aiken-smart-contract

This is readable Merkle-proof validator code with no apparent malware, exfiltration, or external indicators such as domains, URLs, IPs, file paths, or targeted credentials. The principal security concern is that a valid Claim authorizes spending the script input without constraining output destinations or preserving state, enabling eligible claimants to take its assets and allowing proof reuse if the state is recreated. UpdateRoot also does not constrain full address or value preservation. Overall severity is a contract-logic security warning; review and add intended payout, continuation, and claim-replay controls before deployment.

This is a readable Cardano Aiken inheritance validator, not code exhibiting malware: it has no network, filesystem, credential, or process behavior. Its main security risks are incomplete fund-distribution/state checks: a claim only enforces a minimum payment to one beneficiary and does not constrain the remainder or prevent reuse of beneficiary data in a continuation vault. Beneficiary shares are also not validated. Severity is a contract-logic risk requiring review before deployment; no suspicious domains, URLs, IPs, file paths, or credentials are present.

This code implements a time-based inheritance validator and contains no evident malware or obfuscation. Its main security concern is that CheckIn, Claim, and OwnerWithdraw do not constrain asset destinations or preserve the script's value, so authorized transactions can route funds elsewhere; CheckIn can also continue at a different address sharing the same payment credential. Severity is a contract-design security warning; no suspicious domains, URLs, IPs, filesystem paths, or targeted credentials are present.

No malware behavior, suspicious domains, credential access, or obfuscation is present. The code implements a marketplace spending validator, but its Buy branch checks only for a seller payment and does not enforce delivery of the listed NFT, so it has a significant marketplace security/correctness weakness (medium severity) if relied on as a complete purchase validator. The provided tests do not cover this gap.

This readable validator has no evident malware behavior, but its spend condition is an authorization flaw: burning any asset under any policy satisfies it, potentially allowing script outputs to be spent without burning the gift-card NFT. The mint checks are limited to the configured policy and token name, but do not correct this spend-path weakness. Severity is a security warning for deployments relying on burn-to-spend authentication; no suspicious domains, URLs, IPs, file paths, or credential targets are present.

This is readable escrow validation code, not evidence of malware. Its main security limitation is functional: successful completion only requires both signatures and does not enforce asset delivery or payment of the unused price field; seller cancellation also allows spending at any time, as documented. Severity is a contract-design risk if callers expect the validator itself to guarantee an exchange; no suspicious domains, URLs, IPs, file paths, environment variables, or credential targets are present.