I built a free static analyzer for Solana programs — here's what it catches and how it's built

Описание и применение

SolAudit — бесплатный статический анализатор для программ Solana, обнаруживает 11 типичных уязвимостей, интегрируется в CI и обеспечивает высокую точность.

Задача

Solana programs frequently contain recurring security bugs such as missing signer checks, unchecked deserialization, and integer overflows, which can drain millions of dollars before deployment.

Результат

SolAudit achieves 93.8% precision, 100% recall, and 96.8% F1 on a benchmark suite, catching critical and high‑severity bugs without requiring RPC calls or wallet access.

Рабочий процесс

• Point SolAudit at a directory of .rs files
• Run npx solaudit ./your-program
• Review the human‑readable report or export JSON/SARIF
• Configure GitHub Action to scan on every push
• Fix reported issues and re‑run the scan

Доказательства

Solana exploits keep hitting the same bug classes: missing signer checks, arbitrary cross-program invocations, unchecked account deserialization, integer overflow.

Источник

SolAudit applies 11 security rules, then gives you a report grouped by severity — no RPC calls, no wallet, no build step.

Источник

On the committed labeled benchmark suite, the engine scores 93.8% precision, 100% recall, 96.8% F1 on rule-covered categories.

Источник

Every npm publish of SolAudit goes through GitHub Actions trusted publishing with signed Sigstore provenance — the package on npm is cryptographically bound to an exact commit and workflow run in the public repo.

Источник