audit-ci.jsonc

{
  "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
  "low": true,
  "allowlist": [
    // Open Zepplin
    ////////////
    // https://github.com/advisories/GHSA-4g63-c64m-25w9
    // OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
    // We dont use EIP-1271
    "GHSA-4g63-c64m-25w9",
    // https://github.com/advisories/GHSA-qh9x-gcfh-pcrw
    // OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
    // We don't use ERC165Checker
    "GHSA-qh9x-gcfh-pcrw",
    // https://github.com/advisories/GHSA-7grf-83vw-6f5x
    // OpenZeppelin Contracts ERC165Checker unbounded gas consumption
    // We don't use ERC165Checker
    "GHSA-7grf-83vw-6f5x",
    // https://github.com/advisories/GHSA-xrc4-737v-9q75
    // OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals
    // We don't use GovernorVotesQuorumFraction
    "GHSA-xrc4-737v-9q75",
    // https://github.com/advisories/GHSA-4h98-2769-gh6h
    // OpenZeppelin Contracts vulnerable to ECDSA signature malleability
    // We don’t use signatures for replay protection anywhere
    "GHSA-4h98-2769-gh6h",
    // https://github.com/advisories/GHSA-mx2q-35m2-x2rh
    // OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts-upgradeable
    // from: arb-bridge-peripherals>@openzeppelin/contracts-upgradeable
    // from: arb-bridge-peripherals>arb-bridge-eth>@openzeppelin/contracts-upgradeable
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts
    // from: arb-bridge-peripherals>@openzeppelin/contracts
    // from: arb-bridge-peripherals>arb-bridge-eth>@openzeppelin/contracts
    // Clashing selector between proxy and implementation can only be caused deliberately
    "GHSA-mx2q-35m2-x2rh",
    // https://github.com/advisories/GHSA-93hq-5wgc-jc82
    // GovernorCompatibilityBravo may trim proposal calldata
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts-upgradeable
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts
    // We don't use GovernorCompatibilityBravo
    "GHSA-93hq-5wgc-jc82",
    // https://github.com/advisories/GHSA-5h3x-9wvq-w4m2
    // OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts-upgradeable
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts
    // We don't use Governor or GovernorCompatibilityBravo
    "GHSA-5h3x-9wvq-w4m2",
    // https://github.com/advisories/GHSA-g4vp-m682-qqmp
    // OpenZeppelin Contracts vulnerable to Improper Escaping of Output
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts-upgradeable
    // from @arbitrum/nitro-contracts>@openzeppelin/contracts
    // We don't use ERC2771Context
    "GHSA-g4vp-m682-qqmp",
    // https://github.com/advisories/GHSA-wprv-93r4-jj2p
    // OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
    // we don't use oz/merkle-trees anywhere
    // from @arbitrum/nitro-contracts>@offchainlabs/upgrade-executor>@openzeppelin/contracts-upgradeable
    // from @arbitrum/nitro-contracts>@offchainlabs/upgrade-executor>@openzeppelin/contracts
    "GHSA-wprv-93r4-jj2p",
    // https://github.com/advisories/GHSA-3787-6prv-h9w3
    // Undici proxy-authorization header not cleared on cross-origin redirect in fetch
    "GHSA-3787-6prv-h9w3",
    // https://github.com/advisories/GHSA-699g-q6qh-q4v8
    // OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
    // from: @offchainlabs/l1-l3-teleport-contracts>@openzeppelin/contracts
    "GHSA-699g-q6qh-q4v8",
    // https://github.com/advisories/GHSA-9vx6-7xxf-x967
    // OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
    // we don't use the base64 functions
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts-upgradeable
    // from: @arbitrum/token-bridge-contracts>@openzeppelin/contracts-upgradeable
    // from: @arbitrum/nitro-contracts>@openzeppelin/contracts
    // from: @arbitrum/token-bridge-contracts>@openzeppelin/contracts
    "GHSA-9vx6-7xxf-x967",
    // https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
    // axios can leak auth headers when using `Proxy-Authentication` header. We do not use that header.
    // from: axios>follow-redirects
    // from: hardhat>solc>follow-redirects
    "GHSA-cxjh-pqwp-8mfp",
    // https://github.com/advisories/GHSA-9qxr-qj54-h672
    // Undici's fetch with integrity option is too lax when algorithm is specified but hash value is incorrect
    // hardhat requests are only done during development
    // from: hardhat>undici
    "GHSA-9qxr-qj54-h672",
    // https://github.com/advisories/GHSA-m4v8-wqvr-p9f7
    // Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
    // hardhat requests are only done during development
    // from: hardhat>undici
    "GHSA-m4v8-wqvr-p9f7",
    // https://github.com/advisories/GHSA-grv7-fg5c-xmjg
    // Uncontrolled resource consumption in braces
    // eslint and hardhat dependency, only used in dev
    // from: hardhat>braces & eslint>braces
    "GHSA-grv7-fg5c-xmjg",
    // https://github.com/advisories/GHSA-3h5v-q93c-6h6q
    // Exposure of Sensitive Information in ws
    // Issue with sol2uml library that generates UML diagrams from Solidity code. Only used at build time.
    // from: @offchainlabs/l1-l3-teleport-contracts>@arbitrum/nitro-contracts>sol2uml>convert-svg-to-png>convert-svg-core>puppeteer>ws
    // from: @offchainlabs/l1-l3-teleport-contracts>@arbitrum/token-bridge-contracts>@arbitrum/nitro-contracts>sol2uml>convert-svg-to-png>convert-svg-core>puppeteer>ws
    "GHSA-3h5v-q93c-6h6q",
    // https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
    // Axios: Server-Side Request Forgery vulnerability
    // Issue with sol2uml library that generates UML diagrams from Solidity code. Only used at build time.
    // from: @offchainlabs/l1-l3-teleport-contracts>@arbitrum/nitro-contracts>sol2uml>axios
    // from: @offchainlabs/l1-l3-teleport-contracts>@arbitrum/token-bridge-contracts>@arbitrum/nitro-contracts>sol2uml>axios
    "GHSA-wf5p-g6vw-rhxx"
  ]
}