Static read-through audit of plugins/sector-aluminium. One verified finding.
1. Fail-open on the plugin's core compliance gate
Location: src/lib.rs:53, 65-70
Issue: validate_input uses require_str("productionRoute") (any non-empty string) instead of require_enum (available in the SDK and used elsewhere in this codebase). calculate_metrics's match falls through to a _ arm (12,000 kg CO2e/tonne) for any unrecognized value — a threshold higher than all three named routes, including the strictest (primary, 10,000). The inline comment // conservative default directly contradicts this: the default is the most permissive, not the most conservative.
Failure scenario: A shipment that is actually primary (Hall-Héroult) aluminium at 11,000 kg CO2e/tonne — genuinely non-compliant under the real primary threshold — is scored Compliant if productionRoute is anything other than the exact literal "primary" (wrong case, typo, or an unlisted route name). productionRoute is untrusted manufacturer-supplied data directly gating a CBAM/ESPR compliance verdict.
No other issues found — GTIN/country/percentage validation, error handling, and passthrough logic are all sound.
Static read-through audit of
plugins/sector-aluminium. One verified finding.1. Fail-open on the plugin's core compliance gate
Location:
src/lib.rs:53,65-70Issue:
validate_inputusesrequire_str("productionRoute")(any non-empty string) instead ofrequire_enum(available in the SDK and used elsewhere in this codebase).calculate_metrics's match falls through to a_arm (12,000 kg CO2e/tonne) for any unrecognized value — a threshold higher than all three named routes, including the strictest (primary, 10,000). The inline comment// conservative defaultdirectly contradicts this: the default is the most permissive, not the most conservative.Failure scenario: A shipment that is actually primary (Hall-Héroult) aluminium at 11,000 kg CO2e/tonne — genuinely non-compliant under the real primary threshold — is scored
CompliantifproductionRouteis anything other than the exact literal"primary"(wrong case, typo, or an unlisted route name).productionRouteis untrusted manufacturer-supplied data directly gating a CBAM/ESPR compliance verdict.No other issues found — GTIN/country/percentage validation, error handling, and passthrough logic are all sound.