I built a free static analyzer for Solana programs — here's what it catches and how it's built

Description and use

SolAudit is a free static analyzer for Solana programs that detects 11 common security issues, integrates with CI, and achieves high precision and recall.

Problem

Solana programs frequently contain recurring security bugs such as missing signer checks, unchecked deserialization, and integer overflows, which can drain millions of dollars before deployment.

Outcome

SolAudit achieves 93.8% precision, 100% recall, and 96.8% F1 on a benchmark suite, catching critical and high‑severity bugs without requiring RPC calls or wallet access.

Workflow

• Point SolAudit at a directory of .rs files
• Run npx solaudit ./your-program
• Review the human‑readable report or export JSON/SARIF
• Configure GitHub Action to scan on every push
• Fix reported issues and re‑run the scan

Evidence

Solana exploits keep hitting the same bug classes: missing signer checks, arbitrary cross-program invocations, unchecked account deserialization, integer overflow.

Source

SolAudit applies 11 security rules, then gives you a report grouped by severity — no RPC calls, no wallet, no build step.

Source

On the committed labeled benchmark suite, the engine scores 93.8% precision, 100% recall, 96.8% F1 on rule-covered categories.

Source

Every npm publish of SolAudit goes through GitHub Actions trusted publishing with signed Sigstore provenance — the package on npm is cryptographically bound to an exact commit and workflow run in the public repo.

Source