Systematically scan Algorand smart contracts (TEAL and PyTeal) for platform-specific security vulnerabilities documented in Trail of Bits' \"Not So Smart Contracts\" database. This skill encodes 11 critical vulnerability patterns unique to Algorand's transaction model.
\n.teal.py with PyTeal imports# PyTeal indicators\nfrom pyteal import *\nfrom algosdk import *\n\n# Common patterns\nTxn, Gtxn, Global, InnerTxnBuilder\nOnComplete, ApplicationCall, TxnType\n@router.method, @Subroutine\napproval_program.py / clear_program.pycontract.teal / signature.tealuv tool install tealer (ensure uv's tool bin dir is on PATH)tealer contract.teal --detect allWhen invoked, I will:
\nWhen vulnerabilities are found, you'll get a report like this:
\n=== ALGORAND VULNERABILITY SCAN RESULTS ===\n\nProject: my-algorand-dapp\nFiles Scanned: 3 (.teal, .py)\nVulnerabilities Found: 2\n\nCoverage: 11/11 patterns reported\n 1 Rekeying Attack ................... found approval.py:45\n 2 Unchecked Transaction Fee ......... n/a stateful app, fees paid by sender\n 3 Closing Account ................... clear Assert(Txn.close_remainder_to() == Global.zero_address())\n ... one row per pattern, all 11 present ...\n\n---\n\n[CRITICAL] Rekeying Attack\nFile: contracts/approval.py:45\nPattern: Missing RekeyTo validation\n\nCode:\n If(Txn.type_enum() == TxnType.Payment,\n Seq([\n # Missing: Assert(Txn.rekey_to() == Global.zero_address())\n App.globalPut(Bytes(\"balance\"), balance + Txn.amount()),\n Approve()\n ])\n )\n\nIssue: The contract doesn't validate the RekeyTo field, allowing attackers\nto change account authorization and bypass restrictions.\nI check for 11 critical vulnerability patterns unique to Algorand. For detailed detection patterns, code examples, mitigations, and testing strategies, see VULNERABILITY_PATTERNS.md.
\nGlobal.group_size() validation on atomic groupsFor complete vulnerability patterns with code examples, see VULNERABILITY_PATTERNS.md.
\n.teal, .py)# Run Tealer on contract\ntealer contract.teal --detect all\n\n# Or specific detectors\ntealer contract.teal --detect unprotected-rekey,group-size-check,update-application-check\nFor each of the 11 vulnerabilities above:
\nCreate checklist for all transaction types used:
\nPayment Transactions:
\nAsset Transfers:
\nApplication Calls:
\nInner Transactions:
\nFor atomic transaction groups:
\nGlobal.group_size() checksReport on every pattern in §6, whether or not it turned anything up. Emit this table above the findings, with\nall 11 rows present:
\n| # | \nPattern | \nVerdict | \nEvidence | \n
|---|---|---|---|
| 1 | \nRekeying Attack | \nfound | \napproval.py:45 -- no Txn.rekey_to() assertion on the payment branch | \n
| 2 | \nUnchecked Transaction Fee | \n\n | \n |
| 3 | \nClosing Account (CloseRemainderTo) | \n\n | \n |
| 4 | \nClosing Asset (AssetCloseTo) | \n\n | \n |
| 5 | \nGroup Size Check | \n\n | \n |
| 6 | \nTime-Based Replay Attack | \n\n | \n |
| 7 | \nAccess Controls | \n\n | \n |
| 8 | \nAsset ID Verification | \n\n | \n |
| 9 | \nDenial of Service (Asset Opt-In) | \n\n | \n |
| 10 | \nInner Transaction Fee | \n\n | \n |
| 11 | \nClear State Transaction | \n\n | \n |
Each verdict is one of:
\nfound — cite file:line and write the finding up in full below.clear — the pattern applies to this contract and the contract handles it. Name the field, opcode, or\ncheck you searched for, so a reader can repeat the search.n/a — the pattern cannot apply here. Give the reason in one clause (\"no inner transactions in this\ncontract\"). Not having looked is not n/a.A table with fewer than 11 rows is an incomplete scan and must be reported as one. A row whose Verdict cell is empty is incomplete in the same way: row 1 above is filled in to show the shape, and every row is filled in the same way before the report is done. Eleven clear verdicts is\na result a reader can act on. A report that covers four patterns and says nothing about the other seven reads\nexactly like a clean contract, and that is the failure this table exists to prevent.
## [SEVERITY] Vulnerability Name (e.g., Missing RekeyTo Validation)\n\n**Location**: `contract.teal:45-50` or `approval_program.py:withdraw()`\n\n**Description**:\nThe contract approves payment transactions without validating the RekeyTo field, allowing an attacker to rekey the account and bypass future authorization checks.\n\n**Vulnerable Code**:\n```python\n# approval_program.py, line 45\nIf(Txn.type_enum() == TxnType.Payment,\n Approve() # Missing RekeyTo check\n)\n```\n\n**Attack Scenario**:\n1. Attacker submits payment transaction with RekeyTo set to attacker's address\n2. Contract approves transaction without checking RekeyTo\n3. Account authorization is rekeyed to attacker\n4. Attacker gains full control of account\n\n**Recommendation**:\nAdd explicit validation of the RekeyTo field:\n```python\nIf(And(\n Txn.type_enum() == TxnType.Payment,\n Txn.rekey_to() == Global.zero_address()\n), Approve(), Reject())\n```\n\n**References**:\n- building-secure-contracts/not-so-smart-contracts/algorand/rekeying\n- Tealer detector: `unprotected-rekey`\n# Add to CI/CD pipeline\ntealer approval.teal --detect all --json > tealer-report.json\n\n# Fail build on critical findings\ntealer approval.teal --detect all --fail-on critical,high\nbuilding-secure-contracts/not-so-smart-contracts/algorand/Before completing Algorand audit, verify ALL items checked:
\nfound, clear or n/a with a reasonn/a costs one\nclause and makes the judgment reviewable. Silence records nothing, and a reader cannot tell it apart from\nnot having checked.file:line, and split-program contracts are where these checks go missing.