registry / @aztec/txe / 4.4.0

@aztec/txe@4.4.0

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 42 file(s), 338 KB of source, external domains: docs.aztec.network

Source & flagged code

1 flagged

dest/index.jsView file

Lines 31-71javascript

31 // eslint-disable-next-line camelcase

32 session_id: z.number().int().nonnegative(),

33 function: z.string(),

34 // eslint-disable-next-line camelcase

35 root_path: z.string(),

36 // eslint-disable-next-line camelcase

37 package_name: z.string(),

38 inputs: ForeignCallArgsSchema

39}));

40class TXEDispatcher {

41 logger;

42 contractStore;

43 constructor(logger){

44 this.logger = logger;

45 }

46 fastHashFile(path) {

47 return new Promise((resolve)=>{

48 const fd = createReadStream(path);

49 const hash = createHash('sha1');

50 hash.setEncoding('hex');

51 fd.on('end', function() {

52 hash.end();

53 resolve(hash.read());

54 });

55 fd.pipe(hash);

56 });

57 }

58 async #processDeployInputs({ inputs, root_path: rootPath, package_name: packageName }) {

59 const [contractPath, initializer] = inputs.slice(0, 2).map((input)=>fromArray(input).map((char)=>String.fromCharCode(char.toNumber())).join(''));

60 const decodedArgs = fromArray(inputs[3]);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dest/index.jsView on unpkg · L51

61 const secret = fromSingle(inputs[4]);

62 const salt = fromSingle(inputs[5]);

63 const deployer = addressFromSingle(inputs[6]);

64 const publicKeys = secret.equals(Fr.ZERO) ? PublicKeys.default() : (await deriveKeys(secret)).publicKeys;

65 const publicKeysHash = await publicKeys.hash();

66 let artifactPath = '';

67 const { dir: contractDirectory, base: contractFilename } = parse(contractPath);

68 if (contractDirectory) {

69 if (contractDirectory.includes('@')) {

70 // We're deploying a contract that belongs in a workspace

71 // env.deploy("../path/to/workspace/root@packageName/contractName")

Source & flagged code

1 flagged · loading source

dest/index.jsView file

51fd.on('end', function() { L52: hash.end(); L53: resolve(hash.read()); ... L58: async #processDeployInputs({ inputs, root_path: rootPath, package_name: packageName }) { L59: const [contractPath, initializer] = inputs.slice(0, 2).map((input)=>fromArray(input).map((char)=>String.fromCharCode(char.toNumber())).join('')); L60: const decodedArgs = fromArray(inputs[3]);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dest/index.jsView on unpkg · L51

Findings

1 Medium6 Low

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodest/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

dest/index.jsView file

Lines 31-71javascript

31 // eslint-disable-next-line camelcase

32 session_id: z.number().int().nonnegative(),

33 function: z.string(),

34 // eslint-disable-next-line camelcase

35 root_path: z.string(),

36 // eslint-disable-next-line camelcase

37 package_name: z.string(),

38 inputs: ForeignCallArgsSchema

39}));

40class TXEDispatcher {

41 logger;

42 contractStore;

43 constructor(logger){

44 this.logger = logger;

45 }

46 fastHashFile(path) {

47 return new Promise((resolve)=>{

48 const fd = createReadStream(path);

49 const hash = createHash('sha1');

50 hash.setEncoding('hex');

51 fd.on('end', function() {

52 hash.end();

53 resolve(hash.read());

54 });

55 fd.pipe(hash);

56 });

57 }

58 async #processDeployInputs({ inputs, root_path: rootPath, package_name: packageName }) {

59 const [contractPath, initializer] = inputs.slice(0, 2).map((input)=>fromArray(input).map((char)=>String.fromCharCode(char.toNumber())).join(''));

60 const decodedArgs = fromArray(inputs[3]);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dest/index.jsView on unpkg · L51

61 const secret = fromSingle(inputs[4]);

62 const salt = fromSingle(inputs[5]);

63 const deployer = addressFromSingle(inputs[6]);

64 const publicKeys = secret.equals(Fr.ZERO) ? PublicKeys.default() : (await deriveKeys(secret)).publicKeys;

65 const publicKeysHash = await publicKeys.hash();

66 let artifactPath = '';

67 const { dir: contractDirectory, base: contractFilename } = parse(contractPath);

68 if (contractDirectory) {

69 if (contractDirectory.includes('@')) {

70 // We're deploying a contract that belongs in a workspace

71 // env.deploy("../path/to/workspace/root@packageName/contractName")