Skip to content

Releases: brennocm/blindsight

Release list

0.1.0 - 2026-10-22

0.1.0 - 2026-10-22 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 21:43
v0.1.0
f86a5c4

Release Notes

Added

  • Crate scaffold, lint policy and dependency policy (no network or async
    crates, enforced by cargo deny).
  • Safe EIP-712 hashing (domain hash, message hash, safeTxHash) for Safe
    1.0.0, 1.1.1, 1.2.0, 1.3.0, 1.4.1 and 1.5.0, computed by two independent
    implementations that must agree.
  • Input from flags, Safe Transaction Service JSON or raw execTransaction
    calldata, with strict validation, conflict detection between sources and
    size limits.
  • Sanitisation of every input-derived string before printing.
  • Embedded registry: official Safe contracts per chain, a token list
    confirmed on chain, chain names and Permit2.
  • Decoding into a call tree (MultiSend batches, nested Safe transactions,
    user ABIs bound to an address), with each function name labelled as
    verified or inferred from the selector.
  • Address book with look-alike (address poisoning) detection.
  • 20 detectors with stable IDs and severities, documented in
    docs/detectors/.
  • Commands verify, hash, decode, detectors list|explain and
    version; text and JSON output (schema_version 1); expected-hash checks
    with --expect-*; exit codes 0/1/2/3 (docs/OUTPUT.md).
  • Release configuration: archives for Linux, macOS and Windows (x86_64 and
    aarch64) with checksums, a CycloneDX SBOM, cargo-auditable metadata and
    build-provenance attestations.

Security

Fixed during the final security review, before any release:

  • Argument-parser errors could pass a right-to-left override or a carriage
    return from a command-line argument to the terminal; they are now
    sanitised.
  • A user ABI bound to a MultiSend address could turn the batch into an
    opaque call hidden from the detectors; built-in decoding now always takes
    precedence (ADR 0008).
  • A payload nested beyond the analysis depth was reported high; it is now
    critical.
  • signMessage through SignMessageLib and value sent through CreateCall
    now produce findings.
  • Addresses imitating the Safe itself are flagged even without an address
    book; address-book names that differ only by case or spaces are rejected.
  • Characters that render as blank space (Hangul fillers, variation
    selectors, braille blank) are escaped in all output.
  • Token amounts are no longer formatted with token decimals when the token
    function is delegatecalled.
  • Only one input may be read from standard input.

Download blindsight 0.1.0

File Platform Checksum
blindsight-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
blindsight-x86_64-apple-darwin.tar.xz Intel macOS checksum
blindsight-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
blindsight-x86_64-pc-windows-msvc.zip x64 Windows checksum
blindsight-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
blindsight-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo brennocm/blindsight

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
Assets 19