Skip to content
Open-Source Registry

cargo / eth-signature-verifier / 0.2.0

eth-signature-verifier 0.2.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
389
operations
87K
packages
448
compiler runs
234
connections
5
build time
1m 29s
job time
1m 29s
capture
1.1 MB
records
156K
bytes / record
6.9
run 88941417-730f-4faa-bec3-d826070ce79c · built 2026-11-03 · complete View on crates.io
Reviewed by Bitbison: unverified-downloadThe build script installs Foundry with a pinned 2024 foundryup that pulls the nightly release and checks no hash or attestation, then compiles the crate's contracts with it and embeds the bytecode.

Graph

secret-exfil · critical · in libeth_signature_verifier.rlib
3

Checks

11 of 16 clear Network activity Sensitive data access and transfer +3 more
Build behavior▲▲✓✓✓▲✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

7
  • Credential store contents reached a network peer
    binaries.soliditylang.org:443 › binaries.soliditylang.org:443
    critical
  • Build script ran code it downloaded
    eth-signature-verifier 0.2.0 › release-assets.githubusercontent.com:443
    high
  • Build script fetched what the build compiled, linked or ran
    eth-signature-verifier 0.2.0 › release-assets.githubusercontent.com:443, github.com:443, binaries.soliditylang.org:443
    high
  • Build script placed a program among the build's outputs
    anvil
    high
  • Build script placed a program among the build's outputs
    cast
    high
  • Build script placed a program among the build's outputs
    chisel
    high
  • Build script placed a program among the build's outputs
    forge
    high

Detection

criticalwitnessed

Credential store contents reached a network peer

Possible credential exposure

Subject
binaries.soliditylang.org:443
Destination
binaries.soliditylang.org:443
Jobs
build-test
Rule
secret-exfil · eth-signature-verifier

Witness chain

  1. /home/runner/work/eth-signature-verifier/eth-signature-verifier/.env
    source
  2. binaries.soliditylang.org:443via /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry/bin/forge
    • Sensitive-file read linked to a network connectionfrom /home/runner/work/eth-signature-verifier/eth-signature-verifier/.env

      Credential store contents linked to this connection through build-time code: /home/runner/work/eth-signature-verifier/eth-signature-verifier/.env

    sink
  3. build
    artifact

Evidence

  • Credential store contents linked to this connection through build-time code: /home/runner/work/eth-signature-verifier/eth-signature-verifier/.env

In libeth_signature_verifier.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›forge

Ran
/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry/bin/forge …
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. forge/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry/bin/forge …6677

Remediation

Treat the credential as exposed: revoke or rotate it, then remove the build-time code that sent it. The witness chain names the file, the processes that carried its bytes and the destination.

Detection

highwitnessed

Build script ran code it downloaded

Unexpected build script activity

Subject
eth-signature-verifier 0.2.0
Destination
release-assets.githubusercontent.com:443
Jobs
build-test, build-test
Rule
buildscript · eth-signature-verifier

Witness chain

  1. release-assets.githubusercontent.com:443
    source
  2. pipevia curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup
    • Build-time code ran a program downloaded during the buildfrom release-assets.githubusercontent.com:443by bash

      ran a script on its standard input, downloaded during the build by curl from release-assets.githubusercontent.com:443

    subject
  3. build
    artifact
  4. libeth_signature_verifier.rlibmember
    artifact

Evidence

  • ran a script on its standard input, downloaded during the build by curl from release-assets.githubusercontent.com:443

Processes

build-test

cargo›cargo›build-script-build›bash›bash

Ran
bash
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 5 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. bashbash -c curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup | FOUNDRY_DIR=/home/runner/work/e…6547
  5. bashbash6549

build-test

cargo›cargo›build-script-build›forge›solc-0.8.34

Ran
/home/runner/.local/share/svm/0.8.34/solc-0.8.34 --allow-paths /home/runner/work/eth-signature-verifier/eth-signature-verifier,/home/runner/work/eth-signature-v…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 5 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. forge/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry/bin/forge …6677
  5. solc-0.8.34/home/runner/.local/share/svm/0.8.34/solc-0.8.34 --allow-paths /home/runner/work/eth-signature-verifier/eth-signature-verifier,/home/runner/work/eth-signature-v…6720

Remediation

A dependency's build downloaded a program and ran it, outside anything the registry checksums. Review what the program did, rotate any credential the build could read, and pin or replace the dependency.

Detection

highwitnessed

Build script fetched what the build compiled, linked or ran

Unexpected network connection

Subject
eth-signature-verifier 0.2.0
Destination
release-assets.githubusercontent.com:443, github.com:443, binaries.soliditylang.org:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup

  2. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -#L https://github.com/foundry-rs/foundry/releases/download/nightly/foundry_nightly_linux_amd64.tar.gz

  3. Connection outside the process’s allowed destinationscause

    connection to binaries.soliditylang.org:443, opened by forge

    subject binaries.soliditylang.org:443

    by /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry/bin/forge …

  4. What a build script's fetch becamesupport

    12 files came down, reaching 274 more; the build compiled or linked ValidateSigOffchain.bytecode, Erc1271Mock.bytecode and ran solc-0.8.34

  5. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build

  6. Tool commandsupport

    Command: curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup

    by curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup

  7. Tool commandsupport

    Command: curl -#L https://github.com/foundry-rs/foundry/releases/download/nightly/foundry_nightly_linux_amd64.tar.gz

    by curl -#L https://github.com/foundry-rs/foundry/releases/download/nightly/foundry_nightly_linux_amd64.tar.gz

  8. Tool commandsupport

    Command: /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry/bin/forge …

    by /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry/bin/forge …

In libeth_signature_verifier.rlib

Loading the graph

Processes

build-test

cargo›cargo›build-script-build›bash›curl

Ran
curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 5 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. bashbash -c curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup | FOUNDRY_DIR=/home/runner/work/e…6547
  5. curlcurl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup6548

Remediation

A dependency's build downloaded files the build then compiled, linked or ran, outside anything the registry checksums. Review what came down, pin or replace the dependency, or record the download as accepted once it is reviewed.

Detection

highwitnessed

Build script placed a program among the build's outputs

Program placed among the build's outputs

Subject
/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/anvilwritten by tar
Jobs
build-test
Rule
program-planted

Evidence

  1. Program placed among the outputs by no linkcause

    written by tar under the build script at /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build, which no link made here

    subject /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/anvil

    by tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…

  2. Where the planted program's bytes came fromsupport

    its bytes came from /uds/31d8cd6f0

    source pipe

Processes

build-test

cargo›cargo›build-script-build›bash›bash›tar

Ran
tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 6 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. bashbash -c curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup | FOUNDRY_DIR=/home/runner/work/e…6547
  5. bashbash6549
  6. tartar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…6583

Remediation

Only the toolchain and the build tool write programs into the output tree. Review what placed this one and whether anything ships it.

Detection

highwitnessed

Build script placed a program among the build's outputs

Program placed among the build's outputs

Subject
/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/castwritten by tar
Jobs
build-test
Rule
program-planted

Evidence

  1. Program placed among the outputs by no linkcause

    written by tar under the build script at /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build, which no link made here

    subject /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/cast

    by tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…

  2. Where the planted program's bytes came fromsupport

    its bytes came from /uds/31d8cd6f0

    source pipe

Processes

build-test

cargo›cargo›build-script-build›bash›bash›tar

Ran
tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 6 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. bashbash -c curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup | FOUNDRY_DIR=/home/runner/work/e…6547
  5. bashbash6549
  6. tartar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…6583

Remediation

Only the toolchain and the build tool write programs into the output tree. Review what placed this one and whether anything ships it.

Detection

highwitnessed

Build script placed a program among the build's outputs

Program placed among the build's outputs

Subject
/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/chiselwritten by tar
Jobs
build-test
Rule
program-planted

Evidence

  1. Program placed among the outputs by no linkcause

    written by tar under the build script at /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build, which no link made here

    subject /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/chisel

    by tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…

  2. Where the planted program's bytes came fromsupport

    its bytes came from /uds/31d8cd6f0

    source pipe

Processes

build-test

cargo›cargo›build-script-build›bash›bash›tar

Ran
tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 6 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. bashbash -c curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup | FOUNDRY_DIR=/home/runner/work/e…6547
  5. bashbash6549
  6. tartar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…6583

Remediation

Only the toolchain and the build tool write programs into the output tree. Review what placed this one and whether anything ships it.

Detection

highwitnessed

Build script placed a program among the build's outputs

Program placed among the build's outputs

Subject
/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/forgewritten by tar
Jobs
build-test
Rule
program-planted

Evidence

  1. Program placed among the outputs by no linkcause

    written by tar under the build script at /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build, which no link made here

    subject /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/.foundry/bin/forge

    by tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…

  2. Where the planted program's bytes came fromsupport

    its bytes came from /uds/31d8cd6f0

    source pipe

Processes

build-test

cargo›cargo›build-script-build›bash›bash›tar

Ran
tar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 6 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2552
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2552
  3. build-script-build/home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-3228f4413009097d/build-script-build6546
  4. bashbash -c curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup | FOUNDRY_DIR=/home/runner/work/e…6547
  5. bashbash6549
  6. tartar -xzC /home/runner/work/eth-signature-verifier/eth-signature-verifier/target/release/build/eth-signature-verifier-dc01af1281c97c82/out/../../../../.foundry//…6583

Remediation

Only the toolchain and the build tool write programs into the output tree. Review what placed this one and whether anything ships it.

Network

5 peers
  • binaries.soliditylang.org:443 eth-signature-verifier's own build code · forge (eth-signature-verifier) · Cloudflare, Inc. · 11 files · went into an output undeclared
  • github.com:443 eth-signature-verifier's own build code · curl · Microsoft Corporation · 3 files · went into an output undeclared
  • release-assets.githubusercontent.com:443 eth-signature-verifier's own build code · curl · Fastly, Inc. · 3 files · went into an output undeclared
  • sepolia.base.org:443 eth-signature-verifier's own build code · anvil (eth-signature-verifier) · Cloudflare, Inc. unjudged
  • static.crates.io:8080 the package manager · cargo (eth-signature-verifier) via crates.io · 28,227 files · went into an output ecosystem
Vulnerabilities19FixSeverity
Dependencies
alloy-dyn-abi 0.7.7>=0.8.26
CVE-2025-62370alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashinghigh
crypto-bigint 0.5.5>=0.7.6
RUSTSEC-2026-0387Multiple timing variability issues in operations intended to be constant-timehigh
h2 0.3.27>=0.4.16
RUSTSEC-2026-0258h2 unbounded empty DATA frameshigh
rustls-webpki 0.101.7, 0.102.8>=0.103.16
CVE-2026-111943Important: ignition security updatehigh
CVE-2026-93599rustls-webpki: Denial of service via panic on malformed CRL BIT STRINGhigh
CVE-2026-93602webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicmedium
CVE-2026-93600webpki: Name constraints for URI names were incorrectly acceptedlow
CVE-2026-93601webpki: Name constraints were accepted for certificates asserting a wildcard namelow
alloy-json-abi 0.7.7none published
GHSA-8327-84cj-8xjmStack overflow when parsing specially crafted JSON ABI stringsmedium
jsonwebtoken 9.3.1>=10.3.0
CVE-2026-25537jsonwebtoken has Type Confusion that leads to potential authorization bypassmedium
rustls 0.21.12, 0.22.4>=0.23.46
GHSA-c8m5-c952-6cm4Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKsmedium
GHSA-h2v8-394m-p7vvRustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.low
GHSA-w44r-93j7-qv28rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 sharelow
lru 0.12.5>=0.18.2
GHSA-rhfx-m35p-ff5j`IterMut` violates Stacked Borrows by invalidating internal pointerlow
RUSTSEC-2026-0253Potential use-after-free due to lack of panic safety in `LruCache::pop()`info
derivative 2.2.0none published
RUSTSEC-2024-0388`derivative` is unmaintained; consider using an alternativeinfo
paste 1.0.15none published
RUSTSEC-2024-0436paste - no longer maintainedinfo
proc-macro-error 1.0.4none published
RUSTSEC-2024-0370proc-macro-error is unmaintainedinfo
rustls-pemfile 1.0.4, 2.2.0none published
RUSTSEC-2025-0134rustls-pemfile is unmaintainedinfo

Dependencies

531
Dependencies531Build behaviour
adler22.0.1
aho-corasick1.1.5
allocator-api20.2.21
alloy0.2.1
alloy-chains0.1.69
alloy-consensus0.2.1
alloy-contract0.2.1
alloy-core0.7.7
alloy-dyn-abi0.7.7
alloy-eips0.2.1
alloy-genesis0.2.1
alloy-json-abi0.7.7
alloy-json-rpc0.2.1
alloy-network0.2.1
alloy-network-primitives0.2.1
alloy-node-bindings0.2.1
alloy-primitives0.7.7
alloy-primitives0.8.26
alloy-provider0.2.1
alloy-rlp0.3.17
alloy-rlp-derive0.3.17proc macro
alloy-rpc-client0.2.1
alloy-rpc-types0.2.1
alloy-rpc-types-eth0.2.1
alloy-serde0.2.1
alloy-signer0.2.1
alloy-signer-aws0.2.1
alloy-signer-gcp0.2.1
alloy-signer-ledger0.2.1
alloy-signer-local0.2.1
alloy-sol-macro0.7.7proc macro
alloy-sol-macro-expander0.7.7
alloy-sol-macro-input0.7.7
alloy-sol-type-parser0.7.7
alloy-sol-types0.7.7
alloy-transport0.2.1
alloy-transport-http0.2.1
android_system_properties0.1.6
anyhow1.0.104build script, not run
arc-swap1.9.3
ark-ff0.3.0build script, not run
ark-ff0.4.2
ark-ff0.5.0
ark-ff0.6.0
ark-ff-asm0.3.0proc macro
ark-ff-asm0.4.2proc macro
ark-ff-asm0.5.0proc macro
ark-ff-asm0.6.0proc macro
ark-ff-macros0.3.0proc macro
ark-ff-macros0.4.2proc macro
ark-ff-macros0.5.0proc macro
ark-ff-macros0.6.0proc macro
ark-serialize0.3.0
ark-serialize0.4.2
ark-serialize0.5.0
ark-serialize0.6.0
ark-serialize-derive0.6.0proc macro
ark-std0.3.0
ark-std0.4.0
ark-std0.5.0
ark-std0.6.0
arrayvec0.7.8
async-compression0.4.52
async-stream0.3.6
async-stream-impl0.3.6proc macro
async-trait0.1.92proc macro
atomic-waker1.1.2
auto_impl1.4.0proc macro
autocfg1.5.1
aws-credential-types1.3.1
aws-runtime1.10.2
aws-sdk-kms1.129.0
aws-sigv41.6.4
aws-smithy-async1.3.1
aws-smithy-http0.64.3
aws-smithy-json0.65.1
aws-smithy-observability0.3.0
aws-smithy-runtime1.16.2
aws-smithy-runtime-api1.19.2
aws-smithy-runtime-api-macros1.2.0proc macro
aws-smithy-schema1.1.2
aws-smithy-types1.9.1
aws-types1.7.0build script, not run
axum0.6.20build script, not run
axum-core0.3.4build script, not run
base16ct0.2.0
base640.21.7
base640.22.1
base640.23.1
base64-simd0.8.0
base64ct1.8.3
bit-set0.11.1
bit-vec0.10.1
bitflags1.3.2
bitflags2.13.2
bitvec1.1.1
block-buffer0.10.4
block-buffer0.12.1
blst0.3.17build script, not run
borsh1.8.1build script, not run
borsh-derive1.8.1proc macro
bs580.5.1
bumpalo3.20.3
byte-slice-cast1.2.3
byteorder1.5.0
bytes1.12.1
bytes-utils0.1.4
c-kzg1.0.3build script, not run
cc1.11.0
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
chrono0.4.45
cmov0.5.4
coins-ledger0.11.1
compression-codecs0.4.47
compression-core0.4.34
const-hex1.19.3
const-oid0.10.2
const-oid0.9.6
const_format0.2.37
const_format_proc_macros0.2.37proc macro
convert_case0.10.0
convert_case0.4.0
core-foundation0.10.1
core-foundation0.9.4
core-foundation-sys0.8.7
core_detect1.0.0
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.4build script, not run
crunchy0.2.4build script
crypto-bigint0.5.5
crypto-common0.1.6
crypto-common0.2.2
ctutils0.4.8
dashmap5.5.3
defmt1.2.0build script, not run
defmt-macros1.2.0build script, not runproc macro
defmt-parser1.1.0
der0.7.10
deranged0.5.9
derivative2.2.0proc macro
derive_more0.99.20proc macro
derive_more2.1.1
derive_more-impl2.1.1proc macro
digest0.10.7
digest0.11.3
digest0.9.0
displaydoc0.2.7proc macro
dunce1.0.5
dyn-clone1.0.20
ecdsa0.16.9
educe0.6.0proc macro
either1.19.0
elliptic-curve0.13.8
encoding_rs0.8.44build script, not run
enum-ordinalize4.4.2
enum-ordinalize-derive4.4.2proc macro
env_logger0.10.2
equivalent1.0.3
errno0.3.14
fastrand2.5.0
fastrlp0.3.1
fastrlp0.4.0
ff0.13.1
find-msvc-tools0.1.15
fixed-hash0.8.0
flate21.1.10
fnv1.0.7
foldhash0.1.5
foreign-types0.3.2
foreign-types-shared0.1.1
form_urlencoded1.2.2
funty2.0.0
futures0.3.34
futures-channel0.3.34
futures-core0.3.34
futures-executor0.3.34
futures-io0.3.34
futures-macro0.3.34proc macro
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
futures-utils-wasm0.1.0
gcemeta0.2.3
gcloud-sdk0.24.8
generic-array0.14.9build script
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
glob0.3.4
group0.13.0
h20.3.27
hashbrown0.12.3
hashbrown0.14.5
hashbrown0.15.5
hashbrown0.17.1
heck0.5.0
hermit-abi0.5.3
hex0.4.3
hex-literal0.4.1
hidapi-rusb1.3.3build script, not run
hmac0.12.1
hmac0.13.0
http0.2.12
http1.5.0
http-body0.4.6
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
httpdate1.0.3
humantime2.4.0
hybrid-array0.4.15
hyper0.14.32
hyper1.12.0
hyper-rustls0.24.2
hyper-timeout0.4.1
hyper-tls0.6.0
hyper-util0.1.21
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.4.0
icu_locale_core2.4.0
icu_normalizer2.4.0
icu_normalizer_data2.4.0build script
icu_properties2.4.0
icu_properties_data2.4.0build script
icu_provider2.4.0
idna1.1.0
idna_adapter1.2.2
impl-codec0.6.0
impl-trait-for-tuples0.2.3proc macro
indexmap1.9.3build script, not run
indexmap2.14.2
ipnet2.12.2
is-terminal0.4.17
itertools0.10.5
itertools0.12.1
itertools0.13.0
itertools0.14.0
itoa1.0.18
jiff0.2.39
jiff-core0.1.2
jiff-static0.2.39proc macro
jiff-tzdb0.1.9
jiff-tzdb-platform0.1.3
js-sys0.3.107
jsonwebtoken9.3.1
k2560.13.4
keccak-asm0.1.9
konst0.2.20
konst_macro_rules0.2.19
ld-linux-x86-64.so.2system library
libc0.2.191build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm0.2.16build script, not run
libm.so.6system library
libmvec.so.1system library
libssl.so.3system library
libusb1-sys0.7.0build script, not run
linux-raw-sys0.12.1
litemap0.8.3
lock_api0.4.14
log0.4.35
lru0.12.5
matchit0.7.3
memchr2.8.3
memoffset0.7.1build script, not run
mime0.3.17
mime_guess2.0.5build script, not run
miniz_oxide0.9.1
mio1.2.4
multiversion_no_op1.0.0proc macro
native-tls0.2.18build script
nix0.26.4
num-bigint0.4.8
num-conv0.2.2
num-integer0.1.47
num-traits0.2.19build script, not run
num_cpus1.17.0
num_enum0.7.6
num_enum_derive0.7.6proc macro
once_cell1.21.4
openssl0.10.82build script
openssl-macros0.1.1proc macro
openssl-probe0.1.6
openssl-probe0.2.2
openssl-sys0.9.118build script
outref0.5.2
parity-scale-codec3.7.5build script, not run
parity-scale-codec-derive3.7.5proc macro
parking_lot0.12.5
parking_lot_core0.9.12build script
paste1.0.15build scriptproc macro
pem3.0.6
pem-rfc74680.7.0
percent-encoding2.3.2
pest2.9.5
pest_stack_guard1.0.0build script, not run
pin-project0.4.30
pin-project1.1.13
pin-project-internal0.4.30build script, not runproc macro
pin-project-internal1.1.13proc macro
pin-project-lite0.2.17
pin-utils0.1.1
pkcs80.10.2
pkg-config0.3.34
portable-atomic1.15.0build script, not run
portable-atomic-util0.2.8build script, not run
potential_utf0.1.6
powerfmt0.2.1
ppv-lite860.2.21
primitive-types0.12.2
proc-macro-crate3.5.0
proc-macro-error1.0.4build script
proc-macro-error-attr1.0.4build scriptproc macro
proc-macro21.0.107build script
proptest1.12.0
prost0.12.6
prost0.14.4
prost-derive0.12.6proc macro
prost-derive0.14.4proc macro
prost-types0.12.6
prost-types0.14.4
psm0.1.24build script, not runprebuilt objects
quick-error1.2.3
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
radium0.7.0build script, not run
rand0.10.3
rand0.8.8
rand0.9.5
rand_chacha0.3.1
rand_chacha0.9.0
rand_core0.10.1
rand_core0.6.4
rand_core0.9.5
rand_xorshift0.5.0
redox_syscall0.5.18
ref-cast1.0.27build script, not run
ref-cast-impl1.0.27proc macro
regex1.13.1
regex-automata0.4.18
regex-lite0.1.9
regex-syntax0.8.11
reqwest0.11.27
reqwest0.12.28
rfc69790.4.0
ring0.17.14build script, not runprebuilt objects
rlp0.5.2
ruint1.21.1build script
ruint-macro1.2.1proc macro
rusb0.9.4build script, not run
rustc-hex2.1.0
rustc_version0.3.3
rustc_version0.4.1
rustix1.1.6build script
rustls0.21.12build script, not run
rustls0.22.4build script, not run
rustls-native-certs0.6.3
rustls-native-certs0.7.3
rustls-pemfile1.0.4
rustls-pemfile2.2.0
rustls-pki-types1.15.1
rustls-webpki0.101.7
rustls-webpki0.102.8
rustversion1.0.23build scriptproc macro
rusty-fork0.3.1
ryu1.0.23
schannel0.1.30
schemars0.9.0
schemars1.2.3
scopeguard1.2.0
sct0.7.1
sec10.7.3
secret-vault-value0.3.10
security-framework2.11.1
security-framework3.7.0
security-framework-sys2.17.0
semver0.11.0
semver1.0.28
semver-parser0.10.3
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_json1.0.154build script
serde_urlencoded0.7.1
serde_with3.24.0
sha20.10.9
sha20.11.1
sha3-asm0.1.9build script, not run
shlex2.0.1
signal-hook-registry1.4.8
signature2.2.0
simd-adler320.3.10
simdutf80.1.5
simple_asn10.6.4
slab0.4.12
smallvec1.16.4
socket20.5.10
socket20.6.5
spki0.7.3
stable_deref_trait1.2.1
stacker0.1.25build script, not run
static_assertions1.1.0
strum0.27.2
strum_macros0.27.2proc macro
subtle2.6.1
syn1.0.109build script
syn2.0.119
syn3.0.9
syn-solidity0.7.7
sync_wrapper0.1.2
sync_wrapper1.0.2
synstructure0.14.0
system-configuration0.5.1
system-configuration-sys0.5.0build script, not run
tap1.0.1
tempfile3.27.0
termcolor1.4.1
thiserror1.0.69build script
thiserror2.0.21build script
thiserror-impl1.0.69proc macro
thiserror-impl2.0.21proc macro
threadpool1.8.1
time0.3.55
time-core0.1.9
time-macros0.2.32proc macro
tiny-keccak2.0.2build script
tinystr0.8.5
tinyvec1.13.3
tokio1.54.1
tokio-io-timeout1.2.1
tokio-macros2.7.2proc macro
tokio-native-tls0.3.1
tokio-rustls0.24.1
tokio-rustls0.25.0
tokio-stream0.1.19
tokio-util0.7.20
toml_datetime1.1.2+spec-1.1.0
toml_edit0.25.17+spec-1.1.0
toml_parser1.1.5+spec-1.1.0
tonic0.11.0
tower0.4.13
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tower-util0.3.1
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
ucd-trie0.1.7
uint0.9.5
unarray0.1.4
unicase2.10.0
unicode-ident1.0.27
unicode-segmentation1.13.3
unicode-xid0.2.6
untrusted0.9.0
url2.5.8
utf8_iter1.1.0
utf_types1.0.0
uuid1.29.0
valuable0.1.1build script, not run
vcpkg0.2.15prebuilt objects
version_check0.9.5
vsimd0.8.0
wait-timeout0.2.1
want0.3.2
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.130build script, not run
wasm-bindgen-futures0.4.80
wasm-bindgen-macro0.2.130proc macro
wasm-bindgen-macro-support0.2.130
wasm-bindgen-shared0.2.130build script, not run
wasm-streams0.4.2
web-sys0.3.107
winapi-util0.1.11
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.48.0
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.48.5
windows-targets0.52.6
windows_aarch64_gnullvm0.48.5build script, not runprebuilt objects
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.48.5build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.48.5build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.48.5build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.48.5build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.48.5build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.48.5build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow0.6.26
winnow1.0.4
winreg0.50.0
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
wyz0.5.1
yoke0.8.4
yoke-derive0.8.4proc macro
zerocopy0.8.63build script
zerocopy-derive0.8.63proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zeroize_derive1.5.0proc macro
zerotrie0.2.5
zerovec0.11.9
zerovec-derive0.11.7proc macro
zlib-rs0.6.8
zmij1.0.23build script

Versions2

Raw data

capture
1.1 MB
records
156,142
bytes per record
6.9

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-11-03 · run 88941417-730f-4faa-bec3-d826070ce79c

analysis 0.1.0 · 2026-11-02 · 3bf4062 · graph v2

Every build runs Foundry's moving nightly release, installed without verification

unverified-downloadCovers 0.2.0Reviewed by BitbisonUpdated 2026-11-03

The build script installs Foundry with a pinned 2024 foundryup that pulls the nightly release and checks no hash or attestation, then compiles the crate's contracts with it and embeds the bytecode.

What the analysis saw

The registry's build of eth-signature-verifier@0.2.0 (build a49227ff-bb17-4178-b3f7-aa1c650b13f3) piped foundryup from raw.githubusercontent.com into bash. That script downloaded foundry_nightly_linux_amd64.tar.gz from the foundry-rs/foundry nightly release on GitHub and unpacked forge, cast, anvil and chisel into target/.foundry/bin. forge then fetched solc 0.8.34 from binaries.soliditylang.org, ran it on the crate's Solidity contracts, and the build script wrote the compiled bytecode into the crate's output. The crate's tests start anvil forking Base Sepolia (sepolia.base.org).

What the code does

build.rs, install_foundry: runs curl https://raw.githubusercontent.com/foundry-rs/foundry/e0ea59cae26d945445d9cf21fdf22f4a18ac5bb2/foundryup/foundryup | bash with FOUNDRY_DIR under target/, passing no version. That foundryup revision (2024-04-23) defaults to the nightly tag and installs the release tarball without checking a hash or the release's attestation. compile_contracts runs forge build on contracts/, and extract_bytecodes decodes the ValidateSigOffchain and Erc1271Mock bytecode into files the library includes. The behaviour matches the crate's purpose, ERC-6492 signature verification; nothing in it reads credentials or sends project data anywhere.

Foundry's current installer defaults to the stable release and checks each binary's sha256 against the release's attestation, but this crate pins the older script, so its builds get none of that.

Conclusion

unverified-download: every build installs Foundry's moving nightly through a foundryup revision that verifies nothing, and embeds the bytecode it compiles; a compromise of that release reaches every build of this crate.

Indicators

hosts
raw.githubusercontent.comgithub.comrelease-assets.githubusercontent.combinaries.soliditylang.org

Examined

0.2.0
sha256:5605a72885aa5271b133289a9470823a29678fe395b9591b80da609393b85e81

Links