CrossGuard - open-source static analyzer for Starknet bridge contracts

📜 Development Proposals
1

Hi,

I built CrossGuard - a static security analyzer for Starknet bridge contracts.
It analyzes both sides of a bridge at once: L1 Solidity and L2 Cairo.

The problem it solves: tools like Slither don’t understand Starknet messaging
semantics. No existing tool links sendMessageToL2 with its corresponding
#[l1_handler] and checks both sides together.

What it detects:

  • D1 CRITICAL — #[l1_handler] missing from_address validation (any address can call your handler)
  • D2 CRITICAL — uint256/u256 encoding mismatch between L1 and L2 (silent data corruption)
  • D3 HIGH — sendMessageToL2 without msg.value (messages silently dropped by sequencer)
  • D4 HIGH — startL1ToL2MessageCancellation without access control
  • D5 MEDIUM — L2->L1 message without nonce tracking (replay risk)
  • D6 MEDIUM — #[l1_handler] decodes payload without asserting length

Try it in 60 seconds:

git clone https://github.com/drozdisme/crossguard
cd crossguard && mkdir build && cd build && cmake .. && make
./crossguard-cli demo

Outputs terminal, JSON, SARIF (GitHub Code Scanning), and HTML.

I ran it on StarkGate Token Bridge:

Found 0 vulnerabilities. Two false positives documented — both reveal
concrete improvements for v0.2.0 (call-graph analysis for D1, protocol-level
cancellation semantics for D4).

GitHub: GitHub - drozdisme/crossguard: A multi-language semantic analysis platform for unified security reasoning, graph analysis, and extensible formal verification. · GitHub
License: MIT

Looking for feedback - especially from teams building bridges on Starknet.
What vulnerability patterns am I missing?