Issues

• checks: auth.rs duplicates four helper functions that already exist as public functions in util.rs

  checks-cratedead-code
  SorobanGuard/Guard-CLI#747 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: unprotected-admin's primary auth check accepts any require_auth() call anywhere in the function, unrelated to the actual admin/caller address

  bugchecks-crate
  SorobanGuard/Guard-CLI#746 · Filter by author unrealtim-tech opened on Sep 28, 2026

• analyzer: is_suppressed's empty-function-name fallback resolves the correct span but never uses it in the final suppression lookup — its own unit test fails

  analyzer-cratebugcritical
  SorobanGuard/Guard-CLI#745 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: self-transfer flags transfer_ownership as needing a from == to guard — its own test ignores_transfer_ownership fails on main

  bugchecks-cratecritical
  SorobanGuard/Guard-CLI#744 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: unprotected-upgrade/unprotected-contract-deployment's admin-variable heuristic misses owner/caller, unlike admin.rs's equivalent list, causing false positives

  bugchecks-crate
  SorobanGuard/Guard-CLI#743 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: unchecked-arithmetic's severity heuristic substring-matches variable names, misclassifying financial names like deposit/discount as index/counter math

  bugchecks-crate
  SorobanGuard/Guard-CLI#742 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: missing-nonce's contains_nonce_reference accepts any textual mention of a nonce keyword, not an actual replay-protection check

  bugchecks-crate
  SorobanGuard/Guard-CLI#741 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: unchecked-divisor has no guard/validation detection at all — its own "safe" fixture (divide_safe) still triggers the check

  bugchecks-crate
  SorobanGuard/Guard-CLI#740 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: large-loop's own "safe" fixture triggers the check, and the check isn't wired into the CLI's fixture-pair tests

  bugchecks-cratetesting
  SorobanGuard/Guard-CLI#739 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: delegate-call-risk's renamed-Env-parameter fix (issue #456) shipped without its required regression test

  checks-crategood first issuetesting
  SorobanGuard/Guard-CLI#738 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: missing-balance-check accepts .authorized() as a guard on a TokenClient, but authorized() isn't a TokenClient method

  bugchecks-crate
  SorobanGuard/Guard-CLI#737 · Filter by author unrealtim-tech opened on Sep 28, 2026

• cli: fixture_scans.rs still has no assert_fixture_pair coverage for 5 registered checks — issue #291 was closed by an unrelated PR

  cli-cratetesting
  SorobanGuard/Guard-CLI#736 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: symbol-key-collision's Symbol::new(&env, CONST) "known gap" test is still present verbatim — issue #616 was closed without the fix landing

  bugchecks-cratetesting
  SorobanGuard/Guard-CLI#735 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: symbol-key-collision is still file-wide (not per-#[contractimpl]-block) and still flags a key reused within one function — issue #448 was closed without the fix landing

  bugchecks-cratetesting
  SorobanGuard/Guard-CLI#734 · Filter by author unrealtim-tech opened on Sep 28, 2026

• test-contracts: hardcoded-address-vulnerable::get_token's address literal is 57 chars, one too long to ever match hardcoded-address

  bugtesting
  SorobanGuard/Guard-CLI#733 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: hardcoded-address scans the entire raw source, including #[cfg(test)] modules

  bugchecks-crate
  SorobanGuard/Guard-CLI#732 · Filter by author unrealtim-tech opened on Sep 28, 2026

• checks: missing-event-emission's local is_storage_mutation_call still treats extend_ttl/bump as mutations, unlike util::is_storage_mutation_call

  bugchecks-crate
  SorobanGuard/Guard-CLI#731 · Filter by author unrealtim-tech opened on Sep 28, 2026

• docs: false-positives.md per-check table links use the wrong checks.md anchor format for ~27 checks

  bugdocumentation
  SorobanGuard/Guard-CLI#730 · Filter by author unrealtim-tech opened on Sep 28, 2026

• docs: false-positives.md has a duplicate, stale unchecked-arithmetic row

  documentationgood first issue
  SorobanGuard/Guard-CLI#729 · Filter by author unrealtim-tech opened on Sep 28, 2026

• docs: CONTRIBUTING.md step 7 still says nothing enforces the check registry, but registry_consistency.rs does

  documentationgood first issue
  SorobanGuard/Guard-CLI#728 · Filter by author unrealtim-tech opened on Sep 28, 2026

• docs: configuration.md omits the [scan] path key that soroban-guard.toml actually supports

  cli-cratedocumentationgood first issue
  SorobanGuard/Guard-CLI#727 · Filter by author unrealtim-tech opened on Sep 28, 2026

• cli: dead duplicate soroban-guard.toml load reintroduces the exact bug issue #626 closed

  bugcli-crate
  SorobanGuard/Guard-CLI#726 · Filter by author unrealtim-tech opened on Sep 28, 2026

• docs: branch-protection.md required status checks omit the fixture-check job (and don't account for the ci matrix)

  cidocumentationgood first issue
  SorobanGuard/Guard-CLI#725 · Filter by author unrealtim-tech opened on Sep 28, 2026

• analyzer: check_panics returned by scan_directory/scan_directory_with_checks/scan_files is never sorted — non-deterministic ordering across runs

  analyzer-cratebugtesting
  SorobanGuard/Guard-CLI#724 · Filter by author unrealtim-tech opened on Sep 28, 2026

• analyzer: is_suppressed re-scans every FnSpan for every finding — O(checks × findings × functions) per file

  analyzer-crateenhancement
  SorobanGuard/Guard-CLI#723 · Filter by author unrealtim-tech opened on Sep 28, 2026