EOSIO Weakness Classification Registry

The EOSIO Smart Contract Weakness Classification registry is a classification system for weaknesses and vulnerabilities in EOSIO smart contracts.

It is loosely aligned to the terminologies and structure used in the Common Weakness Classification (CWE) and the Ethereum Smart Contract Weakness Classification (SWC) Registry whilst paying attention to weakness variants that are specific to EOSIO smart contracts.

EOS Publicly Known Vulnerabilites

ID	Name	CWE Equivalent
EOSIO-WCR-104	Missing Assertion Check	CWE-754: Improper Check for Exceptional Condition
EOSIO-WCR-105	Missing Authorisation Check	CWE-862: Missing Authorization
EOSIO-WCR-106	Forged Token Transfer	CWE-352: Cross-Site Request Forgery
EOSIO-WCR-107	Fake Notification Receipt	CWE-1021: Improper Restriction of Rendered Frames
EOSIO-WCR-108	Transaction Rollback	CWE-471: Modification of Assumed-Immutable Data
EOSIO-WCR-109	Unchecked Action Arguments	CWE-749: Exposed Dangerous Method
EOSIO-WCR-110	Haphazard Multi-Index Migration	CWE-669: Incorrect Resource Transfer Between Spheres
EOSIO-WCR-111	Integer Overflow	CWE-190: Integer Overflow
EOSIO-WCR-112	Bad Randomness	CWE-338: Use of Cryptographically Weak Pseudorandom Number Generator
EOSIO-WCR-113	Re-entrancy Attack	CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
EOSIO-WCR-114	Denial of Service	CWE-400: Uncontrolled Resource Consumption
EOSIO-WCR-115	Dangling Pointer	CWE-825: Expired Pointer Dereference

Create a new EOSIO WCR entry

Make sure that there is no matching weakness in the registry. Ideally, also coordinate with the community in EOSIO WCR-registry Telegram channel to prevent conflicting entries. Create a file with a new EOSIO WCR ID in the entries directory. Use the template and describe all weakness attributes.

# Title
Pick a meaningful title.

## Relationships
Link a CWE Base or Class type to the CWS variant.
e.g.  [CWE-682: Incorrect Calculation](https://cwe.mitre.org/data/definitions/682.html)

## Description
Describe the nature and potential impact of the weakness on the contract system.

## Remediation
Describe ways on how to fix the weakness.

## References
Link to external references that contain useful additional information on the issue.

Create a new test case

Test cases should be as varied as possible and include both simple test cases and real-world samples of vulnerable smart contracts. The test cases are grouped into subdirectories based on a single weakness variant or based on more complex real world contract systems that can contain various weakness variants. Use the template directory. A single test case consists of the following structure:

1. A directory named WCR-<number> that contains all files belonging to a single test case
2. A vulnerable contract and a contract where the vulnerability has been fixed for each issue.
3. Add your contracts for compilation to the CMakeLists root file
4. Optional unit tests showing how to exploit the vulnerable contract. Add your contract to hydra.yml

Compiling contracts

After adding your contracts for compilation to the CMakeLists root file:

cd test_cases
cmake .
make

Running unit tests

cd test_cases
# If this is the first time running Hydra in this directory then install dependencies
npm i
# run all
npm test
# run only wcr-105 tests
npm test -- -t 'wcr-105'

One more thing, make sure the credit the author and mention the source if you don't write the contract sample yourself.

/*
 * @source: <link>
 * @author: <name>
 */

Contributing

Before you create a PR for the first time make sure you have read:

• the sections Create a new EOSIO WCR entry and Create a new test case.
• read several existing EOSIO WCR definitions and their test cases.

Scope of Weaknesses

EOSIO WCRs should be concerned with weaknesses that can be identified within the code of a smart contract, typically C++. Weaknesses in 'smart contract adjacent' code should not be included.

Contact

This repository is maintained by the Klevoya team.