diff-review

You are reviewing the current branch diff for Solana-specific security issues, code quality problems, and anti-patterns. Output categorized findings with line references and fix suggestions.

Related Skills

• ext/solana-dev/skill/references/security.md - Vulnerability categories
• ext/trailofbits/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/ - Automated scanning

Step 1: Get the Diff

# Determine base branch
BASE_BRANCH="main"
if ! git rev-parse --verify "$BASE_BRANCH" >/dev/null 2>&1; then
    BASE_BRANCH="master"
fi

echo "Reviewing diff: $BASE_BRANCH...HEAD"
echo "Branch: $(git branch --show-current)"
echo ""

# Get the full diff
git diff "$BASE_BRANCH"...HEAD

echo ""
echo "Changed files:"
git diff --name-only "$BASE_BRANCH"...HEAD

echo ""
echo "Diff stats:"
git diff --stat "$BASE_BRANCH"...HEAD

Step 2: Check for Critical Issues

Scan the diff for each category. Report with file path, line number, and severity.

Account Validation

echo "=== Account Validation Check ==="

# Find Anchor account structs in changed files
CHANGED_RS=$(git diff --name-only "$BASE_BRANCH"...HEAD | grep '\.rs$')

if [ -n "$CHANGED_RS" ]; then
    echo "Checking Rust files for account validation..."

    # Missing owner checks in native programs
    for f in $CHANGED_RS; do
        [ -f "$f" ] || continue
        grep -n "AccountInfo" "$f" | head -20
    done

    # Check for accounts missing constraints in Anchor
    for f in $CHANGED_RS; do
        [ -f "$f" ] || continue
        # Accounts without any constraint attribute
        grep -n "pub.*Account<" "$f" | grep -v "#\[account" | head -20
    done
fi

Arithmetic Safety

echo ""
echo "=== Arithmetic Safety Check ==="

if [ -n "$CHANGED_RS" ]; then
    for f in $CHANGED_RS; do
        [ -f "$f" ] || continue
        # Unchecked arithmetic operators on likely numeric operations
        grep -n -E '\b\w+\s*[+\-\*]\s*\w+' "$f" | grep -v "checked_" | grep -v "//" | grep -v "test" | head -20
    done
fi