Back to Details

near-contract-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

NEAR Contract Audit

NEAR合约审计

Security audit skill for NEAR smart contracts in Rust.
针对使用Rust编写的NEAR智能合约的安全审计技能。

Audit Workflow

审计工作流

Phase 1: Automated Analysis

阶段1：自动化分析

Run your preferred Rust static analysis and NEAR-focused security tools on the contract to:
  • Scan for common vulnerability patterns (reentrancy, unsafe math, unhandled promises, access control issues, etc.)
  • Highlight potentially risky patterns for deeper manual review
运行你偏好的Rust静态分析工具和NEAR专属安全工具对合约进行扫描，以：
  • 检测常见漏洞模式（重入、不安全数学运算、未处理promise、访问控制问题等）
  • 标记潜在风险模式以便深入人工审查

Phase 2: Manual Review

阶段2：人工审查

After automated analysis, perform manual review for:
  • Business logic vulnerabilities
  • Access control patterns
  • Economic attack vectors
  • Cross-contract interaction safety
自动化分析完成后，开展人工审查以检查：
  • 业务逻辑漏洞
  • 访问控制模式
  • 经济攻击向量
  • 跨合约交互安全性

Phase 3: Code-Specific Analysis

阶段3：代码专项分析

For each finding, verify:
  1. Is it a true positive?
  2. What is the exploitability?
  3. What is the recommended fix?
针对每个发现的问题，验证以下内容：
  1. 是否为真阳性？
  2. 可被利用的程度如何？
  3. 推荐的修复方案是什么？

Phase 4: Report Generation

阶段4：报告生成

Document findings with severity, location, description, and remediation.
记录发现的问题，包含严重程度、位置、描述以及修复建议。

Vulnerability Quick Reference

漏洞速查表

SeverityDetector IDDescription
High
non-private-callback
Callback missing 
#[private]
macro
High
reentrancy
State change after cross-contract call
High
incorrect-argument-or-return-types
Using native integer types in JSON interfaces
High
unsaved-changes
Collection modifications not persisted
High
owner-check
Missing caller/owner verification
High
yocto-attach
Missing 
assert_one_yocto
on sensitive functions
High
storage-collision
Same storage prefix for different collections
High
required-initialization-macro
Missing 
#[init]
on initialization method
Medium
gas-griefing
Unbounded loops causing DoS
Medium
insecure-random
Predictable randomness from block data
Medium
prepaid-gas
Insufficient gas reserved for callbacks
Low
cover-storage-cost
Missing storage deposit verification
Low
unsafe-math
Arithmetic without overflow checks
Low
float-math
Using floating point types for financial math
严重程度检测器ID描述
高危
non-private-callback
回调函数缺失
#[private]
宏
高危
reentrancy
跨合约调用后修改状态
高危
incorrect-argument-or-return-types
JSON接口中使用原生整数类型
高危
unsaved-changes
集合修改未持久化
高危
owner-check
缺失调用者/所有者验证
高危
yocto-attach
敏感函数缺失
assert_one_yocto
检查
高危
storage-collision
不同集合使用相同存储前缀
高危
required-initialization-macro
初始化方法缺失
#[init]
宏
中危
gas-griefing
无界循环导致拒绝服务（DoS）
中危
insecure-random
基于区块数据的可预测随机性
中危
prepaid-gas
为回调预留的Gas不足
低危
cover-storage-cost
缺失存储押金验证
低危
unsafe-math
未做溢出检查的算术运算
低危
float-math
金融运算中使用浮点类型

Reference Files

参考文件

For detailed vulnerability documentation with code examples:
  • high-severity.md - Critical vulnerabilities (8 detectors)
  • medium-severity.md - Medium vulnerabilities (4 detectors)
  • low-severity.md - Low severity findings (3 detectors)
如需查看包含代码示例的详细漏洞文档：
  • high-severity.md - 高危漏洞（8种检测项）
  • medium-severity.md - 中危漏洞（4种检测项）
  • low-severity.md - 低危漏洞（3种检测项）