crytic / caracal

Static Analyzer for Starknet smart contracts
GNU Affero General Public License v3.0
135 stars 7 forks source link

An l1_handler function not checking the from_address #20

Closed tarunbhm closed 1 year ago

tarunbhm commented 1 year ago

Detect if a function annotated with the #[l1_handler] annotation is not checking the from_address to validate the correct L1 caller address. Without this check, anyone can send an L1-L2 message to trigger the function.