Overview

CWC RegistryChaincode Weakness Classification and Test Cases

This is an overview of the CWC registry, a weakness database for Hyperledger Fabric "smart contracts" (in Fabric parlance: chaincode), in the style of the SWC Registry. Each row consists of a CWC identifier (ID), weakness title, CWE parent and similar SWC entries (if applicable), and list of related code samples. This repository is currently maintained in conjunction with ongoing research efforts at the Fault Tolerant Systems Research Group at BME. Any contributions are wellcome. To reach out to us, contact Konrad Hambuch or Imre Kocsis - konrad.hambuch - at - edu.bme.hu, kocsis.imre - at - vik.bme.hu.

IDTitleRelationshipsTest cases
CWC-113

Assignment of ledger state to Variable without Use

CWE-563: Assignment to Variable without Use

CWC-112

Weak Sources of Randomness from Chain Attributes

SWC-120: Weak Sources of Randomness from Chain Attributes
CWE-330: Use of Insufficiently Random Values

    CWC-111

    DoS with Failed Call

    SWC-113: DoS with Failed Call
    CWE-703: Improper Check or Handling of Exceptional Conditions

      CWC-110

      Unchecked Call Return Value

      SWC-104: Unchecked Call Return Value
      CWE-252: Unchecked Return Value

        CWC-109

        Accessing external sources

        CWE-829: Inclusion of Functionality from Untrusted Control Sphere

          CWC-108

          No execution timer set

          CWE-665: Improper Initialization

            CWC-107

            Invoking chaincode on other channel

            TODO

              CWC-106

              Non-deterministic chaincode

              TODO

                CWC-105

                Initializing global variables in Init Function

                CWE-665: Improper Initialization

                CWC-104

                Putting private data on ledger

                CWE-201: Insertion of Sensitive Information Into Sent Data
                SWC-136: Unencrypted Private Data On-Chain

                  CWC-103

                  Modifying keys in a long iteration

                  CWE-834: Excessive Iteration

                    CWC-102

                    Modifying a narrow subset of keys

                    TODO

                      CWC-101

                      No Input type validation

                      CWE-1287: Improper Validation of Specified Type of Input

                        CWC-100

                        No input validation

                        CWE-20: Improper Input Validation