Solana exploits keep hitting the same bug classes: missing signer checks, arbitrary cross-program invocations, unchecked account deserialization, integer overflow. These aren't exotic — they're the same patterns that have drained hundreds of millions of dollars from on-chain programs, and they're detectable with static analysis before code ever gets deployed.
So I built SolAudit: a free, MIT-licensed static analyzer for Anchor/Solana Rust programs. 0.2.0 shipped this week.
Try it in 10 seconds: npx solaudit ./your-program
What it does
Point SolAudit at a directory of .rs files and it applies 11 security rules, then gives you a report grouped by severity — no RPC calls, no wallet, no build step:
| Severity | Examples |
|---|---|
| CRITICAL | Missing signer checks on token transfers/mints |
| HIGH | Arbitrary CPI (caller-controlled program IDs), unchecked deserialization, type cosplay, insecure manual account closure, missing bump canonicalization |
| MEDIUM | Integer overflow on balance math, insecure account init, missing rent-exemption checks |
| LOW | Missing owner checks |
Each finding includes the exact line and a concrete remediation hint. Exit code is 1 on any CRITICAL/HIGH finding, so it drops straight into CI as a gate.
Three ways to use it
CLI — npx solaudit ./program, or bun add -g solaudit. Outputs human-readable, --json, or --sarif.
Web app — solaudit-web.vercel.app. Paste a public GitHub repo URL or upload a single .rs file. No install.
GitHub Action — on the Marketplace. Ten lines of YAML and every push gets scanned, with findings uploaded to your repo's Security tab as code-scanning alerts:
- uses: actions/checkout@v4
- uses: blueeyez425-art/solaudit@main
with:
path: ./programs
On accuracy — honest numbers
On the committed labeled benchmark suite, the engine scores 93.8% precision, 100% recall, 96.8% F1 on rule-covered categories.
Those numbers describe that suite, not general effectiveness. One known gap remains: duplicate mutable accounts. I built a "distinctness" heuristic for it, it produced false positives on common legitimate patterns (e.g., a deposit instruction's user/vault token accounts of the same type), so I didn't ship it. A scanner that cries wolf gets uninstalled; I'd rather have a smaller rule set people trust.
Supply chain: verify the build yourself
A security tool that asks you to trust its binaries shouldn't exist. Every npm publish of SolAudit goes through GitHub Actions trusted publishing with signed Sigstore provenance — the package on npm is cryptographically bound to an exact commit and workflow run in the public repo. There's no "someone's laptop" in the loop. npm displays the provenance badge on the package page.
The dogfooding story
The repo's own CI runs SolAudit against its intentionally vulnerable example program on every push. Setting that up immediately caught a real bug — in my own Action: when a consuming repo had a local workspace package named solaudit, npx would resolve the local package instead of the pinned npm release, and the scan silently ran... nothing. The fix: install the pinned CLI into a temp dir and invoke it directly. Self-scanning found a distribution bug before any user did. That's the loop working as advertised.
What's next
- Closing the duplicate-mutable-accounts gap with a smarter heuristic that survives the false-positive review
- More rules from post-mortems of real exploits
- Reentrancy-via-CPI-callback detection
Links
- Repo: https://github.com/blueeyez425-art/solaudit (⭐ if useful)
- npm: https://www.npmjs.com/package/solaudit
- Action: https://github.com/marketplace/actions/solaudit-security-scanner
- Demo: https://solaudit-web.vercel.app/
Feedback, false positives, and rule requests are all welcome as GitHub issues. SolAudit is free and will keep being built either way — development doesn't depend on tips. That said, if it saved you real time or caught a real bug, there's a tip link in the README, and it's genuinely appreciated.
Built by an independent security researcher. SolAudit is a first-pass scanner, not an audit — it doesn't replace manual review for anything holding real funds.
Top comments (0)