rules:
  # =============================================================================
  # SOLIDITY POST-QUANTUM CRYPTOGRAPHIC VULNERABILITY RULES
  # =============================================================================
  # These rules detect cryptographic algorithms vulnerable to quantum attacks
  # using Shor's algorithm (asymmetric) or Grover's algorithm (symmetric/hash)
  # 
  # NOTE: Solidity relies heavily on blockchain cryptography (ECDSA signatures)
  # which is inherently vulnerable to quantum attacks. These rules focus on
  # explicit cryptographic operations in smart contracts.
  # =============================================================================

  # ---------------------------------------------------------------------------
  # HASH FUNCTION VULNERABILITIES (Grover's Algorithm)
  # ---------------------------------------------------------------------------

  - id: solidity-use-of-sha1-quantum
    patterns:
      - pattern-either:
          - pattern: sha1(...)
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [solidity]
    metadata:
      category: security
      technology:
        - solidity
        - ethereum
        - post-quantum
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9
      post_quantum_alternatives:
        - "keccak256"

  - id: solidity-use-of-ripemd160-quantum
    patterns:
      - pattern-either:
          - pattern: ripemd160(...)
    message: >-
      QUANTUM VULNERABILITY: RIPEMD-160 provides 160-bit security classically, but Grover's algorithm
      reduces this to 80-bit quantum security, which is insufficient for long-term security.
    severity: WARNING
    languages: [solidity]
    metadata:
      category: security
      technology:
        - solidity
        - ethereum
        - post-quantum
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: MEDIUM
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 6
      post_quantum_alternatives:
        - "keccak256"

  # ---------------------------------------------------------------------------
  # ASYMMETRIC CRYPTOGRAPHY VULNERABILITIES (Shor's Algorithm)
  # ---------------------------------------------------------------------------

  - id: solidity-ecrecover-quantum-warning
    patterns:
      - pattern-either:
          - pattern: ecrecover(...)
    message: >-
      QUANTUM VULNERABILITY: The ecrecover function verifies ECDSA signatures, which are vulnerable to
      Shor's algorithm. While this is currently the standard for Ethereum, quantum computers will be able
      to break ECDSA signatures and forge transactions. IMPACT: In a post-quantum world, attackers could
      recover private keys from public keys or signatures, allowing them to forge signatures and steal
      funds.
    severity: WARNING
    languages: [solidity]
    metadata:
      category: security
      technology:
        - solidity
        - ethereum
        - post-quantum
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: LOW
      impact: CRITICAL
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8
      post_quantum_alternatives:
        - "Post-quantum blockchain protocols"
        - "Quantum-resistant signature schemes"

  # ---------------------------------------------------------------------------
  # BLOCK HASH RELIANCE (Quantum Consideration)
  # ---------------------------------------------------------------------------

  - id: solidity-blockhash-quantum-consideration
    patterns:
      - pattern-either:
          - pattern: blockhash(...)
          - pattern: block.blockhash(...)
    message: >-
      QUANTUM CONSIDERATION: While blockhash itself uses keccak256 (quantum-resistant hashing), the
      underlying proof-of-work or consensus mechanism may be vulnerable to quantum attacks. Using
      blockhash for critical randomness or security decisions should be carefully evaluated in a
      post-quantum context.
    severity: INFO
    languages: [solidity]
    metadata:
      category: security
      technology:
        - solidity
        - ethereum
        - post-quantum
      confidence: MEDIUM
      likelihood: LOW
      impact: MEDIUM
      quantum_vulnerable: true
      quantum_attack: "Various (consensus-dependent)"
      quantum_risk_score: 4

  # ---------------------------------------------------------------------------
  # SHA-256 USAGE (Quantum Consideration)
  # ---------------------------------------------------------------------------

  - id: solidity-sha256-quantum-consideration
    patterns:
      - pattern-either:
          - pattern: sha256(...)
    message: >-
      QUANTUM CONSIDERATION: SHA-256 provides 256-bit classical security, but Grover's algorithm reduces
      this to 128-bit quantum security. While this is still considered secure for now, it's weaker than
      keccak256 in the quantum context.
    severity: INFO
    languages: [solidity]
    metadata:
      category: security
      technology:
        - solidity
        - ethereum
        - post-quantum
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      confidence: LOW
      likelihood: LOW
      impact: LOW
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 3
      post_quantum_alternatives:
        - "keccak256"

  # ---------------------------------------------------------------------------
  # EXTERNAL CRYPTO LIBRARY CALLS
  # ---------------------------------------------------------------------------

  - id: solidity-external-crypto-quantum-warning
    patterns:
      - pattern-either:
          - pattern: |
              $CONTRACT.call(abi.encodeWithSignature("$FUNC", ...))
          - pattern: |
              $CONTRACT.delegatecall(abi.encodeWithSignature("$FUNC", ...))
    pattern-where-python: |
      "encrypt" in vars["$FUNC"] or "decrypt" in vars["$FUNC"] or 
      "sign" in vars["$FUNC"] or "verify" in vars["$FUNC"] or
      "rsa" in vars["$FUNC"].lower() or "ecdsa" in vars["$FUNC"].lower()
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [solidity]
    metadata:
      category: security
      technology:
        - solidity
        - ethereum
        - post-quantum
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Algorithm-dependent"
      quantum_risk_score: 7
      post_quantum_alternatives:
        - "Post-quantum cryptographic libraries"
