Skip to content

Commit

Permalink
Fix typos in "Static Analysis of Runtime Pallets" RFP (#2235)
Browse files Browse the repository at this point in the history
  • Loading branch information
davidsemakula authored Feb 27, 2024
1 parent 348a7bf commit fab3707
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions docs/RFPs/Static-Analysis-for-Runtime-Pallets.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ This Request for Proposals is currently considered **under development**, meanin

## Project Description :page_facing_up:

[Runtime Pallets](https://docs.substrate.io/fundamentals/runtime-development/) are modules for writing the business logic of blockchains in [Substrate](https://github.com/paritytech/polkadot-sdk/tree/master/substrate) (a Rust framework fo rbuilding blockchians). These are usually concise pieces of standalone code with relatively few dependencies and clear specifications, hence tractable targets for performing static analysis and verification. We would like to develop tools and techniques to perform static analysis with reasonable soundness guarantees. In particular, we would like to target vunerability classes that are detectable using dataflow analysis techniques like *tag analysis* and *taint analysis*. Just to give a flavor, relevant might vulnerabilities include:
[Runtime Pallets](https://docs.substrate.io/fundamentals/runtime-development/) are modules for writing the business logic of blockchains in [Substrate](https://github.com/paritytech/polkadot-sdk/tree/master/substrate) (a Rust framework for building blockchians). These are usually concise pieces of standalone code with relatively few dependencies and clear specifications, hence tractable targets for performing static analysis and verification. We would like to develop tools and techniques to perform static analysis with reasonable soundness guarantees. In particular, we would like to target vunerability classes that are detectable using dataflow analysis techniques like *tag analysis* and *taint analysis*. Just to give a flavor, relevant might vulnerabilities include:
* [incorrect origin](https://github.com/bhargavbh/MIRAI/blob/main/substrate_examples/incorrect-origin/description.md) of dispatchable functions.
* [unsigned transaction](https://github.com/bhargavbh/MIRAI/blob/main/substrate_examples/unsigned-transaction/description.md) validation.
* tracking bad randomness: ensure bad randomness does not leak into sensitive functions.
Expand All @@ -20,14 +20,14 @@ We seek applications that either extend existing static analysers for rust like

## Deliverables

The deliverables listed are an innitial draft and can be modified taking into consideration the interests of the applicant.
The deliverables listed are an initial draft and can be modified taking into consideration the interests of the applicant.

| Number | Deliverable | Specification |
| Number | Deliverable | Specification |
| ------------- | ------------- | ------------- |
| 0a. | License | Apache 2.0 / MIT / Unlicense |
| 0b. | Documentation | A document describing the design decisions for the tool and modeling of vulnerabilities. Clear usage guideline along with the trade-off of different modes if any.|
| 0c. | Testing Guide | Test-suite which exercises various features. |
| 0d. | Article | A brief outreach article describing the high-level technique used and outcomes of the grant, including asample of minimal examples. |
| 1 | Tool | A robust static analysis tool that works on Subsstrate runtime pallets and analyses vulnerabilities classes described above. |
| 2 | Engaegment | Engage with teams at Web3 Foundation and Parity to prioritise targeting vulnerability classes.|
| 0c. | Testing Guide | Test-suite which exercises various features. |
| 0d. | Article | A brief outreach article describing the high-level technique used and outcomes of the grant, including a sample of minimal examples. |
| 1 | Tool | A robust static analysis tool that works on Substrate runtime pallets and analyses vulnerabilities classes described above. |
| 2 | Engagement | Engage with teams at Web3 Foundation and Parity to prioritise targeting vulnerability classes.|

0 comments on commit fab3707

Please sign in to comment.