regolith-labs/steel

fn try_header_from_bytes_mut(data: &mut [u8]) -> Result<(&mut Self, &mut [u8]), ProgramError> {
    let (prefix, remainder) = data[8..].split_at_mut(std::mem::size_of::<T>());

the read-only twin, try_header_from_bytes (line 52), rejects data whose type byte does not match. The mutable version does not. A program that loads a header-plus-body account (for example a merkle tree) through this public method will accept any other account it owns that is long enough, then reinterpret it and write to it as the header type. An attacker can therefore pass one of the program's other account types and corrupt or forge its state through the header path. That is type confusion with write access.

add the same Self::discriminator().ne(&data[0]) check as the read-only variant, and a length check before slicing.

let base_path = Path::new(&project_name);
...
fs::write(path, content)?;

create_dir_all succeeds when the directory already exists, and every template file is then written with fs::write. Running steel new <existing-name> (or steel new .) silently replaces the existing Cargo.toml, README.md, lib.rs, the program sources and the tests. A name such as ../x writes outside the working directory, and quotes or braces in the name are substituted straight into the generated manifest.

refuse a non-empty target directory, open each file with create_new(true), and require names to match [a-z][a-z0-9_-]*.

let new_key = Keypair::new();
replace_prog_id(new_key.insecure_clone().into())?;
let mut lib_rs = fs::OpenOptions::new().create(true).write(true).truncate(true).open(deploy_kp_path)?;

the command is documented as "Sync declared program id to deploy program keypair". It reads the existing keypair (line 82), but whenever lib.rs does not already contain that key, which is the only case in which it does anything, it discards the key, generates a random one and truncates the keypair file. The original program keypair is lost for good: it lives in git-ignored target/, and there is no prompt or backup. Planned or vanity program ids, and the ids of programs already in use elsewhere, are replaced rather than synced. The "synced to" message hides this.

pass the keypair already read to replace_prog_id and never write the keypair file in sync.

let mut data = self.try_borrow_mut_data()?;
...
T::try_from_bytes_mut(std::slice::from_raw_parts_mut(data.as_mut_ptr(), expected_len))

the borrow guard is dropped when the function returns, but the &mut T it returns lives as long as the AccountInfo. When a caller passes the same account twice (for example as both from and to), both loads succeed and the program holds two live mutable references to the same bytes. The runtime's duplicate-borrow protection is bypassed and the behaviour is undefined. A handler that reads both balances before writing them can then credit funds without debiting them. A close or realloc while such a reference is held leaves it dangling.

return a guard (RefMut::map) that keeps the borrow alive, or provide and document a duplicate-account check that callers must run before loading.

let offset = contents.find("declare_id!").unwrap_or(contents.len());
let offset_start = offset + 11;
contents.replace_range(offset_start.., &formatted_key);

the replacement runs to the end of the file. Any code a developer has placed after declare_id! in api/src/lib.rs is deleted by keys new or keys sync. If the macro is absent, the index is out of range and the CLI panics, although the doc comment promises an error.

replace only the declare_id!("…"); span, matched with a regex or syn, and return an error when it is not found.

.status()
.expect("Failed to execute command");
Ok(())

the exit status of the child process is discarded. A failed compile or failing tests still exit 0, so a CI pipeline goes green and can merge or deploy a broken program.

check status.success() and return an error carrying the child's exit code.

if data.len() < spl_token_2022::state::Account::LEN {
...
let account = spl_token_2022::state::Account::unpack(std::slice::from_raw_parts(data.as_ptr(), spl_token_2022::state::Account::LEN))?;

any account owned by Token-2022 that is at least 165 bytes long is unpacked from its first 165 bytes, and the account-type byte at offset 165 is never read. Anyone can create a Token-2022 multisig account (355 bytes). Its signer slots hold bytes the creator chooses, and those bytes line up with the owner, amount, delegate and state fields of a token account. as_token_account then returns an owner, balance and delegate of the attacker's choosing. A program that does not pin the mint to a fixed value can be made to credit a balance that does not exist.

for Token-2022, parse with StateWithExtensions::<Account>::unpack, which checks the account type. Reject multisig-length data.

&spl_token::instruction::approve(
    &spl_token::ID,

every sibling wrapper builds its instruction for token_program.key. This one hard-codes the legacy program. With a Token-2022 account the instruction targets a program that is not in the account list, so the call fails. Program-id handling is inconsistent across the wrappers.

build the instruction with token_program.key, and check that it is one of the two canonical token program ids.

if Self::discriminator().ne(&data[0]) {
...
bytemuck::try_from_bytes::<Self>(&data[8..])

data[0], data[8..] and split_at panic when the slice is too short. is_type panics the same way on a program-owned account with empty data. On chain, the transaction aborts with an opaque panic instead of InvalidAccountData. Off-chain clients and indexers that use these public functions on RPC data crash when an account is missing, because a missing account returns an empty buffer.

check data.len() >= 8 + size_of::<T>() (or >= 1 for the type check) and return InvalidAccountData.

replace_prog_id(new_key.insecure_clone().into())?;

keys new and keys sync both rewrite api/src/lib.rs and then the keypair file, as two independent steps. If the second write fails, the declared id and the keypair no longer match.

route both commands through one function that writes both files to temporary files, renames them into place, and re-reads them to confirm they agree.

pub fn create_associated_token_account<'info>(
...
pub fn get_account_data_size(

transfer, mint/burn, freeze/thaw, delegation, authority, multisig and native-SOL wrappers share one file as about 30 near-identical signed/unsigned pairs. Findings 20 and 21 are copy-paste defects of the kind this structure produces.

split the file into one module per group, and generate the signed variants from a single helper.

let bump: &[u8] = &[bump];
let mut combined_seeds = Vec::with_capacity(seeds.len() + 1);
combined_seeds.extend_from_slice(seeds); combined_seeds.push(bump);

the same block appears twice, and the bump derivation is repeated in about 15 wrappers. The duplicates can drift apart.

move both into one private helper.

pub fn parse_instruction<'a, T: std::convert::TryFrom<u8>>(
...
pub fn string_to_bytes<const N: usize>(s: &str) -> Result<[u8; N], ProgramError> {

instruction dispatch and fixed-width string codecs sit in the same module. cli/src/utils.rs mixes stdin prompting, naming, manifest inspection and source rewriting. This makes ownership and review harder.

split by concern, for example instruction.rs and string.rs, and naming.rs, project.rs and prog_id.rs in the CLI.

} = load_config().unwrap_or_default();
let url = client_url.unwrap_or(json_rpc_url);

a malformed config file is swallowed. The RPC URL, commitment and keypair path quietly change to library defaults with no warning.

fall back to defaults only when the file is not found. Report parse errors, and print the URL and signer actually in use.

let mut lib_rs = fs::OpenOptions::new()
    .create(true).write(true).truncate(true)
    .open(deploy_kp_path)?;

the keypair lives in target/deploy, which is git-ignored, so this is usually the only copy. It is truncated and replaced at once. The new secret key is written with the process umask, typically readable by other local users.

require --force or a confirmation prompt, copy the old file to a backup first, write to a temporary file and rename it, and create the file with mode 0600.

Command::new("cargo")
    .arg("clean")

all three copies share the ignored-exit-status defect (finding 17), so the fix has to be made three times.

add one run_cargo(args) helper that checks the exit status, and call it from all three commands.

let deploy_kp_path = format!("./target/deploy/{}-keypair.json", formatted);

three copies of the same path logic and checks, plus two copies of the keypair write block, can drift apart.

extract deploy_keypair_path(), require_built_project() and write_keypair_file() helpers.

let (_url, _signer) = load_client_and_signer(url, commitment, keypair)?;

new, build, test, clean and keys all fail on a machine or CI runner without a Solana keypair file. With a usb:// or prompt:// signer they block on a hardware-wallet or seed prompt for nothing.

remove the call, or make it lazily in the commands that actually sign.

let bump = Pubkey::find_program_address(seeds, authority_info.owner).1;

the runtime checks PDA signatures against the calling program. A typical vault authority PDA has no data and is owned by the System program, so the bump derived here does not match and every transfer_signed, mint_to_signed, burn_signed and similar call fails. The variants that use the token program id can never sign. The failure is closed, but PDA-authority token flows built on these helpers do not work.

take the calling program id as a parameter, or require the *_with_bump variants with a stored bump.

&spl_token_2022::instruction::approve_checked(
    &token_program.key,
    mint_info.key,
    source_info.key,

approve_checked swaps source and mint. The signed variants pass the delegate as the owner and signer and leave required accounts out of the account list. approve_checked_signed calls the unchecked approve, so the decimals check its name promises never runs. These calls fail, or they run with the wrong authority semantics.

follow the token program's parameter order (program, source, mint, delegate, owner, signers), take an explicit owner, and route the checked variant to the checked instruction.

&spl_token_2022::instruction::initialize_multisig(&token_program.key, multisig_info.key, &[signer_info.key], n)?,
&[token_program.clone(), signer_info.clone()],

the instruction references an account that is not passed, so every call fails. The wrapper also accepts only one signer for an m-of-n setup.

pass the multisig account and a slice of signers.

if data.len() != spl_token_2022::state::Mint::LEN {

any mint with a transfer fee, metadata pointer, transfer hook or other extension is longer than 82 bytes. Programs built on as_mint cannot accept those tokens, and extensions are the main reason to use Token-2022.

parse with StateWithExtensions::<Mint>::unpack.

Numeric::from_i80f48(self.to_i80f48() + other.to_i80f48())

in release builds, with overflow checks off as is usual for Solana programs, add, subtract and multiply wrap silently. to_u64 turns negative or oversized values into wrong numbers. Division by zero aborts. A program doing price or reward math can store a plausible but wrong value.

add checked_* operations and try_to_u64 / try_to_i64 that return a Result, and document the behaviour of the operator forms.

**self.lamports.borrow_mut() -= lamports;
**to.lamports.borrow_mut() += lamports;

an amount larger than the balance wraps the source to about 2^64 in release builds. The program keeps running on corrupt balances until the runtime rejects the transaction with a generic error. The function returns (), so it cannot signal insufficient funds.

use checked_sub and checked_add, and return Result<(), ProgramError>.

fn assert_mut<F>(&mut self, _condition: F) -> Result<&mut Self, ProgramError>
...
    panic!("not implemented")

these public trait methods compile but abort the program at runtime with no meaningful error.

return an error, or split the trait so these types do not offer the mutable methods.

Ok(String::from_utf8_lossy(&bytes[..actual_len])
    .trim_matches('\0')
    .to_string())

the doc comment promises an error for invalid UTF-8. Instead, invalid bytes are replaced, so two different stored names can read back as the same string. string_to_bytes also accepts embedded NUL bytes, which truncate the value on the way back.

use String::from_utf8 and map the failure to the documented error, and reject interior NULs when encoding.

pub fn from_bytes(data: &[u8]) -> &Self {
    bytemuck::from_bytes::<Self>(data)
}

indexers that decode event bytes from transaction logs crash on truncated or misaligned data. The instruction macro already generates a fallible decoder.

generate a try_from_bytes that returns a Result.

dirs.iter().any(|dir| path_str.contains(dir)) // fixme: `contains` also matches partial words

directories such as apis, rapid or programs count as matches. A real project with an extra matching folder is rejected, and a non-project can pass. This check is the only guard before the keypair and source rewrites.

compare each entry's file_name() exactly.

let amount = u64::from_le_bytes(args.amount);
...
counter.value += amount;

the value < 100 guard runs before the addition, so a large amount wraps the counter in release builds. Every project generated by steel new starts from this pattern.

use checked_add and apply the bound to the result.

steel = "3.0"

the workspace ships version 4.0.9, but steel new creates projects pinned to 3.x. The scaffold, the documentation and the CLI drift away from the library the generated code compiles against.

substitute the CLI's own package version into the template at build time, and add a CI job that generates a project and builds it.