Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix typos in "Static Analysis of Runtime Pallets" RFP #2235

Merged
merged 1 commit into from
Feb 27, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions docs/RFPs/Static-Analysis-for-Runtime-Pallets.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ This Request for Proposals is currently considered **under development**, meanin

## Project Description :page_facing_up:

[Runtime Pallets](https://docs.substrate.io/fundamentals/runtime-development/) are modules for writing the business logic of blockchains in [Substrate](https://github.com/paritytech/polkadot-sdk/tree/master/substrate) (a Rust framework fo rbuilding blockchians). These are usually concise pieces of standalone code with relatively few dependencies and clear specifications, hence tractable targets for performing static analysis and verification. We would like to develop tools and techniques to perform static analysis with reasonable soundness guarantees. In particular, we would like to target vunerability classes that are detectable using dataflow analysis techniques like *tag analysis* and *taint analysis*. Just to give a flavor, relevant might vulnerabilities include:
[Runtime Pallets](https://docs.substrate.io/fundamentals/runtime-development/) are modules for writing the business logic of blockchains in [Substrate](https://github.com/paritytech/polkadot-sdk/tree/master/substrate) (a Rust framework for building blockchians). These are usually concise pieces of standalone code with relatively few dependencies and clear specifications, hence tractable targets for performing static analysis and verification. We would like to develop tools and techniques to perform static analysis with reasonable soundness guarantees. In particular, we would like to target vunerability classes that are detectable using dataflow analysis techniques like *tag analysis* and *taint analysis*. Just to give a flavor, relevant might vulnerabilities include:
* [incorrect origin](https://github.com/bhargavbh/MIRAI/blob/main/substrate_examples/incorrect-origin/description.md) of dispatchable functions.
* [unsigned transaction](https://github.com/bhargavbh/MIRAI/blob/main/substrate_examples/unsigned-transaction/description.md) validation.
* tracking bad randomness: ensure bad randomness does not leak into sensitive functions.
Expand All @@ -20,14 +20,14 @@ We seek applications that either extend existing static analysers for rust like

## Deliverables

The deliverables listed are an innitial draft and can be modified taking into consideration the interests of the applicant.
The deliverables listed are an initial draft and can be modified taking into consideration the interests of the applicant.

| Number | Deliverable | Specification |
| Number | Deliverable | Specification |
| ------------- | ------------- | ------------- |
| 0a. | License | Apache 2.0 / MIT / Unlicense |
| 0b. | Documentation | A document describing the design decisions for the tool and modeling of vulnerabilities. Clear usage guideline along with the trade-off of different modes if any.|
| 0c. | Testing Guide | Test-suite which exercises various features. |
| 0d. | Article | A brief outreach article describing the high-level technique used and outcomes of the grant, including asample of minimal examples. |
| 1 | Tool | A robust static analysis tool that works on Subsstrate runtime pallets and analyses vulnerabilities classes described above. |
| 2 | Engaegment | Engage with teams at Web3 Foundation and Parity to prioritise targeting vulnerability classes.|
| 0c. | Testing Guide | Test-suite which exercises various features. |
| 0d. | Article | A brief outreach article describing the high-level technique used and outcomes of the grant, including a sample of minimal examples. |
| 1 | Tool | A robust static analysis tool that works on Substrate runtime pallets and analyses vulnerabilities classes described above. |
| 2 | Engagement | Engage with teams at Web3 Foundation and Parity to prioritise targeting vulnerability classes.|

Loading