Skip to content

.false-positives.md

Latest commit

 

History

History
118 lines (83 loc) · 2.97 KB

.false-positives.md

File metadata and controls

118 lines (83 loc) · 2.97 KB
Raw

Known False Positives & Accepted Risks

This file maintains an audit trail of all security findings that have been reviewed and determined to be false positives or acceptable risks.

Maintainers: @security-team Last Updated: [DATE] Review Frequency: Quarterly

False Positive Template

When adding a new entry, use this structure:

## [FP-XXX] Brief Title of Finding

### Detection Details
- **Tool**: (Slither / Cargo Audit / Clippy)
- **Rule**: (specific detector/rule name)
- **Severity**: (Critical / High / Medium / Low)
- **Location**: (file path and line numbers)
- **Date Detected**: (YYYY-MM-DD)
- **Detection ID**: (unique reference if available)

### Code Pattern

[code snippet that triggered the finding]


### Root Cause Analysis
[Explanation of why the tool flagged this code]

**However**, this is a **false positive** because:
1. [First reason why it's safe]
2. [Second reason]
3. [Third reason if applicable]

### Mitigation Evidence
- **Test Case**: [link to test file]
- **Reference Implementation**: [link to safe pattern]
- **Additional Context**: [any supporting documentation]

### Decision
✅ **Status**: ACCEPTED (False Positive) | EXCLUDED (Style Issue) | FLAGGED (Real Issue)

**Reasoning**: [Brief explanation of decision]

**Approved By**: @github-handle (YYYY-MM-DD)
**Approval Link**: [Link to PR discussion or issue]

### Follow-up Actions
- [ ] Add inline code comment with suppression
- [ ] Reference this FP document in code
- [ ] Update slither.config.json if needed
- [ ] Add test coverage (if applicable)

---

Active False Positives

[FP-001] Example: Reentrancy Pattern

Detection Details

  • Tool: Slither
  • Rule: reentrancy-eth
  • Severity: High
  • Location: contracts/vault/src/lib.rs (lines 145-156)
  • Date Detected: 2024-01-10
  • Status: TEMPLATE - Please replace with actual entries

Decision

🔄 Status: PENDING REVIEW (This is a template entry)

[Your team should populate this with actual findings]

Revoked / Updated Entries

Use this section if a previous false positive becomes a real issue:

[FP-001-REVOKED] Previous Pattern Now Active

Status: ⚠️ REVOKED (Updated: 2024-02-01) Reason: Code refactoring in PR #567 removed the protective guard. This is now a real vulnerability. Action Taken: Reopened as GitHub Issue #890 Assigned To: @security-team

Statistics

Category Count
Active False Positives 0
Excluded (Style/Info) 0
Revoked (Now Active Issues) 0
Total Reviewed 0

Next Steps

  1. Add your first false positive entry using the template above
  2. Link test coverage in "Mitigation Evidence"
  3. Tag security team for approval
  4. Update slither.config.json with exclusions
  5. Update statistics in the table above

Document Version: 1.0 Created: 2024-01-15 For process details, see: docs/FALSE_POSITIVE_HANDLING.md