I built a free static analyzer for Solana programs — here's what it catches and how it's built

说明与用途

SolAudit 是一款针对 Solana 程序的免费静态分析器，检测 11 种常见安全缺陷，支持 CI 集成，准确率高。

问题

Solana programs frequently contain recurring security bugs such as missing signer checks, unchecked deserialization, and integer overflows, which can drain millions of dollars before deployment.

结果

SolAudit achieves 93.8% precision, 100% recall, and 96.8% F1 on a benchmark suite, catching critical and high‑severity bugs without requiring RPC calls or wallet access.

工作流

• Point SolAudit at a directory of .rs files
• Run npx solaudit ./your-program
• Review the human‑readable report or export JSON/SARIF
• Configure GitHub Action to scan on every push
• Fix reported issues and re‑run the scan

证据

Solana exploits keep hitting the same bug classes: missing signer checks, arbitrary cross-program invocations, unchecked account deserialization, integer overflow.

来源

SolAudit applies 11 security rules, then gives you a report grouped by severity — no RPC calls, no wallet, no build step.

来源

On the committed labeled benchmark suite, the engine scores 93.8% precision, 100% recall, 96.8% F1 on rule-covered categories.

来源

Every npm publish of SolAudit goes through GitHub Actions trusted publishing with signed Sigstore provenance — the package on npm is cryptographically bound to an exact commit and workflow run in the public repo.

来源