I built a free static analyzer for Solana programs — here's what it catches and how it's built

Cody Pack — Wed, 14 Oct 2026 02:26:30 +0000

Solana exploits keep hitting the same bug classes: missing signer checks, arbitrary cross-program invocations, unchecked account deserialization, integer overflow. These aren't exotic — they're the same patterns that have drained hundreds of millions of dollars from on-chain programs, and they're detectable with static analysis before code ever gets deployed.

So I built SolAudit: a free, MIT-licensed static analyzer for Anchor/Solana Rust programs. 0.2.0 shipped this week.

Try it in 10 seconds: npx solaudit ./your-program

What it does

Point SolAudit at a directory of .rs files and it applies 11 security rules, then gives you a report grouped by severity — no RPC calls, no wallet, no build step:

Severity	Examples
CRITICAL	Missing signer checks on token transfers/mints
HIGH	Arbitrary CPI (caller-controlled program IDs), unchecked deserialization, type cosplay, insecure manual account closure, missing bump canonicalization
MEDIUM	Integer overflow on balance math, insecure account init, missing rent-exemption checks
LOW	Missing owner checks

Each finding includes the exact line and a concrete remediation hint. Exit code is 1 on any CRITICAL/HIGH finding, so it drops straight into CI as a gate.

Three ways to use it

CLI — npx solaudit ./program, or bun add -g solaudit. Outputs human-readable, --json, or --sarif.

Web app — solaudit-web.vercel.app. Paste a public GitHub repo URL or upload a single .rs file. No install.

GitHub Action — on the Marketplace. Ten lines of YAML and every push gets scanned, with findings uploaded to your repo's Security tab as code-scanning alerts:

- uses: actions/checkout@v4
- uses: blueeyez425-art/solaudit@main
  with:
    path: ./programs

On accuracy — honest numbers

On the committed labeled benchmark suite, the engine scores 93.8% precision, 100% recall, 96.8% F1 on rule-covered categories.

Those numbers describe that suite, not general effectiveness. One known gap remains: duplicate mutable accounts. I built a "distinctness" heuristic for it, it produced false positives on common legitimate patterns (e.g., a deposit instruction's user/vault token accounts of the same type), so I didn't ship it. A scanner that cries wolf gets uninstalled; I'd rather have a smaller rule set people trust.

Supply chain: verify the build yourself

A security tool that asks you to trust its binaries shouldn't exist. Every npm publish of SolAudit goes through GitHub Actions trusted publishing with signed Sigstore provenance — the package on npm is cryptographically bound to an exact commit and workflow run in the public repo. There's no "someone's laptop" in the loop. npm displays the provenance badge on the package page.

The dogfooding story

The repo's own CI runs SolAudit against its intentionally vulnerable example program on every push. Setting that up immediately caught a real bug — in my own Action: when a consuming repo had a local workspace package named solaudit, npx would resolve the local package instead of the pinned npm release, and the scan silently ran... nothing. The fix: install the pinned CLI into a temp dir and invoke it directly. Self-scanning found a distribution bug before any user did. That's the loop working as advertised.

What's next

Closing the duplicate-mutable-accounts gap with a smarter heuristic that survives the false-positive review
More rules from post-mortems of real exploits
Reentrancy-via-CPI-callback detection

Links

Repo: https://github.com/blueeyez425-art/solaudit (⭐ if useful)
npm: https://www.npmjs.com/package/solaudit
Action: https://github.com/marketplace/actions/solaudit-security-scanner
Demo: https://solaudit-web.vercel.app/

Feedback, false positives, and rule requests are all welcome as GitHub issues. SolAudit is free and will keep being built either way — development doesn't depend on tips. That said, if it saved you real time or caught a real bug, there's a tip link in the README, and it's genuinely appreciated.

Built by an independent security researcher. SolAudit is a first-pass scanner, not an audit — it doesn't replace manual review for anything holding real funds.

DEV Community: Cody Pack