Algorand Vulnerability Scanner 1. Purpose

Systematically scan Algorand smart contracts (TEAL and PyTeal) for platform-specific security vulnerabilities documented in Trail of Bits' "Not So Smart Contracts" database. This skill encodes 11 critical vulnerability patterns unique to Algorand's transaction model.

1. When to Use This Skill Auditing Algorand smart contracts (stateful applications or smart signatures) Reviewing TEAL assembly or PyTeal code Pre-audit security assessment of Algorand projects Validating fixes for reported Algorand vulnerabilities Training team on Algorand-specific security patterns
2. Platform Detection File Extensions & Indicators TEAL files: .teal PyTeal files: .py with PyTeal imports Language/Framework Markers

PyTeal indicators

from pyteal import * from algosdk import *

Common patterns

Txn, Gtxn, Global, InnerTxnBuilder OnComplete, ApplicationCall, TxnType @router.method, @Subroutine

Project Structure approval_program.py / clear_program.py contract.teal / signature.teal References to Algorand SDK or Beaker framework Tool Support Tealer: Trail of Bits static analyzer for Algorand Installation: pip3 install tealer Usage: tealer contract.teal --detect all 4. How This Skill Works

When invoked, I will:

Search your codebase for TEAL/PyTeal files Analyze each file for the 11 vulnerability patterns Report findings with file references and severity Provide fixes for each identified issue Run Tealer (if installed) for automated detection 5. Example Output

When vulnerabilities are found, you'll get a report like this:

=== ALGORAND VULNERABILITY SCAN RESULTS ===

Project: my-algorand-dapp Files Scanned: 3 (.teal, .py) Vulnerabilities Found: 2

[CRITICAL] Rekeying Attack File: contracts/approval.py:45 Pattern: Missing RekeyTo validation

Code: If(Txn.type_enum() == TxnType.Payment, Seq([ # Missing: Assert(Txn.rekey_to() == Global.zero_address()) App.globalPut(Bytes("balance"), balance + Txn.amount()), Approve() ]) )

Issue: The contract doesn't validate the RekeyTo field, allowing attackers to change account authorization and bypass restrictions.

5. Vulnerability Patterns (11 Patterns)

I check for 11 critical vulnerability patterns unique to Algorand. For detailed detection patterns, code examples, mitigations, and testing strategies, see VULNERABILITY_PATTERNS.md.

Pattern Summary:

1. Rekeying Vulnerability ⚠️ CRITICAL - Unchecked RekeyTo field
2. Missing Transaction Verification ⚠️ CRITICAL - No GroupSize/GroupIndex checks
3. Group Transaction Manipulation ⚠️ HIGH - Unsafe group transaction handling
4. Asset Clawback Risk ⚠️ HIGH - Missing clawback address checks
5. Application State Manipulation ⚠️ MEDIUM - Unsafe global/local state updates
6. Asset Opt-In Missing ⚠️ HIGH - No asset opt-in validation
7. Minimum Balance Violation ⚠️ MEDIUM - Account below minimum balance
8. Close Remainder To Check ⚠️ HIGH - Unchecked CloseRemainderTo field
9. Application Clear State ⚠️ MEDIUM - Unsafe clear state program
10. Atomic Transaction Ordering ⚠️ HIGH - Assuming transaction order
11. Logic Signature Reuse ⚠️ HIGH - Logic sigs without uniqueness constraints

For complete vulnerability patterns with code examples, see VULNERABILITY_PATTERNS.md.

5. Scanning Workflow

Step 1: Platform Identification

1. Confirm file extensions (.teal, .py)
2. Identify framework (PyTeal, Beaker, pure TEAL)
3. Determine contract type (stateful application vs smart signature)
4. Locate approval and clear state programs

Step 2: Static Analysis with Tealer

```bash

Run Tealer on contract

tealer contract.teal --detect all

Or specific detectors

tealer contract.teal --detect unprotected-rekey,group-size-check,update-application-check

Step 3: Manual Vulnerability Sweep

For each of the 11 vulnerabilities above:

Search for relevant transaction field usage Verify validation logic exists Check for bypass conditions Validate inner transaction handling Step 4: Transaction Field Validation Matrix

Create checklist for all transaction types used:

Payment Transactions:

RekeyTo validated CloseRemainderTo validated Fee validated (if smart signature)

Asset Transfers:

Asset ID validated AssetCloseTo validated RekeyTo validated

Application Calls:

OnComplete validated Access controls enforced Group size validated

Inner Transactions:

Fee explicitly set to 0 RekeyTo not user-controlled (Teal v6+) All fields validated Step 5: Group Transaction Analysis

For atomic transaction groups:

Validate Global.group_size() checks Review absolute vs relative indexing Check for replay protection (Lease field) Verify OnComplete fields for ApplicationCalls in group Step 6: Access Control Review Creator/admin privileges properly enforced Update/delete operations protected Sensitive functions have authorization checks 6. Reporting Format Finding Template

[SEVERITY] Vulnerability Name (e.g., Missing RekeyTo Validation)

Location: contract.teal:45-50 or approval_program.py:withdraw()

Description: The contract approves payment transactions without validating the RekeyTo field, allowing an attacker to rekey the account and bypass future authorization checks.

Vulnerable Code: ```python

approval_program.py, line 45

If(Txn.type_enum() == TxnType.Payment, Approve() # Missing RekeyTo check )

Attack Scenario:

Attacker submits payment transaction with RekeyTo set to attacker's address Contract approves transaction without checking RekeyTo Account authorization is rekeyed to attacker Attacker gains full control of account

Recommendation: Add explicit validation of the RekeyTo field:

If(And( Txn.type_enum() == TxnType.Payment, Txn.rekey_to() == Global.zero_address() ), Approve(), Reject())

References:

building-secure-contracts/not-so-smart-contracts/algorand/rekeying Tealer detector: unprotected-rekey

7. Priority Guidelines

Critical (Immediate Fix Required)

• Rekeying attacks
• CloseRemainderTo / AssetCloseTo issues
• Access control bypasses

High (Fix Before Deployment)

• Unchecked transaction fees
• Asset ID validation issues
• Group size validation
• Clear state transaction checks

Medium (Address in Audit)

• Inner transaction fee issues
• Time-based replay attacks
• DoS via asset opt-in

8. Testing Recommendations

Unit Tests Required

• Test each vulnerability scenario with PoC exploit
• Verify fixes prevent exploitation
• Test edge cases (group size = 0, empty addresses, etc.)

Tealer Integration

```bash

Add to CI/CD pipeline

tealer approval.teal --detect all --json > tealer-report.json

Fail build on critical findings

tealer approval.teal --detect all --fail-on critical,high

Scenario Testing Submit transactions with all critical fields manipulated Test atomic groups with unexpected sizes Attempt access control bypasses Verify inner transaction fee handling 9. Additional Resources Building Secure Contracts: building-secure-contracts/not-so-smart-contracts/algorand/ Tealer Documentation: https://github.com/crytic/tealer Algorand Developer Docs: https://developer.algorand.org/docs/ PyTeal Documentation: https://pyteal.readthedocs.io/ 10. Quick Reference Checklist

Before completing Algorand audit, verify ALL items checked:

RekeyTo validated in all transaction types CloseRemainderTo validated in payment transactions AssetCloseTo validated in asset transfers Transaction fees validated (smart signatures) Group size validated for atomic transactions Lease field used for replay protection (where applicable) Access controls on Update/Delete operations Asset ID validated in all asset operations Asset transfers use pull pattern to avoid DoS Inner transaction fees explicitly set to 0 OnComplete field validated for ApplicationCall transactions Tealer scan completed with no critical/high findings Unit tests cover all vulnerability scenarios