Differential Review
This skill helps you analyze the difference between two versions of a codebase, focusing on security implications of changes.
1. Upgradeability Checks (MultiversX)
When reviewing a diff between v1 and v2 of a Smart Contract:
- Storage Layout:
- Critical: Did the order of fields in a
structstored in aVecMapperorSingleValueMapperchange? - Result: Usage of existing data will interpret bytes incorrectly (Memory Corruption).
- Fix: Append new fields to the end of structs, never reorder.
- Critical: Did the order of fields in a
- Initialization:
- Critical: Does
v2introduce new Storage Mappers? - Check: Are they initialized in
#[upgrade]? (Remember#[init]is NOT called on upgrade).
- Critical: Does
2. Regression Testing
- New Features: Do they break old invariants?
- Deleted Code: Was a check removed? Why?
3. Workflow
- Generate Diff:
git diff v1..v2. - Filter Noise: Ignore formatting/style changes.
- Trace Data: Follow the flow of changed data structures.