed
How to fix broken constraint chains between template instances by using constrained wiring.
Dead Code Remediation
Maintained by Sigvex Team Reviewed
How to handle unreachable code: remove it, or restore the path that was supposed to reach it.
Dead Signal Remediation
Maintained by Sigvex Team Reviewed
How to resolve intermediate signals that are declared but never assigned, by wiring them to the check they were meant to anchor or removing them.
Default Visibility Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates default visibility vulnerabilities in Solidity contracts where missing visibility modifiers default to public, exposing sensitive initialization and admin functions.
Default Visibility Remediation
Maintained by Sigvex Team Reviewed
How to eliminate default visibility vulnerabilities by always specifying explicit visibility modifiers on all functions and state variables, and upgrading to Solidity 0.5.0+ which enforces this at compile time.
DeFi Reentrancy Remediation
Maintained by Sigvex Team Reviewed
How to prevent DeFi reentrancy by following the checks-effects-interactions pattern in vault, lending, and staking operations.
Delegatecall Injection Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates unvalidated delegatecall targets by passing attacker-controlled contract addresses and checking for storage slot mutations.
Delegatecall Remediation
Maintained by Sigvex Team Reviewed
How to safely use delegatecall in proxy patterns by validating the target address and using EIP-1967 storage slots to prevent storage collisions.
Denial of Service Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates DoS vulnerabilities by simulating unbounded loop execution and external call blocking scenarios to confirm contracts can be permanently disabled.
Denial of Service Remediation
Maintained by Sigvex Team Reviewed
How to eliminate denial-of-service vulnerabilities by replacing push-based ETH distribution with pull withdrawal patterns and adding maximum batch sizes and pagination to prevent unbounded loop gas exhaustion.
Denial of Service Remediation
Maintained by Sigvex Team Reviewed
How to prevent DoS vulnerabilities in Solidity by replacing push-payment patterns with pull payments and bounding loop iterations.
Deprecated Functions Remediation
Maintained by Sigvex Team Reviewed
How to replace removed or deprecated Solidity constructs with their modern, safe equivalents.
Deserialization Attack Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates unsafe deserialization vulnerabilities in Solana programs where crafted account data causes incorrect state interpretation, type confusion, or panic in the deserialization layer.
Deserialization Attack Remediation
Maintained by Sigvex Team Reviewed
How to safely deserialize Solana account data by validating discriminators, checking program ownership, and using the account-validation framework's typed account system.
Deserialization Endianness Remediation
Maintained by Sigvex Team Reviewed
How to fix endianness mismatches in data deserialization.
Diamond Collision Remediation
Maintained by Sigvex Team Reviewed
How to prevent storage slot collisions between facets in an EIP-2535 diamond by giving each facet its own namespaced storage struct.
Disconnected Component Remediation
Maintained by Sigvex Team Reviewed
How to wire an orphaned component instance into the parent's constraint system, or remove it, so its checks actually apply to the circuit.
Divide Before Multiply Remediation
Maintained by Sigvex Team Reviewed
How to avoid precision loss in integer math by ordering operations to multiply before dividing.
Division by Zero Remediation
Maintained by Sigvex Team Reviewed
How to prevent reverts and corrupted math by guarding divisors that can reach zero.
Division by Zero Remediation
Maintained by Sigvex Team Reviewed
How to fix division operations where the divisor may be zero, preventing panics and DoS.
Division by Zero Remediation
Maintained by Sigvex Team Reviewed
How to prevent division-by-zero risks in ZK circuits by adding non-zero constraints on divisor signals.
DoS Compute Exhaustion Remediation
Maintained by Sigvex Team Reviewed
How to fix denial-of-service via compute unit exhaustion.
Double Constraining Assignment Remediation
Maintained by Sigvex Team Reviewed
How to restructure a signal that is assigned with <== twice, keeping both relations as constraints instead of downgrading one to a witness hint.
Duplicate Mutable Accounts Remediation
Maintained by Sigvex Team Reviewed
How to prevent duplicate mutable account aliasing in Solana programs by adding key equality constraints and explicit address comparisons.
Durable Nonce Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing validation when interacting with durable nonce accounts.
Ed25519 Signature Malleability Remediation
Maintained by Sigvex Team Reviewed
How to fix Ed25519 signature verification to prevent malleability attacks.
Emergency Pause Remediation
Maintained by Sigvex Team Reviewed
How to fix missing or vulnerable emergency pause mechanisms in Solana programs.
Empty Code Detection Remediation
Maintained by Sigvex Team Reviewed
How to stop a low-level call to a codeless address from silently succeeding, so a contract never records an interaction that never happened.
ERC-1155 Standard Violations Remediation
Maintained by Sigvex Team Reviewed
Validate batch array lengths, invoke receiver callbacks, and declare ERC-165 support to make multi-token contracts standard-compliant.
ERC-1271 Signature Verification Remediation
Maintained by Sigvex Team Reviewed
How to verify signatures safely for smart-contract signers: check the magic value, support both EOA and contract signers, and guard the call.
ERC-165 Interface Spoofing Remediation
Maintained by Sigvex Team Reviewed
How to avoid trusting a forged supportsInterface response by verifying behaviour, not just the interface flag.
ERC-20 Approve Race Remediation
Maintained by Sigvex Team Reviewed
How to avoid the ERC-20 approval front-running race by using allowance deltas or a set-to-zero-first pattern.
ERC-721 Standard Violations Remediation
Maintained by Sigvex Team Reviewed
Implement safe transfer callbacks, correct events, and ERC-165 support to make NFT contracts standard-compliant.
ERC20 Violations Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates ERC20 standard violations by simulating non-standard token behaviors including missing return values, fee-on-transfer tokens, and rebase tokens.
ERC20 Violations Remediation
Maintained by Sigvex Team Reviewed
How to eliminate ERC20 integration vulnerabilities by using SafeERC20 for all token operations, measuring actual received amounts for fee-on-transfer tokens, and handling non-standard token behaviors such as missing return values and rebase mechanics.
Ether Balance Assumption Remediation
Maintained by Sigvex Team Reviewed
Track deposits with internal accounting instead of relying on address(this).balance, which can be inflated by forced ETH.
EVM Contract Fuzzing Framework
Maintained by Sigvex Team Reviewed
Sigvex coverage-guided EVM fuzzing framework with ABI-aware input generation, property-based invariant checking, symbolic execution, multi-contract execution, and transaction sequence fuzzing.
EXTCODESIZE Bypass Remediation
Maintained by Sigvex Team Reviewed
Why code-size checks do not reliably distinguish EOAs from contracts, and what to do instead when a function must be restricted to externally owned accounts.
Fee-on-Transfer Remediation
Maintained by Sigvex Team Reviewed
Measure the actual received balance after transferFrom instead of trusting the requested amount.
Feedback Loop Remediation
Maintained by Sigvex Team Reviewed
How to fix circular signal dependencies that create unsatisfiable or ambiguous constraint systems.
Field Overflow Deep Multiplication Remediation
Maintained by Sigvex Team Reviewed
How to keep multi-signal products below the field modulus by bounding operands and staging the multiplication through constrained intermediates.
Field Overflow Exponentiation Remediation
Maintained by Sigvex Team Reviewed
How to replace exponentiation in circuits with constrained multiplication chains whose operands are bounded below the field modulus.
Field Overflow Remediation
Maintained by Sigvex Team Reviewed
How to prevent field overflow in ZK circuit arithmetic by adding range constraints on signals before operations.
Field Underflow Negation Remediation
Maintained by Sigvex Team Reviewed
How to remove witness-only negation from circuits and represent signed quantities in a way the constraint system can check.
Field Underflow Subtraction Remediation
Maintained by Sigvex Team Reviewed
How to prevent field wrap-around in subtractions by proving operand ordering and range-constraining the result.
Flash Loan Attack Vector Remediation
Maintained by Sigvex Team Reviewed
How to eliminate flash loan attack surfaces by replacing manipulable spot prices with time-weighted average prices and adding sanity bounds on price inputs.
Flash Loan Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates flash loan vulnerabilities by comparing contract execution under normal vs. temporarily-inflated balance conditions.
Flash Loan Validation Remediation
Maintained by Sigvex Team Reviewed
How to enforce flash loan repayment validation to prevent borrowers from defaulting on loans.
Floating Pragma Remediation
Maintained by Sigvex Team Reviewed
Pin the Solidity compiler version so deployed bytecode matches what was reviewed.
Front-Running and MEV Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates transaction ordering vulnerabilities by simulating how different gas prices and transaction sequences affect contract outcomes.
Front-Running Remediation
Maintained by Sigvex Team Reviewed
How to reduce front-running exposure through commit-reveal schemes, slippage protection, and transaction batching.
Frozen Account Operations Remediation
Maintained by Sigvex Team Reviewed
How to fix missing frozen state checks before token operations.
Function Selector Collision Remediation
Maintained by Sigvex Team Reviewed
Use a transparent proxy pattern or rename functions so admin and implementation selectors never collide.
Gas Griefing Remediation
Maintained by Sigvex Team Reviewed
Reserve a gas minimum, forward a bounded amount, and require inner call success so callers cannot starve nested calls.
Gas Optimization Remediation
Maintained by Sigvex Team Reviewed
Cache repeated storage reads, pack adjacent variables, and use calldata to cut gas without changing semantics.
Governance Attack Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates DAO governance vulnerabilities by simulating flash loan vote acquisition, insufficient quorum scenarios, and timelock bypass.
Governance Attack Remediation
Maintained by Sigvex Team Reviewed
How to protect DAO governance systems against flash loan vote acquisition, low quorum exploitation, and timelock bypass using voting snapshots, mandatory delays, and flash loan-resistant token designs.
Hardcoded Gas Values Remediation
Maintained by Sigvex Team Reviewed
Forward available gas with call instead of relying on fixed stipends that break across hard forks and L2s.
Hardcoded System Program Address Remediation
Maintained by Sigvex Team Reviewed
How to fix hardcoded system program addresses by using named constants.
Hardcoded Sysvar Address Remediation
Maintained by Sigvex Team Reviewed
How to fix hardcoded sysvar addresses by using proper derivation functions.
Hash Collision Remediation
Maintained by Sigvex Team Reviewed
Use abi.encode instead of abi.encodePacked when hashing multiple dynamic arguments to prevent collisions.
Hash Collision Remediation
Maintained by Sigvex Team Reviewed
How to fix hash collision vulnerabilities caused by truncation, weak algorithms, or small inputs.
Implicit Instruction Ordering Remediation
Maintained by Sigvex Team Reviewed
How to fix implicit instruction ordering dependencies not enforced on all control flow paths.
Improper Error Handling Remediation
Maintained by Sigvex Team Reviewed
How to fix silently ignored errors and improper error propagation.
Incomplete Analysis Missing Template Remediation
Maintained by Sigvex Team Reviewed
How to make every instantiated template visible to analysis so the constraint system is examined in full and an empty findings list means what it says.
Incorrect Comparison Remediation
Maintained by Sigvex Team Reviewed
Choose the boundary-correct comparison operator so checks behave correctly at edge values.
Incorrect Constructor Remediation
Maintained by Sigvex Team Reviewed
How to ensure initialization code runs once at deployment and cannot be re-invoked, using the constructor keyword or a guarded initializer.
Incorrect Exponent Remediation
Maintained by Sigvex Team Reviewed
Replace the XOR operator with exponentiation or scientific notation in scaling calculations.
Inheritance Order Remediation
Maintained by Sigvex Team Reviewed
Order base contracts from most general to most derived so C3 linearization resolves overrides as intended.
Input Validation Remediation
Maintained by Sigvex Team Reviewed
How to properly validate user-supplied inputs in smart contracts to prevent arbitrary fund routing, unbounded operations, and zero-address vulnerabilities.
Instruction Data Length Remediation
Maintained by Sigvex Team Reviewed
How to fix missing instruction data length validation before unpacking.
Instruction Data Parsing Edge Cases Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe instruction data parsing patterns that may cause panics or errors.
Instruction Index Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix hardcoded instruction index comparisons that can be bypassed.
Instruction Introspection Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe instruction introspection with missing bounds or length validation.
Instruction Sender Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing authority validation for transaction senders in privileged operations.
Instruction Verification Pattern Remediation
Maintained by Sigvex Team Reviewed
How to fix incorrect ordering of validation checks and sensitive operations.
Insufficient Data Length Check Remediation
Maintained by Sigvex Team Reviewed
How to fix account data access without sufficient length validation.
Insufficient Lamport Balance Remediation
Maintained by Sigvex Team Reviewed
How to fix missing lamport balance validation before transfers.
Integer Overflow Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates unchecked arithmetic vulnerabilities by supplying maximum uint256 values and checking whether the execution reverts.
Integer Overflow Remediation
Maintained by Sigvex Team Reviewed
How to eliminate integer overflow and underflow vulnerabilities in Solidity by using Solidity 0.8+ checked arithmetic and safe unchecked block practices.
Integer Overflow Remediation (SVM)
Maintained by Sigvex Team Reviewed
How to prevent integer overflow and underflow in Solana programs by using checked arithmetic methods and the account-validation framework checked_math! macro.
Integer Truncation Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe integer type casts that truncate data.
L2 Rollup Risks Remediation
Maintained by Sigvex Team Reviewed
How to handle L2-specific hazards: sequencer downtime, cross-domain message authentication, and L1/L2 block-property differences.
Lamport Conservation Remediation
Maintained by Sigvex Team Reviewed
How to fix lamport conservation violations in Solana programs.
Lamport Drain Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates lamport drain vulnerabilities in Solana programs by simulating an attack that drains all lamports from an account the program fails to adequately protect, with impact reported as potential SOL loss.
Lamport Drain Remediation
Maintained by Sigvex Team Reviewed
How to prevent unauthorized SOL transfers by validating signer authorization and stored authority before any lamport modification.
Lamport Dust Remediation
Maintained by Sigvex Team Reviewed
How to fix lamport dust exploitation vulnerabilities.
Lamport Token Confusion Remediation
Maintained by Sigvex Team Reviewed
How to fix confusion between native SOL and SPL token operations.
Lamport Underflow Remediation
Maintained by Sigvex Team Reviewed
How to fix lamport transfers that may exceed available balance or violate rent-exempt minimums.
Liquidity Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to fix liquidity pool manipulation vulnerabilities.
Locked Ether Remediation
Maintained by Sigvex Team Reviewed
Add an access-controlled withdrawal path to contracts that accept ETH, or remove payability the contract does not need.
LP Token Inflation Remediation
Maintained by Sigvex Team Reviewed
How to neutralize the first-depositor share-inflation attack with virtual shares or a seeded deposit.
Metadata Authority Transfer Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe metadata authority transfers in Solana programs.
MEV Vulnerabilities Remediation
Maintained by Sigvex Team Reviewed
How to reduce order-flow exploitation with slippage bounds, deadlines, commit-reveal, and private submission.
MEV Vulnerabilities Remediation
Maintained by Sigvex Team Reviewed
How to fix MEV and transaction ordering vulnerabilities in Solana programs.
Mint Authority Abuse Remediation
Maintained by Sigvex Team Reviewed
How to validate mint authority before token minting operations to prevent unauthorized supply inflation.
Missing Assert Remediation
Maintained by Sigvex Team Reviewed
How to add the assertions that make a Noir constrained function prove something about its inputs rather than merely compute with them.
Missing Deadline Remediation
Maintained by Sigvex Team Reviewed
How to protect swaps and mints from stale execution by enforcing a caller-supplied transaction deadline.
Missing Empty Account Check Remediation
Maintained by Sigvex Team Reviewed
How to fix missing empty account validation before initialization.
Missing Events Remediation
Maintained by Sigvex Team Reviewed
How to make critical state changes observable off-chain by emitting events on every privileged mutation.
Missing Owner Check Remediation
Maintained by Sigvex Team Reviewed
How to add proper account ownership validation in Solana programs to prevent unauthorized access via accounts owned by other programs.
Missing Range Check Remediation
Maintained by Sigvex Team Reviewed
How to fix missing range constraints on signals used in size-sensitive operations.
Missing Rent Check Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates missing rent-exempt check vulnerabilities in Solana programs where accounts with insufficient lamport balances may be garbage-collected by the runtime, causing unexpected program failures.
Missing Rent Check Remediation
Maintained by Sigvex Team Reviewed
How to verify rent exemption when creating or modifying Solana accounts to prevent garbage collection of program-owned accounts.
Missing Signer Check Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates missing signer check vulnerabilities in Solana programs by simulating instruction execution without required signatures, confirming unauthorized access to protected program logic.
Missing Signer Check Remediation
Maintained by Sigvex Team Reviewed
How to add proper signer verification before privileged operations in Solana programs using both native and Anchor approaches.
Missing Writable Check Remediation
Maintained by Sigvex Team Reviewed
How to add is_writable validation before account modifications in Solana native programs and use the account-validation framework's #[account(mut)] constraint.
Missing Zero Address Validation Remediation
Maintained by Sigvex Team Reviewed
How to prevent burned funds and bricked ownership by validating address inputs against the zero address.
Mixed Assignment Types Remediation
Maintained by Sigvex Team Reviewed
How to make every path through a template constrain a signal the same way, so a parameter choice cannot silently switch a constraint off.
msg.value in Loop Remediation
Maintained by Sigvex Team Reviewed
How to avoid crediting the same ETH multiple times by never treating msg.value as per-iteration value.
Multi-Hop CPI Remediation
Maintained by Sigvex Team Reviewed
How to secure multi-hop CPI chains by validating program IDs at every hop, re-validating state between calls, and staying clear of the invocation depth limit.
Multi-Sig Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix multi-signature validation weaknesses including thresholds, replay protection, and signer verification.
Native Discriminator Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing discriminator validation in native Solana programs.
Native Program Authority Remediation
Maintained by Sigvex Team Reviewed
How to fix missing authority validation for native program CPIs.
NFT Creator Verification Remediation
Maintained by Sigvex Team Reviewed
How to fix missing NFT creator signature verification.
NFT Metadata Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix NFT metadata validation issues.
Noir Circuit Vulnerabilities Remediation
Maintained by Sigvex Team Reviewed
How to fix Noir-specific vulnerabilities including unconstrained function misuse, oracle manipulation, and Brillig escapes.
Non-Anchor Discriminator Remediation
Maintained by Sigvex Team Reviewed
How to fix missing instruction discrimination in non-an account-validation framework programs.
Nondeterministic Conditional Remediation
Maintained by Sigvex Team Reviewed
How to replace if/else logic in unconstrained assignments with constrained multiplexer selection so the proof enforces the branch choice.
Nondeterministic Control Flow Remediation
Maintained by Sigvex Team Reviewed
How to fix ternary operators in unconstrained assignments where the prover controls which branch executes.
Nondeterministic Witness Remediation
Maintained by Sigvex Team Reviewed
How to constrain nondeterministic operations in ZK witness generation to prevent prover manipulation.
Oracle Data Freshness Remediation
Maintained by Sigvex Team Reviewed
How to fix stale oracle price data usage.
Oracle Failure Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates oracle failure vulnerabilities by testing contract behavior when price feeds return zero, extreme, or unavailable values.
Oracle Failure Remediation
Maintained by Sigvex Team Reviewed
How to harden contracts against oracle failure modes — zero prices, extreme values, and feed unavailability — using input validation, bounds checking, fallback oracles, and circuit breakers.
Oracle Manipulation Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates spot-price oracle manipulation by comparing contract execution under normal vs. artificially imbalanced DEX reserve configurations.
Oracle Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to eliminate oracle manipulation vulnerabilities by replacing spot prices with time-weighted averages and using decentralized oracle networks.
Oracle Manipulation Remediation (Solana)
Maintained by Sigvex Team Reviewed
How to defend Solana DeFi programs against oracle price manipulation through account ownership verification, staleness checks, confidence interval validation, and multi-oracle aggregation.
Outdated Compiler Remediation
Maintained by Sigvex Team Reviewed
Upgrade to a current pinned Solidity release and verify your build settings do not trigger known compiler advisories.
Parameter Count Mismatch Remediation
Maintained by Sigvex Team Reviewed
How to keep component instantiations in step with template signatures so compile-time parameters configure the circuit the author intended.
Payable Fallback Remediation
Maintained by Sigvex Team Reviewed
How to keep a payable fallback from stranding funds by accounting for, restricting, or rejecting stray ETH.
PDA Bump Seed Reuse Remediation
Maintained by Sigvex Team Reviewed
How to fix reuse of bump seeds across multiple PDA derivations.
PDA Manipulation Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates PDA (Program Derived Address) manipulation vulnerabilities in Solana programs by simulating an attack that passes a fake PDA to bypass program authority validation.
PDA Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to prevent PDA substitution attacks by using canonical bumps, storing bump seeds, and verifying PDA derivation with the account-validation framework's seeds constraint.
PDA Ownership Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix PDA usage without ownership validation.
PDA Path Confusion Remediation
Maintained by Sigvex Team Reviewed
How to fix PDA derivations lacking program-specific namespace seeds.
PDA Seed Collision Remediation
Maintained by Sigvex Team Reviewed
How to prevent PDA seed collisions that allow distinct logical accounts to resolve to the same address.
PDA Seed Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix incorrect PDA seed derivation patterns.
PDA Signer Seed Extraction Remediation
Maintained by Sigvex Team Reviewed
How to protect PDA signer seeds from extraction by using domain separation and program-controlled seed components.
PDA System Collision Remediation
Maintained by Sigvex Team Reviewed
How to fix weak PDA seed patterns that could collide with system addresses.
PDA User-Controlled Seeds Remediation
Maintained by Sigvex Team Reviewed
How to fix unvalidated user-controlled input in PDA seeds.
PDA Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing PDA address validation that allows attackers to substitute attacker-controlled accounts.
Permit Frontrunning Remediation
Maintained by Sigvex Team Reviewed
How to keep EIP-2612 permit-based flows from being griefed by front-run permit submissions.
Permit Vulnerabilities Remediation
Maintained by Sigvex Team Reviewed
How to use ERC-2612 permit safely across front-running, nonce handling, and deadline enforcement.
Precision Errors Remediation
Maintained by Sigvex Team Reviewed
How to eliminate precision loss in Solidity financial calculations by reordering operations, using scaling factors, and applying explicit rounding direction.
Precision Errors Remediation
Maintained by Sigvex Team Reviewed
How to fix precision loss and rounding errors in DeFi calculations.
Price Deviation Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates price deviation vulnerabilities by submitting extreme price updates (10x increase, 90% crash) and confirming whether the contract accepts them without bounds checking.
Price Deviation Remediation
Maintained by Sigvex Team Reviewed
How to protect protocols from extreme price movements and flash loan manipulation using deviation bounds, TWAP comparison, circuit breakers, and absolute price range constraints.
Price Impact Remediation
Maintained by Sigvex Team Reviewed
How to fix missing price impact validation in large swaps.
Private Data Exposure Remediation
Maintained by Sigvex Team Reviewed
How to stop treating the private keyword as confidentiality: never store secrets on-chain in plaintext.
Private Input Unchecked Remediation
Maintained by Sigvex Team Reviewed
How to fix unchecked private inputs in Noir by adding assertions that constrain witness values.
Program Interface Compliance Remediation
Maintained by Sigvex Team Reviewed
How to fix program interface compliance issues.
Program Upgrade Risks Remediation
Maintained by Sigvex Team Reviewed
How to fix security risks in upgradeable Solana programs.
Prover-Controlled Loop Bound Remediation
Maintained by Sigvex Team Reviewed
How to fix prover-controlled loop bounds by using constants, template parameters, or constrained signals.
Quadratic Constraint Composition Remediation
Maintained by Sigvex Team Reviewed
How to fix constraint expressions with multiple multiplications that do not decompose cleanly into R1CS form.
Read-Only Reentrancy Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates read-only reentrancy vulnerabilities where view functions return stale state during an external call, misleading dependent protocols.
Readonly Account Mutation Remediation
Maintained by Sigvex Team Reviewed
How to fix readonly account mutation logic errors.
Readonly CPI Write Bypass Remediation
Maintained by Sigvex Team Reviewed
How to fix readonly account write bypass via CPI.
Readonly Misuse Remediation
Maintained by Sigvex Team Reviewed
How to fix readonly account misuse vulnerabilities.
Rebasing Token Remediation
Maintained by Sigvex Team Reviewed
How to support elastic-supply tokens by tracking shares or measuring balances instead of caching amounts.
Reentrancy Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates reentrancy vulnerabilities by simulating recursive drain attacks against withdraw-pattern functions.
Reentrancy Remediation
Maintained by Sigvex Team Reviewed
How to eliminate reentrancy vulnerabilities by applying the Checks-Effects-Interactions pattern and using reentrancy guards.
Remediating Account Alias Attacks
Maintained by Sigvex Team Reviewed
How to prevent account role confusion by explicitly validating that accounts in distinct roles have distinct addresses.
Remediating Arbitrary External Calls
Maintained by Sigvex Team Reviewed
How to prevent external calls to user-controlled addresses by validating targets against whitelists.
Remediating Atomic State Update Violations
Maintained by Sigvex Team Reviewed
How to ensure multi-step state updates maintain invariant consistency using intermediate checks, reentrancy guards, and explicit state machine patterns.
Remediating Authority Chain Validation
Maintained by Sigvex Team Reviewed
How to ensure that delegated PDA signing authority is verified at each hop in a multi-step CPI chain, preventing intermediate programs from abusing implicitly inherited authority.
Remediating Bridge Security Vulnerabilities
Maintained by Sigvex Team Reviewed
How to protect cross-chain bridge implementations against missing message verification, replay attacks, unauthorized relay, and protocol-specific a cross-chain messaging protocol, Axelar, and Hyperlane integration errors.
Remediating Business Logic Errors
Maintained by Sigvex Team Reviewed
How to identify and fix business logic errors by enforcing protocol invariants, correctly ordering state updates, and validating edge cases.
Remediating Callback State Mutation Vulnerabilities
Maintained by Sigvex Team Reviewed
How to fix state mutations after external calls by applying the Checks-Effects-Interactions pattern and reentrancy guards.
Remediating Constructor State in Upgradeable Contracts
Maintained by Sigvex Team Reviewed
How to move state initialization from constructors to initializer functions in proxy-based upgradeable contracts.
Remediating CPI Program ID Validation
Maintained by Sigvex Team Reviewed
How to ensure Cross-Program Invocations target the intended program by validating program account keys before invocation.
Remediating Decimal Mismatch
Maintained by Sigvex Team Reviewed
How to normalize token decimal precision before arithmetic to prevent over/under-payment vulnerabilities.
Remediating DoS with Failed Call
Maintained by Sigvex Team Reviewed
How to prevent denial of service from unchecked external calls in loops using error handling, pull patterns, and try/catch.
Remediating Governance Attacks
Maintained by Sigvex Team Reviewed
How to protect DAO governance mechanisms against flash loan voting, timelock bypass, quorum manipulation, and treasury drain attacks.
Remediating Immutable Violation
Maintained by Sigvex Team Reviewed
How to enforce immutability of constructor-set variables using the immutable keyword and initialization guards.
Remediating Initializer Reentrancy
Maintained by Sigvex Team Reviewed
How to prevent reentrancy in proxy initializer functions by using OpenZeppelin's Initializable modifier and setting the initialization flag before external calls.
Remediating Input Validation
Maintained by Sigvex Team Reviewed
How to validate user-controlled instruction data and account fields in Solana programs.
Remediating Insecure Merkle Proof Verification
Maintained by Sigvex Team Reviewed
How to prevent second preimage attacks and proof malleability by using double-hashed leaves and audited Merkle proof libraries.
Remediating Loop Gas Exhaustion
Maintained by Sigvex Team Reviewed
How to prevent DoS via block gas limit exhaustion by adding maximum iteration limits, pagination, and pull-over-push patterns.
Remediating Memory Expansion DoS
Maintained by Sigvex Team Reviewed
How to prevent out-of-gas denial of service by bounding memory allocation size in functions that process untrusted input.
Remediating Metamorphic Contract Risks
Maintained by Sigvex Team Reviewed
How to prevent code replacement attacks by removing SELFDESTRUCT from CREATE2-deployed contracts and using standard proxy patterns.
Remediating Off-By-One Errors
Maintained by Sigvex Team Reviewed
How to fix off-by-one errors in loop boundaries by using correct comparison operators and avoiding length-1 patterns.
Remediating Read-Only Reentrancy
Maintained by Sigvex Team Reviewed
How to prevent read-only reentrancy by ensuring state is consistent before external calls and protecting price-reading functions from mid-execution observations.
Remediating Remaining Accounts Injection
Maintained by Sigvex Team Reviewed
How to safely use ctx.remaining_accounts by validating account ownership, type discriminators, and writability before any privileged operations.
Remediating Reward and Incentive Manipulation
Maintained by Sigvex Team Reviewed
How to protect staking and yield farming contracts against flash loan pool manipulation, timestamp gaming, and division-before-multiplication precision loss.
Remediating Stale Off-Chain Price Feed
Maintained by Sigvex Team Reviewed
How to validate off-chain aggregated oracle data freshness by checking the updatedAt timestamp, answer validity, and round completeness before consuming price data.
Remediating Token Hook Reentrancy
Maintained by Sigvex Team Reviewed
How to prevent reentrancy through ERC-777, ERC-1155, and ERC-4626 callback hooks using the CEI pattern and reentrancy guards.
Remediating Uninitialized UUPS Proxy
Maintained by Sigvex Team Reviewed
How to protect UUPS proxy implementations from front-running attacks by disabling initializers on the implementation contract.
Remediating Vault Inflation Attacks
Maintained by Sigvex Team Reviewed
How to protect ERC-4626 vaults from first-depositor share price inflation attacks using virtual shares, dead share seeding, or minimum deposit requirements.
Rent Collection Exploit Remediation
Maintained by Sigvex Team Reviewed
How to keep accounts rent-exempt through withdrawals and reallocations by computing minimum balances dynamically and enforcing them on every lamport movement.
Rent Epoch Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix improper rent epoch validation.
Rent Exempt Epoch Transition Remediation
Maintained by Sigvex Team Reviewed
How to fix cached rent-exempt minimum balances.
Rent Exempt Initialization Remediation
Maintained by Sigvex Team Reviewed
How to fix account data writes that occur before rent-exempt funding.
Rent Exempt Reallocation Remediation
Maintained by Sigvex Team Reviewed
How to fix account reallocations without rent-exemption adjustments.
Rent Withdrawal Balance Remediation
Maintained by Sigvex Team Reviewed
How to fix partial lamport withdrawals without rent-exemption checks.
Requirement Violations Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates requirement violation findings by classifying the specific check failure — incorrect comparison, missing validation, assert misuse, or arithmetic overflow — and documenting the exploit path.
Requirement Violations Remediation
Maintained by Sigvex Team Reviewed
How to eliminate requirement violation vulnerabilities by correcting comparison operators, adding missing input validation guards, replacing assert with require for user-facing checks, and upgrading to Solidity 0.8.0 for built-in overflow protection.
Reserve Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to stop direct-transfer balance inflation by pricing off tracked reserves, not live balanceOf.
Returnbomb Remediation
Maintained by Sigvex Team Reviewed
How to defend against return-data bombs by bounding or discarding returndata from untrusted calls.
Role-Based Access Control Remediation
Maintained by Sigvex Team Reviewed
How to fix missing role checks, privilege escalation risks, and hardcoded role permissions.
Royalty Bypass Remediation
Maintained by Sigvex Team Reviewed
Query and enforce ERC-2981 royalty payments inside marketplace sale logic so creator revenue cannot be circumvented.
RTLO Unicode Remediation
Maintained by Sigvex Team Reviewed
Reject bidirectional Unicode control characters in source and CI so code cannot be visually disguised as benign.
Sandwich Attack Remediation
Maintained by Sigvex Team Reviewed
Enforce minimum-output and deadline checks on swap functions so MEV searchers cannot extract value by bracketing trades.
Secondary Signer Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing signer validation on identity-checked accounts.
Secp256k1 Signature Malleability Remediation
Maintained by Sigvex Team Reviewed
How to fix Secp256k1 signature malleability vulnerabilities.
Selfdestruct Remediation
Maintained by Sigvex Team Reviewed
How to eliminate selfdestruct vulnerabilities by replacing balance-dependent invariants with internal accounting, protecting library contracts from direct initialisation, and avoiding the SELFDESTRUCT opcode entirely.
Selfdestruct Vulnerability Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates selfdestruct vulnerabilities including unprotected self-destruction, library-based destruction (Parity-style), and forced ETH reception.
Semantic Reentrancy Remediation
Maintained by Sigvex Team Reviewed
How to defend against reentrancy that exploits a temporarily invalid invariant rather than a stale balance.
Short Address Attack Remediation
Maintained by Sigvex Team Reviewed
Validate calldata length on token transfers so truncated addresses cannot left-shift the amount parameter.
Sign Extension Overflow Remediation
Maintained by Sigvex Team Reviewed
Validate the sign of a value before casting between signed and unsigned integer types so negative values cannot become huge positives.
Signal Aliasing Remediation
Maintained by Sigvex Team Reviewed
How to fix redundant equality constraints that create aliases without adding security.
Signal as Array Index Remediation
Maintained by Sigvex Team Reviewed
How to fix unconstrained signals used as array indices by using constrained multiplexer circuits.
Signal Mutation in Loop Remediation
Maintained by Sigvex Team Reviewed
How to fix self-referential signal mutations in loops by using signal arrays with per-step constraints.
Signal Reuse Remediation
Maintained by Sigvex Team Reviewed
How to fix signals assigned multiple times by using distinct signals or arrays for each computed value.
Signature Malleability Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates ECDSA signature malleability vulnerabilities by computing the alternative valid s value and confirming that both signatures recover to the same address.
Signature Malleability Remediation
Maintained by Sigvex Team Reviewed
How to prevent ECDSA signature malleability attacks by enforcing EIP-2 low-s values and tracking message hashes as nonces instead of signature hashes.
Signature Replay Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates missing replay protection in meta-transaction and permit functions by testing same-chain, cross-chain, and cross-contract replay scenarios.
Signature Replay Remediation
Maintained by Sigvex Team Reviewed
How to prevent signature replay attacks by binding signed messages to a nonce, deadline, chain ID, and contract address using EIP-712.
Signature Replay Remediation (SVM)
Maintained by Sigvex Team Reviewed
How to prevent signature replay in Solana programs by including a nonce and deadline in the signed message and incrementing the nonce after each successful verification.
Signature Verification Remediation
Maintained by Sigvex Team Reviewed
Verify ECDSA signatures with EIP-712 typed data, a domain separator, nonce, and a strict signer check to prevent forgery and replay.
Signer Authority Role Remediation
Maintained by Sigvex Team Reviewed
How to fix privileged operations that check signer status but not authority role.
Single Oracle Dependency Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates single oracle dependency vulnerabilities by simulating primary oracle failure with no fallback, confirming protocols that halt or misbehave when the sole price source goes offline.
Single Oracle Dependency Remediation
Maintained by Sigvex Team Reviewed
How to eliminate single oracle dependency by implementing multi-source price architectures, cross-validation, and circuit breakers that keep protocols functioning when any individual feed fails.
Slippage Protection Remediation
Maintained by Sigvex Team Reviewed
How to fix missing slippage protection in token swaps.
Slippage Validation Remediation
Maintained by Sigvex Team Reviewed
How to add slippage protection to DEX swap operations by exposing minimum output parameters and bounded deadlines to callers.
Solc Calldata Re-encode Bugs Remediation
Maintained by Sigvex Team Reviewed
How to remediate the ABI-encoder calldata re-encoding bugs by recompiling with a patched compiler and redeploying.
Solc keccak256 Optimizer Bug (2021-03) Remediation
Maintained by Sigvex Team Reviewed
How to remediate the pre-0.8.3 keccak256 optimizer bug: recompile with a fixed compiler and verify the deployed bytecode.
Solc Storage Write Removal Bug (2022-09) Remediation
Maintained by Sigvex Team Reviewed
How to remediate the 0.8.13–0.8.16 Yul optimizer bug that dropped storage writes: recompile with 0.8.17+ and redeploy.
Solc Transient Storage Helper Collision (2026-02) Remediation
Maintained by Sigvex Team Reviewed
How to remediate the 0.8.28–0.8.33 IR bug that collided transient and persistent delete helpers: recompile with 0.8.34+.
SPL Governance Attack Remediation
Maintained by Sigvex Team Reviewed
How to protect governance implementations from flash governance, quorum bypass, and timelock circumvention.
SPL Token Account Close Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe account close operations in Solana programs.
SPL Token Account Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing validation in SPL token operations.
SPL Token ATA Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix improper Associated Token Account validation.
SPL Token Authority Confusion Remediation
Maintained by Sigvex Team Reviewed
How to fix authority confusion between owner, delegate, close, mint, and freeze authorities.
SPL Token Close Authority Bypass Remediation
Maintained by Sigvex Team Reviewed
How to fix missing close_authority validation when closing token accounts.
SPL Token Compliance Remediation
Maintained by Sigvex Team Reviewed
How to fix SPL Token standard compliance violations.
SPL Token Delegation Chain Depth Remediation
Maintained by Sigvex Team Reviewed
How to fix excessive delegation chain depth in Solana programs.
SPL Token Delegation Overflow Remediation
Maintained by Sigvex Team Reviewed
How to fix integer overflow vulnerabilities in token delegation amount calculations.
SPL Token Delegation Security Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe token delegation patterns in Solana programs.
SPL Token Freeze Burn Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe freeze and burn operations in Solana programs.
SPL Token Metadata Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix metadata validation issues including PDA checks and URI validation.
SPL Token Mint Authority Remediation
Maintained by Sigvex Team Reviewed
How to fix mint authority vulnerabilities in Solana token programs.
SPL Token Transfer Hooks Remediation
Maintained by Sigvex Team Reviewed
How to fix transfer hook vulnerabilities in Token-2022 programs.
Stack Depth Violation Remediation
Maintained by Sigvex Team Reviewed
How to fix CPI depth limit violations.
Stale Account Data Remediation
Maintained by Sigvex Team Reviewed
How to fix stale account data usage after CPI calls.
Stale Oracle Data Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates aggregated oracle staleness vulnerabilities by executing contracts against fresh, stale (24-hour-old), and incomplete-round oracle configurations.
Stale Oracle Data Remediation
Maintained by Sigvex Team Reviewed
How to eliminate stale off-chain price-feed vulnerabilities by validating all latestRoundData return fields, enforcing heartbeat-based freshness thresholds, and adding L2 sequencer uptime checks.
State Leakage Intermediate Remediation
Maintained by Sigvex Team Reviewed
How to connect witness-only intermediate signals to the circuit's outputs so the verifier can check them, or remove them when they carry no security property.
Storage Collision Remediation
Maintained by Sigvex Team Reviewed
How to prevent proxy storage collisions by using EIP-1967 unstructured storage slots for all proxy administrative variables.
Storage Layout Versioning Remediation
Maintained by Sigvex Team Reviewed
How to keep upgradeable proxies safe by preserving storage layout: append-only variables, storage gaps, and namespaced slots.
SVM Program Fuzzing Framework
Maintained by Sigvex Team Reviewed
Sigvex coverage-guided Solana program fuzzing framework with instruction-aware input generation, account state fuzzing, CPI simulation, invariant checking, and crash detection for Solana-specific vulnerability classes.
Swap Validation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing validation in token swap operations.
Sysvar Account Spoofing Remediation
Maintained by Sigvex Team Reviewed
How to prevent sysvar spoofing by validating account keys or using the Sysvar::get() API.
Sysvar Cache Staleness Remediation
Maintained by Sigvex Team Reviewed
How to fix stale sysvar data usage.
Sysvar Substitution Remediation
Maintained by Sigvex Team Reviewed
How to fix unverified sysvar account usage that allows data spoofing.
Tautological Compare Remediation
Maintained by Sigvex Team Reviewed
How to fix always-true/always-false conditions that were meant to be real bounds checks.
Template Misuse Remediation
Maintained by Sigvex Team Reviewed
How to fix incorrect template instantiation patterns including parameter mismatches and unconstrained wiring.
the NFT metadata program Authority Bypass Remediation
Maintained by Sigvex Team Reviewed
How to fix missing update authority verification in standard NFT metadata operations.
the NFT metadata program Compliance Remediation
Maintained by Sigvex Team Reviewed
How to fix standard NFT metadata standard violations.
Timelock Operations Remediation
Maintained by Sigvex Team Reviewed
How to fix missing timelock delays, timestamp validation issues, and unprotected cancellation.
Timestamp Dependence Remediation
Maintained by Sigvex Team Reviewed
How to eliminate exploitable timestamp dependence by replacing block.timestamp with block numbers, commit-reveal schemes, or off-chain randomness.
Timestamp Dependency Remediation
Maintained by Sigvex Team Reviewed
How to fix dangerous dependencies on block timestamps in security-critical logic.
Timestamp Manipulation Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates block.timestamp dependency vulnerabilities by executing contracts at shifted timestamps (±900 seconds) to detect miner-manipulable randomness and time-lock bypasses.
Timestamp Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to eliminate block.timestamp dependency vulnerabilities by replacing miner-manipulable timestamp randomness and time-locks with an off-chain verifiable random function service and block-number-based logic.
Timestamp-Based External Triggers Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates cross-chain timestamp coordination vulnerabilities including block time variation, clock drift between chains, and race conditions in time-sensitive cross-chain operations.
Timestamp-Based External Triggers Remediation
Maintained by Sigvex Team Reviewed
How to eliminate cross-chain timestamp coordination vulnerabilities by replacing exact timestamp matching with nonce-based identifiers and time-window validation that tolerates clock drift and miner manipulation.
Token Account Ownership Remediation
Maintained by Sigvex Team Reviewed
How to fix missing account ownership validation before CPI calls.
Token Account Spoofing Remediation
Maintained by Sigvex Team Reviewed
How to fix token account spoofing and aliasing vulnerabilities.
Token Balance Invariant Remediation
Maintained by Sigvex Team Reviewed
How to fix token operations that violate balance accounting invariants.
Token Decimal Mismatch Remediation
Maintained by Sigvex Team Reviewed
How to fix token decimal mismatch vulnerabilities in cross-token operations.
Token Extension Security Remediation
Maintained by Sigvex Team Reviewed
How to fix Token-2022 extension security misconfigurations.
Token Init Race Remediation
Maintained by Sigvex Team Reviewed
How to fix token account initialization race conditions.
Token-2022 Confidential Remediation
Maintained by Sigvex Team Reviewed
How to fix Token-2022 confidential transfer vulnerabilities.
Token-2022 Extensions Remediation
Maintained by Sigvex Team Reviewed
How to fix Token-2022 extension vulnerabilities.
Token-2022 Immutable Owner Remediation
Maintained by Sigvex Team Reviewed
How to protect protocol token accounts from owner reassignment by initializing the Token-2022 Immutable Owner extension and verifying it on deposit.
Token-2022 Transfer Fee Bypass Remediation
Maintained by Sigvex Team Reviewed
How to fix Token-2022 transfer fee accounting issues.
Transaction Size DoS Remediation
Maintained by Sigvex Team Reviewed
How to fix transaction size DoS vulnerabilities.
Trivial Constraint Remediation
Maintained by Sigvex Team Reviewed
How to fix constraints that are always satisfied regardless of signal values.
TWAP Oracle Remediation
Maintained by Sigvex Team Reviewed
How to harden TWAP oracles with adequate windows, cardinality, and cross-checks against multi-block manipulation.
tx.origin Authentication Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates tx.origin authentication vulnerabilities by simulating a phishing scenario where an intermediary contract calls the victim with the owner's tx.origin.
tx.origin Authentication Remediation
Maintained by Sigvex Team Reviewed
How to eliminate tx.origin authentication vulnerabilities by replacing all tx.origin identity checks with msg.sender, which correctly identifies the immediate caller and is not vulnerable to phishing via intermediary contracts.
Type Cosplay Remediation
Maintained by Sigvex Team Reviewed
How to prevent type cosplay attacks by validating the account discriminator before deserializing account data.
Typographical Error Remediation
Maintained by Sigvex Team Reviewed
Replace accidental assignments with the intended compound operators and add invariant tests that catch overwrite-instead-of-accumulate bugs.
Unassigned Output Remediation
Maintained by Sigvex Team Reviewed
How to fix output signals that are declared but never assigned by wiring them to the circuit's computation with constraining assignments.
Unchecked Arithmetic Remediation
Maintained by Sigvex Team Reviewed
How to fix unchecked arithmetic operations that could silently overflow or underflow.
Unchecked Array Bounds Remediation
Maintained by Sigvex Team Reviewed
How to guard array indexing driven by untrusted input, especially in memory and assembly where the EVM does not revert for you.
Unchecked Call Remediation
Maintained by Sigvex Team Reviewed
How to safely handle external call return values in Solidity to prevent silent failures from ignored CALL, SEND, and low-level call results.
Unchecked Call Target Remediation
Maintained by Sigvex Team Reviewed
How to safely make low-level calls: validate the target, check the return value, and never delegatecall into attacker-controlled code.
Unchecked Component Remediation
Maintained by Sigvex Team Reviewed
How to fix component instances with disconnected inputs or outputs that do not contribute to circuit security.
Unchecked CPI Return Remediation
Maintained by Sigvex Team Reviewed
How to fix CPI calls that ignore return values, preventing silent failures.
Unchecked Deserialization Remediation
Maintained by Sigvex Team Reviewed
How to fix unchecked deserialization vulnerabilities.
Unchecked ERC20 Operations Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates unsafe ERC20 token operations by simulating standard, USDT-like, and malicious token interactions to detect missing return value checks.
Unchecked ERC20 Operations Remediation
Maintained by Sigvex Team Reviewed
How to safely handle ERC20 token transfers by using SafeERC20.safeTransfer, accounting for fee-on-transfer tokens, and avoiding the token approve-transferFrom race condition.
Unchecked External Call Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates unchecked call return values by sending ETH to a contract that always reverts and checking whether the victim's state updates regardless.
Unchecked Fee/Rent Math Remediation
Maintained by Sigvex Team Reviewed
How to use checked arithmetic in fee and rent calculations to prevent overflow and underflow exploits.
Unchecked Subtraction Remediation
Maintained by Sigvex Team Reviewed
How to prevent integer underflow in Solidity by using Solidity 0.8+ default arithmetic, adding explicit balance checks before subtraction, and using SafeMath in legacy contracts.
Unconnected Component Inputs Remediation
Maintained by Sigvex Team Reviewed
How to fix unconnected component inputs by wiring all sub-circuit inputs to parent signals using constraining assignments.
Unconstrained Call Return Unchecked Remediation
Maintained by Sigvex Team Reviewed
How to bind the result of a Noir unconstrained call in the constrained caller so the prover cannot substitute a different value.
Unconstrained Component Output Read Remediation
Maintained by Sigvex Team Reviewed
How to read sub-component outputs so the parent inherits the sub-template's guarantees instead of a witness-time copy.
Unconstrained Output Remediation
Maintained by Sigvex Team Reviewed
How to fix unconstrained output signals by adding constraining assignments or explicit constraints.
Unconstrained Public Input Remediation
Maintained by Sigvex Team Reviewed
How to fix unconstrained public inputs by adding constraints that bind them to the circuit's computation.
Unconstrained Return Value Remediation
Maintained by Sigvex Team Reviewed
How to use Noir unconstrained functions safely: keep them as hints and re-derive every property the circuit relies on with an in-circuit assertion.
Under-Constrained Signal Remediation
Maintained by Sigvex Team Reviewed
How to fix under-constrained signals by adding proper constraints to ensure circuit soundness.
Uninitialized Account Remediation
Maintained by Sigvex Team Reviewed
How to fix uninitialized account access vulnerabilities.
Uninitialized Storage Pointer Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates uninitialized storage pointer vulnerabilities by checking whether uninitialized struct or array pointers overwrite critical storage slots including owner and balance variables.
Uninitialized Storage Pointer Remediation
Maintained by Sigvex Team Reviewed
How to eliminate uninitialized storage pointer vulnerabilities by upgrading to Solidity 0.5.0+ and always assigning storage references to explicit mapping or array slots.
Unprotected Ether Withdrawal Remediation
Maintained by Sigvex Team Reviewed
How to stop arbitrary callers from draining contract funds by adding access control and constraining withdrawal destinations.
Unsafe Callback Remediation
Maintained by Sigvex Team Reviewed
How to make intentional callbacks safe with reentrancy guards, allowlists, and state finalized before the hook.
Unsafe Comparison Remediation
Maintained by Sigvex Team Reviewed
How to fix comparison operators in unconstrained assignments by using constrained circomlib comparator components.
Unsafe Delegatecall Remediation
Maintained by Sigvex Team Reviewed
How to prevent contract takeover via delegatecall by fixing the target address to a trusted, immutable implementation instead of accepting it from callers or unguarded storage.
Unsafe Deserialization Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe account data access patterns.
Unsafe Downcasting Remediation
Maintained by Sigvex Team Reviewed
How to stop silent truncation when narrowing integer types by using checked casts.
Unused and Dead Signals Remediation
Maintained by Sigvex Team Reviewed
How to fix unused public inputs, unassigned signals, and dead signals in ZK circuits.
Unused Component Output Remediation
Maintained by Sigvex Team Reviewed
How to enforce the result of a wired component whose output is never read, so comparators and checks actually constrain the proof.
Unused Intermediate Signal Remediation
Maintained by Sigvex Team Reviewed
How to resolve intermediate signals that are computed but never consumed, by writing the missing comparison or removing the dead computation.
Unused Variables Remediation
Maintained by Sigvex Team Reviewed
Remove dead state variables or wire them into the logic they were meant to feed, and confirm off-chain consumers before deleting public state.
Validator/Relayer Compromise Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates bridge validator and relayer compromise vulnerabilities including low M-of-N thresholds, key management failures, centralized relayers, and missing validator rotation — with the Ronin Bridge ($625M) as the canonical attack scenario.
Validator/Relayer Compromise Remediation
Maintained by Sigvex Team Reviewed
How to harden bridge validator and relayer infrastructure against compromise through high consensus thresholds, hardware key management, validator diversity, rotation schedules, and fraud proof challenge windows.
Variable Shadowing Remediation
Maintained by Sigvex Team Reviewed
Remove duplicate variable declarations that hide parent-contract or outer-scope state so reads and writes target the intended slot.
Vault Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to protect DeFi vault state from unauthorized modifications through access control and invariant enforcement.
Vault Rounding Remediation
Maintained by Sigvex Team Reviewed
How to protect ERC-4626 vaults from share-price rounding abuse and first-depositor inflation attacks.
veToken Governance Remediation
Maintained by Sigvex Team Reviewed
How to protect vote-escrow systems from flash-vote, decay manipulation, and checkpoint gaming.
Voting Power Manipulation Remediation
Maintained by Sigvex Team Reviewed
How to fix governance voting power manipulation vulnerabilities.
Weak PDA Entropy Remediation
Maintained by Sigvex Team Reviewed
How to fix PDA derivations using weak seed entropy.
Weak Randomness Exploit Generator
Maintained by Sigvex Team Reviewed
Sigvex exploit generator that validates randomness vulnerabilities by testing whether contract outcomes change predictably with controlled block environment variables.
Weak Randomness Remediation
Maintained by Sigvex Team Reviewed
How to replace predictable on-chain entropy sources with verifiable off-chain randomness from an off-chain verifiable random function service or commit-reveal schemes.
Weak Randomness Remediation (Solana)
Maintained by Sigvex Team Reviewed
How to eliminate weak randomness vulnerabilities in Solana programs by replacing predictable on-chain entropy sources with Verifiable Random Functions (VRF) or commit-reveal schemes.
Witness Complexity Remediation
Maintained by Sigvex Team Reviewed
How to fix complex unconstrained witness computations by decomposing into simpler steps with per-step constraints.
Wrapped Native Token Remediation
Maintained by Sigvex Team Reviewed
How to handle ETH and WETH consistently so deposits, accounting, and transfers never diverge.
Wrapped Token Parity Remediation
Maintained by Sigvex Team Reviewed
How to fix missing wrapped token supply vs collateral parity validation.
Write After Write Remediation
Maintained by Sigvex Team Reviewed
How to resolve a dead storage write: remove the redundant assignment or fix the slot/logic it was meant to update.
Zero Amount Operation Remediation
Maintained by Sigvex Team Reviewed
How to fix missing zero-amount validation in token operations.
Zero Copy Deserialization Remediation
Maintained by Sigvex Team Reviewed
How to fix unsafe zero-copy deserialization patterns.