---
# System prepended metadata

title: Linters Breakdown

---

### Linters that are enabled

Some usage descriptions taken from: https://golangci-lint.run/usage/linters/



### golangci-lint/dogsled
Prevents too many unassigned variables in function returns, e.g.
```golang
x, _, _, _, := fn()
```
The default is 2.
The linter uses examples from golang standard library.

### golangci-lint/exportloopref
Linter which aims to solve the problem of re-using a loop variable but only keeping the last. E.g. in our codebase we use
```golang
tc := tc
```
in our tests to ensure we are not referencing the wrong `tc` .

### golangci-lint/errcheck
Linter for unchecked errors.

### golangci-lint/gci
Configurable linter for imports.
```yaml
gci:
  sections:
    - standard # Standard section: captures all standard packages.
    - default # Default section: contains all imports that could not be matched to another section type.
    - blank # blank imports
    - dot # dot imports
    - prefix(cosmossdk.io)
    - prefix(github.com/cosmos/cosmos-sdk)
    - prefix(github.com/cometbft/cometbft)
    - prefix(github.com/cosmos/ibc-go)
```

### golangci-lint/goconst
Finds repeated strings that could be used as a constant. (Can be a pain in our tests)

### golangci-lint/gocritic
This one seems like it has a lot of strict checks that I'm not sure we care about.
From Github
`Highly extensible Go source code linter providing checks currently missing from other linters.` 

Has over 100 "opinionated checks" withc strict / specific requirements.
        - https://go-critic.com/overview#checkers-from-the-diagnostic-group
        - https://go-critic.com/overview#checkers-from-the-performance-group
        - https://go-critic.com/overview#checkers-from-the-style-group

### golangci-lint/gofumpt
A stricter version of gofmt.
It acts as a drop-in replacement for gofmt.

### golangci-lint/gosec
Inspects source code by scanning the go AST
We explicitly disable `'Use of weak random number generator'`
But are enabling everything else.
```md
G101: Look for hard coded credentials
G102: Bind to all interfaces
G103: Audit the use of unsafe block
G104: Audit errors not checked
G106: Audit the use of ssh.InsecureIgnoreHostKey
G107: Url provided to HTTP request as taint input
G108: Profiling endpoint automatically exposed on /debug/pprof
G109: Potential Integer overflow made by strconv.Atoi result conversion to int16/32
G110: Potential DoS vulnerability via decompression bomb
G111: Potential directory traversal
G112: Potential slowloris attack
G113: Usage of Rat.SetString in math/big with an overflow (CVE-2022-23772)
G114: Use of net/http serve function that has no support for setting timeouts
G201: SQL query construction using format string
G202: SQL query construction using string concatenation
G203: Use of unescaped data in HTML templates
G204: Audit use of command execution
G301: Poor file permissions used when creating a directory
G302: Poor file permissions used with chmod
G303: Creating tempfile using a predictable path
G304: File path provided as taint input
G305: File traversal when extracting zip/tar archive
G306: Poor file permissions used when writing to a new file
G401: Detect the usage of DES, RC4, MD5 or SHA1
G402: Look for bad TLS connection settings
G403: Ensure minimum RSA key length of 2048 bits
G404: Insecure random number source (rand)
G501: Import blocklist: crypto/md5
G502: Import blocklist: crypto/des
G503: Import blocklist: crypto/rc4
G504: Import blocklist: net/http/cgi
G505: Import blocklist: crypto/sha1
G601: Implicit memory aliasing of items from a range statement
G602: Slice access out of bounds
```

### golangci-lint/gosimple
Linter for Go source code that specializes in simplifying code
Seems to be deprecated in favour of golangci-lint/staticcheck. (which we are also using)

### golangci-lint/govet
vet is a tool for static analysis of Go programs.
vet examines Go source code and reports suspicious constructs, such as Printf calls whose arguments do not align with the format string. It uses heuristics thatt do not guarantee all reports are genuine problems, but it can find errors not caught by the compilers.
```
Registered analyzers:

  asmdecl      report mismatches between assembly files and Go declarations
  assign       check for useless assignments
  atomic       check for common mistakes using the sync/atomic package
  bools        check for common mistakes involving boolean operators
  buildtag     check that +build tags are well-formed and correctly located
  cgocall      detect some violations of the cgo pointer passing rules
  composites   check for unkeyed composite literals
  copylocks    check for locks erroneously passed by value
  errorsas     report passing non-pointer or non-error values to errors.As
  framepointer report assembly that clobbers the frame pointer before saving it
  httpresponse check for mistakes using HTTP responses
  ifaceassert  detect impossible interface-to-interface type assertions
  loopclosure  check references to loop variables from within nested functions
  lostcancel   check cancel func returned by context.WithCancel is called
  nilfunc      check for useless comparisons between functions and nil
  printf       check consistency of Printf format strings and arguments
  shift        check for shifts that equal or exceed the width of the integer
  sigchanyzer  check for unbuffered channel of os.Signal
  stdmethods   check signature of methods of well-known interfaces
  stringintconv check for string(int) conversions
  structtag    check that struct field tags conform to reflect.StructTag.Get
  testinggoroutine report calls to (*testing.T).Fatal from goroutines started by a test.
  tests        check for common mistaken usages of tests and examples
  unmarshal    report passing non-pointer or non-interface values to unmarshal
  unreachable  check for unreachable code
  unsafeptr    check for invalid conversions of uintptr to unsafe.Pointer
  unusedresult check for unused results of calls to some functions

```
By default all analyzers are run.

### golangci-lint/ineffassign
checks if value is not used after assignment.

### golangci-lint/misspell
checks for typos

### golangci-lint/nakedret
nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length.

### golangci-lint/staticcheck
It's a set of rules from staticcheck. It's not the same thing as the staticcheck binary. The author of staticcheck doesn't support or approve the use of staticcheck as a library inside golangci-lint.

### golangci-lint/thelper
Ensures correctness of calls to `t.Helper()` in test functions.

### golangci-lint/stylecheck
It's a set of rules from staticcheck. It's not the same thing as the staticcheck binary. The author of staticcheck doesn't support or approve the use of staticcheck as a library inside golangci-lint.

### golangci-lint/revive
From the docs
"Revive implements all the rules which golint has and the failures have the same concept of “confidence” that golint introduced. In fact, invoking revive with no flags has the same behavior as golint, with the difference that it runs faster."

### golangci-lint/typecheck
Like the front-end of a Go compiler, parses and type-checks Go code
Not sure why this is needed.

### golangci-lint/unconvert
  Remove unnecessary type conversions

### golangci-lint/unused
Checks Go code for unused constants, variables, functions and types
