Class EnsurePrgSeed

A detector that identifies all calls to nativeRandom and nativeRandomInterval without a preceding PRG seed initialization.

Why is it bad?

Using nativeRandom or nativeRandomInterval without first initializing the PRG seed via nativePrepareRandom, nativeRandomize, or nativeRandomizeLt may lead to unintended behavior or weak random number generation. This detector ensures that PRG seed initialization is always performed before any use of random functions, enhancing contract security.

Example

// Bad: `nativeRandom` is used without prior PRG seed initialization
fun generateRandomValue(): Int {
  return nativeRandom()
}

Use instead:

fun test(): Int {
  nativePrepareRandom();
}

// OK: PRG has been initialized somewhere in the contract
fun generateRandomValue(): Int {
  return nativeRandom()
}

Hierarchy (view full)

Constructors

constructor

Properties

ctx severity

Accessors

id kind shareImportedWarnings usesSouffle

Methods

check makeWarning skipUnused

Constructors

constructor

Properties

Readonlyctx

ctx: MistiContext

severity

severity: Severity = Severity.MEDIUM

Gets the severity of the detector.

Accessors

id

  • get id(): string

  • Gets the short identifier of the detector, used in analyzer warnings.

    Returns string

    The unique identifier of the detector.

kind

shareImportedWarnings

  • get shareImportedWarnings(): WarningsBehavior

  • Defines the behavior of warnings generated by this detector when working with multiple projects within a single Tact configuration.

    Here are the available options:

    1. "union" Leave this value if you don't care about warnings generated in other projects.
    2. "intersect" If the warning is generated for some source location of the imported file, it should be generated by each of the projects. Example: Constants from an imported file should not be reported iff they are unused in all the projects, so you need "intersect".

    Returns WarningsBehavior

usesSouffle

  • get usesSouffle(): boolean

  • Checks whether this detector needs the Soufflé binary to be executed.

    Returns boolean

Methods

check

ProtectedmakeWarning

ProtectedskipUnused

Settings

Member Visibility

On This Page

Why is it bad?Example
Constructors
Properties
Accessors
Methods