solaudit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cody Pack
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,176 @@
+# SolAudit
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
+[![npm version](https://img.shields.io/badge/npm-v0.1.0-blue.svg)](https://www.npmjs.com/package/solaudit)
+[![build](https://img.shields.io/badge/build-passing-brightgreen.svg)](./.github/workflows/ci.yml)
+
+**A zero-dependency, static-analysis CLI that scans Anchor/Solana Rust programs for the vulnerability patterns behind the most common on-chain exploits.**
+
+SolAudit reads your `.rs` source files, applies a set of pattern-matching security rules (missing signer checks, arbitrary CPIs, unchecked deserialization, integer overflow, and more), and gives you an actionable report in seconds — with no external dependencies, no RPC calls, and no build step required to run it.
+
+---
+
+## Install
+
+```bash
+# Run instantly with npx (no install)
+npx solaudit ./program
+
+# Or install globally with Bun
+bun add -g solaudit
+solaudit ./program
+
+# Or clone and run from source
+git clone https://github.com/blueeyez425-art/solaudit.git
+cd solaudit
+bun run solaudit ./examples
+```
+
+## Usage
+
+```bash
+solaudit [path] [options]
+```
+
+| Flag | Description |
+|---|---|
+| `--json` | Print raw scan results as JSON |
+| `--sarif` | Print results as SARIF 2.1.0 (for GitHub Code Scanning) |
+| `--min-severity <level>` | Only report findings at or above `CRITICAL`\|`HIGH`\|`MEDIUM`\|`LOW`\|`INFO` |
+| `--help` | Show usage |
+
+### Example
+
+```bash
+$ solaudit ./examples
+```
+
+```
+SolAudit v0.1.0 — static analysis for Anchor/Solana programs
+Scanned 1 file(s) at 2026-08-22T18:32:37.205Z
+──────────────────────────────────────────────────────────────────────
+
+CRITICAL (2)
+   CRITICAL  SOL-001 Missing Signer Check
+    examples/vulnerable.rs:35
+    │ token::transfer(cpi_ctx, amount)?;
+    └─ Verify the authority/owner account is a Signer or explicitly
+       check `.is_signer` before transferring or minting tokens.
+
+HIGH (3)
+   HIGH      SOL-003 Arbitrary CPI (Cross-Program Invocation)
+    examples/vulnerable.rs:68
+    │ invoke(&ix, &[ctx.accounts.target_program.to_account_info()])?;
+    └─ Validate the target program ID against a known constant or type
+       the account as `Program<'info, T>` before invoking it.
+
+  HIGH      SOL-004 Missing Bump Seed Canonicalization
+    examples/vulnerable.rs:76
+    │ let signer_pda = Pubkey::create_program_address(seeds, ctx.program_id)
+    └─ Use `Pubkey::find_program_address` to derive the canonical bump
+       instead of calling `create_program_address` directly.
+
+MEDIUM (3)
+  MEDIUM    SOL-005 Integer Overflow Risk
+    examples/vulnerable.rs:27
+    │ vault.total_staked = vault.total_staked - amount;
+    └─ Replace raw arithmetic with `.checked_sub()` / `.checked_add()`
+       or `saturating_*` equivalents.
+
+──────────────────────────────────────────────────────────────────────
+Summary
+  CRITICAL 2   HIGH 3   MEDIUM 3   LOW 6   INFO 0
+  Total findings: 14 across 1 file(s)
+```
+
+Exit code is `1` when any `CRITICAL` or `HIGH` finding is present — making SolAudit a natural CI gate.
+
+## Rules
+
+| ID | Severity | Name | What it catches |
+|---|---|---|---|
+| `SOL-001` | CRITICAL | Missing Signer Check | `transfer`/`mint_to` calls made without a nearby `Signer<'info>` type or `.is_signer` check |
+| `SOL-002` | HIGH | Unchecked Account Deserialization | `Account::try_from` / `AccountLoader::try_from` used without a validating `#[account(...)]` constraint |
+| `SOL-003` | HIGH | Arbitrary CPI | `invoke`/`invoke_signed` targeting a program ID sourced from a caller-supplied account instead of a verified constant |
+| `SOL-004` | HIGH | Missing Bump Seed Canonicalization | `create_program_address` used directly, or `find_program_address`'s bump discarded instead of stored/validated |
+| `SOL-005` | MEDIUM | Integer Overflow Risk | Raw `+`/`-`/`*` arithmetic on balance-like fields instead of `checked_*`/`saturating_*` |
+| `SOL-006` | HIGH | Type Cosplay / Missing Discriminator Check | Manual `try_from_slice` deserialization with no discriminator validation or `Account<'info, T>` wrapper |
+| `SOL-007` | MEDIUM | Insecure Account Initialization | `#[account(init, ...)]` constraints missing `payer` and/or `space` |
+| `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo` fields used without a nearby `.owner` comparison |
+
+Each rule is implemented as real regex/line-scanning logic in [`src/rules/index.ts`](./src/rules/index.ts) — see that file (and its accompanying [tests](./src/rules/index.test.ts)) for the exact matching heuristics and false-positive guards.
+
+## Output formats
+
+SolAudit supports three output modes, so it fits into a terminal, a script, or a CI pipeline:
+
+- **Human** (default) — colorized terminal report grouped by severity, for local development.
+- **JSON** (`--json`) — the full `ScanResult` object (`scannedFiles`, `findings[]`, `summary`), for piping into other tooling.
+- **SARIF** (`--sarif`) — [SARIF 2.1.0](https://sarifweb.azurewebsites.net/) output compatible with GitHub Code Scanning, so findings show up as annotations directly on your pull requests.
+
+```bash
+solaudit ./programs --sarif > results.sarif
+```
+
+## GitHub Actions
+
+Add SolAudit to your CI so every push and PR is scanned automatically:
+
+```yaml
+name: SolAudit
+
+on: [push, pull_request]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - run: bun install
+      - run: bun src/cli.ts ./programs --sarif > results.sarif
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+```
+
+This repository's own [`.github/workflows/ci.yml`](./.github/workflows/ci.yml) runs SolAudit against [`examples/vulnerable.rs`](./examples/vulnerable.rs) on every push.
+
+## Project layout
+
+```
+src/
+  types.ts             # Finding, Rule, ScanResult types
+  rules/index.ts        # The 8 vulnerability rules (pattern-matching logic)
+  scanner.ts            # File/directory walking + aggregation
+  output/report.ts       # Colored terminal report
+  output/sarif.ts        # SARIF 2.1.0 conversion
+  cli.ts                # Argument parsing + entrypoint
+examples/vulnerable.rs   # Intentionally vulnerable sample Anchor program
+```
+
+## Development
+
+```bash
+bun install
+bun test              # run the unit test suite
+bun run start ./examples   # run the CLI against the bundled example
+bun run build         # bundle src/cli.ts -> dist/cli.js
+```
+
+## Contributing
+
+Contributions are very welcome — new rules, false-positive fixes, additional output formats, or better heuristics are all in scope.
+
+1. Fork the repo and create a branch from `main`.
+2. Add or update a rule in `src/rules/index.ts` (each rule is a self-contained `Rule` object).
+3. Add unit tests covering both a triggering and a non-triggering case (`src/rules/index.test.ts`).
+4. Run `bun test` and `bun run build` before opening a PR.
+
+Please open an issue first for larger changes (e.g. new output formats or a plugin system) so we can discuss the approach.
+
+## License
+
+[MIT](./LICENSE) © 2026 Cody Pack

package/dist/cli.js

@@ -0,0 +1,509 @@
+#!/usr/bin/env node
+
+// src/rules/index.ts
+function makeFinding(rule, filePath, line, snippet, description) {
+  return {
+    ruleId: rule.id,
+    ruleName: rule.name,
+    severity: rule.severity,
+    filePath,
+    line,
+    snippet: snippet.trim(),
+    description
+  };
+}
+function splitLines(fileContent) {
+  return fileContent.split(/\r\n|\r|\n/);
+}
+var missingSignerCheck = {
+  id: "SOL-001",
+  name: "Missing Signer Check",
+  severity: "CRITICAL",
+  description: "A transfer or mint_to call was found without an is_signer / Signer<'info> check within the preceding 10 lines. Add a `Signer<'info>` account type or an explicit `require!(ctx.accounts.authority.is_signer, ...)` check before authorizing fund movement.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const callPattern = /\b(transfer|mint_to)\s*\(/;
+    lines.forEach((line, idx) => {
+      if (!callPattern.test(line))
+        return;
+      if (!line.includes("ctx.accounts.") && !fileContent.includes("ctx.accounts."))
+        return;
+      const windowStart = Math.max(0, idx - 10);
+      const window = lines.slice(windowStart, idx + 1).join(`
+`);
+      const hasSignerEvidence = /is_signer/.test(window) || /Signer<\s*'info\s*>/.test(window) || /#\[account\([^)]*signer[^)]*\)\]/i.test(window);
+      if (!hasSignerEvidence) {
+        findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, line, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
+      }
+    });
+    return findings;
+  }
+};
+var uncheckedDeserialization = {
+  id: "SOL-002",
+  name: "Unchecked Account Deserialization",
+  severity: "HIGH",
+  description: "`Account::try_from` / `AccountLoader::try_from` was used to manually deserialize account data without a corresponding `#[account(...)]` constraint validating ownership or discriminator. Prefer typed `Account<'info, T>` fields validated by Anchor, or add explicit owner/discriminator checks.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const pattern = /(Account|AccountLoader)::try_from\s*\(/;
+    lines.forEach((line, idx) => {
+      if (!pattern.test(line))
+        return;
+      const prevLine = idx > 0 ? lines[idx - 1] : "";
+      const hasConstraint = /#\[account\(/.test(prevLine) || /#\[account\(/.test(line);
+      if (!hasConstraint) {
+        findings.push(makeFinding(uncheckedDeserialization, filePath, idx + 1, line, "Add a `#[account(constraint = ..., owner = ...)]` attribute, or replace with a typed `Account<'info, T>` field so Anchor validates ownership and discriminator automatically."));
+      }
+    });
+    return findings;
+  }
+};
+var arbitraryCpi = {
+  id: "SOL-003",
+  name: "Arbitrary CPI (Cross-Program Invocation)",
+  severity: "HIGH",
+  description: "`invoke` or `invoke_signed` is called with a program id sourced from a user-supplied account rather than a hardcoded/verified program ID. This allows an attacker to substitute a malicious program. Add a `constraint = program.key() == expected_program::ID` check or use Anchor's `Program<'info, T>` type.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const cpiPattern = /\b(invoke|invoke_signed)\s*\(/;
+    lines.forEach((line, idx) => {
+      if (!cpiPattern.test(line))
+        return;
+      const windowStart = Math.max(0, idx - 3);
+      const windowEnd = Math.min(lines.length, idx + 4);
+      const window = lines.slice(windowStart, windowEnd).join(`
+`);
+      const usesAccountsAsProgram = /ctx\.accounts\.\w+\.(to_account_info\(\)|key\(\))/.test(window) && !/Program<\s*'info/.test(window);
+      if (usesAccountsAsProgram) {
+        findings.push(makeFinding(arbitraryCpi, filePath, idx + 1, line, "Validate the target program ID against a known constant (e.g. `token_program.key() == spl_token::ID`) or type the account as `Program<'info, T>` before invoking it."));
+      }
+    });
+    return findings;
+  }
+};
+var missingBumpCanonicalization = {
+  id: "SOL-004",
+  name: "Missing Bump Seed Canonicalization",
+  severity: "HIGH",
+  description: "PDA bump seeds must be derived via `find_program_address` and the canonical bump stored/validated on-chain. Calling `create_program_address` directly, or discarding the bump returned by `find_program_address`, allows bump-seed forgery attacks.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    lines.forEach((line, idx) => {
+      if (/create_program_address\s*\(/.test(line) && !/find_program_address/.test(line)) {
+        findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
+        return;
+      }
+      const fpaMatch = line.match(/let\s+(\([^)]*\)|\w+)\s*=\s*[\w:]*find_program_address\s*\(/);
+      if (fpaMatch) {
+        const binding = fpaMatch[1];
+        const bindsBump = /\(\s*\w+\s*,\s*\w+\s*\)/.test(binding);
+        if (!bindsBump) {
+          findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Destructure and store the bump returned by `find_program_address` (e.g. `let (pda, bump) = ...`) and persist/validate it instead of discarding it."));
+        }
+      }
+    });
+    return findings;
+  }
+};
+var integerOverflowRisk = {
+  id: "SOL-005",
+  name: "Integer Overflow Risk",
+  severity: "MEDIUM",
+  description: "Raw arithmetic (`+`, `-`, `*`) was performed on u64/u128-typed values without using checked or saturating arithmetic. Unchecked overflow can wrap silently in release builds without `overflow-checks = true`, corrupting balances. Use `.checked_add`/`.checked_sub`/`.checked_mul` or `saturating_*` and handle the `None` case.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const arithmeticPattern = /\b(\w*(amount|balance|supply|total|shares|stake)\w*)\s*(\+|\-|\*)\s*\w/i;
+    const alreadySafe = /checked_(add|sub|mul|div)|saturating_(add|sub|mul)|wrapping_(add|sub|mul)/;
+    lines.forEach((line, idx) => {
+      if (alreadySafe.test(line))
+        return;
+      if (line.trim().startsWith("//"))
+        return;
+      if (arithmeticPattern.test(line)) {
+        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
+      }
+    });
+    return findings;
+  }
+};
+var typeCosplay = {
+  id: "SOL-006",
+  name: "Type Cosplay / Missing Discriminator Check",
+  severity: "HIGH",
+  description: "Account data is manually deserialized with `try_from_slice` without validating an 8-byte Anchor discriminator or account type tag first. An attacker can pass an account of a different type with a compatible byte layout ('type cosplay') to bypass logic. Use Anchor's `Account<'info, T>` wrapper, which enforces discriminator checks automatically, or manually compare the first 8 bytes against `T::DISCRIMINATOR`.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    lines.forEach((line, idx) => {
+      if (!/try_from_slice\s*\(/.test(line))
+        return;
+      const windowStart = Math.max(0, idx - 5);
+      const window = lines.slice(windowStart, idx + 1).join(`
+`);
+      const usesTypedAccountWrapper = /Account<\s*'info/.test(window);
+      const checksDiscriminator = /discriminator/i.test(window);
+      if (!usesTypedAccountWrapper && !checksDiscriminator) {
+        findings.push(makeFinding(typeCosplay, filePath, idx + 1, line, "Verify the account's 8-byte Anchor discriminator matches the expected type before trusting deserialized fields, or switch to Anchor's `Account<'info, T>` type."));
+      }
+    });
+    return findings;
+  }
+};
+var insecureInit = {
+  id: "SOL-007",
+  name: "Insecure Account Initialization",
+  severity: "MEDIUM",
+  description: "An `#[account(init, ...)]` constraint is missing `payer` and/or `space`. Anchor requires both to safely allocate and rent-exempt a new account; omitting them causes a compile error in modern Anchor, but in hand-rolled or macro-generated code this pattern indicates the constraint block was copy-pasted incompletely and should be reviewed.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const blockRegex = /#\[account\(([\s\S]*?)\)\]/g;
+    let match;
+    while ((match = blockRegex.exec(fileContent)) !== null) {
+      const block = match[1];
+      if (!/\binit\b/.test(block))
+        continue;
+      const hasPayer = /\bpayer\s*=/.test(block);
+      const hasSpace = /\bspace\s*=/.test(block);
+      if (!hasPayer || !hasSpace) {
+        const upToMatch = fileContent.slice(0, match.index);
+        const line = upToMatch.split(/\r\n|\r|\n/).length;
+        const missing = [!hasPayer && "payer", !hasSpace && "space"].filter(Boolean).join(" and ");
+        findings.push(makeFinding(insecureInit, filePath, line, `#[account(${block.trim()})]`, `Add the missing \`${missing}\` argument(s) to this init constraint so Anchor allocates and rent-exempts the account correctly.`));
+      }
+    }
+    return findings;
+  }
+};
+var missingOwnerCheck = {
+  id: "SOL-008",
+  name: "Missing Owner Check",
+  severity: "LOW",
+  description: "A raw `AccountInfo` field is accessed via `ctx.accounts.` without a nearby `.owner` comparison. Raw `AccountInfo` accounts bypass Anchor's automatic ownership validation, so the program must manually verify `account.owner == expected_program_id` before trusting its data.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const rawFieldPattern = /pub\s+(\w+)\s*:\s*AccountInfo<\s*'info\s*>/;
+    const rawFields = new Set;
+    lines.forEach((line) => {
+      const m = line.match(rawFieldPattern);
+      if (m)
+        rawFields.add(m[1]);
+    });
+    if (rawFields.size === 0)
+      return findings;
+    lines.forEach((line, idx) => {
+      for (const field of rawFields) {
+        const usagePattern = new RegExp(`ctx\\.accounts\\.${field}\\b`);
+        if (!usagePattern.test(line))
+          continue;
+        const windowStart = Math.max(0, idx - 5);
+        const windowEnd = Math.min(lines.length, idx + 6);
+        const window = lines.slice(windowStart, windowEnd).join(`
+`);
+        const hasOwnerCheck = new RegExp(`${field}\\.owner`).test(window) || /\.owner\s*==/.test(window);
+        if (!hasOwnerCheck) {
+          findings.push(makeFinding(missingOwnerCheck, filePath, idx + 1, line, `Add an explicit \`require!(ctx.accounts.${field}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check before using this raw AccountInfo.`));
+        }
+      }
+    });
+    return findings;
+  }
+};
+var rules = [
+  missingSignerCheck,
+  uncheckedDeserialization,
+  arbitraryCpi,
+  missingBumpCanonicalization,
+  integerOverflowRisk,
+  typeCosplay,
+  insecureInit,
+  missingOwnerCheck
+];
+
+// src/scanner.ts
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+function scanFile(filePath, rules2) {
+  const content = readFileSync(filePath, "utf8");
+  const findings = [];
+  for (const rule of rules2) {
+    try {
+      const ruleFindings = rule.check(content, filePath);
+      findings.push(...ruleFindings);
+    } catch (err) {
+      console.error(`[solaudit] rule ${rule.id} threw on ${filePath}: ${err.message}`);
+    }
+  }
+  return findings.sort((a, b) => a.line - b.line);
+}
+function walk(dirPath, files = []) {
+  const entries = readdirSync(dirPath);
+  for (const entry of entries) {
+    if (entry === "node_modules" || entry === "target" || entry === ".git")
+      continue;
+    const fullPath = join(dirPath, entry);
+    const stat = statSync(fullPath);
+    if (stat.isDirectory()) {
+      walk(fullPath, files);
+    } else if (stat.isFile() && fullPath.endsWith(".rs")) {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
+function emptySummary() {
+  return { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+}
+function tallySummary(findings) {
+  const summary = emptySummary();
+  for (const finding of findings) {
+    switch (finding.severity) {
+      case "CRITICAL":
+        summary.critical++;
+        break;
+      case "HIGH":
+        summary.high++;
+        break;
+      case "MEDIUM":
+        summary.medium++;
+        break;
+      case "LOW":
+        summary.low++;
+        break;
+      case "INFO":
+        summary.info++;
+        break;
+    }
+  }
+  return summary;
+}
+async function scanDirectory(targetPath, rules2) {
+  const stat = statSync(targetPath);
+  const rsFiles = stat.isDirectory() ? walk(targetPath) : targetPath.endsWith(".rs") ? [targetPath] : [];
+  const allFindings = [];
+  for (const file of rsFiles) {
+    allFindings.push(...scanFile(file, rules2));
+  }
+  const severityOrder = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3, INFO: 4 };
+  allFindings.sort((a, b) => {
+    const sev = severityOrder[a.severity] - severityOrder[b.severity];
+    if (sev !== 0)
+      return sev;
+    if (a.filePath !== b.filePath)
+      return a.filePath.localeCompare(b.filePath);
+    return a.line - b.line;
+  });
+  return {
+    scannedFiles: rsFiles.length,
+    findings: allFindings,
+    summary: tallySummary(allFindings)
+  };
+}
+
+// src/output/report.ts
+var RESET = "\x1B[0m";
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var RED = "\x1B[31m";
+var ORANGE = "\x1B[38;5;208m";
+var YELLOW = "\x1B[33m";
+var BLUE = "\x1B[34m";
+var GRAY = "\x1B[90m";
+var CYAN = "\x1B[36m";
+var GREEN = "\x1B[32m";
+function colorFor(severity) {
+  switch (severity) {
+    case "CRITICAL":
+      return RED;
+    case "HIGH":
+      return ORANGE;
+    case "MEDIUM":
+      return YELLOW;
+    case "LOW":
+      return BLUE;
+    default:
+      return GRAY;
+  }
+}
+function badge(severity) {
+  const color = colorFor(severity);
+  return `${color}${BOLD} ${severity.padEnd(8)} ${RESET}`;
+}
+var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
+function printReport(result) {
+  const timestamp = new Date().toISOString();
+  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.1.0 — static analysis for Anchor/Solana programs${RESET}`);
+  console.log(`${DIM}Scanned ${result.scannedFiles} file(s) at ${timestamp}${RESET}`);
+  console.log(`${GRAY}${"─".repeat(70)}${RESET}`);
+  if (result.findings.length === 0) {
+    console.log(`${GREEN}${BOLD}✔ No issues found.${RESET}`);
+  } else {
+    const grouped = new Map;
+    for (const finding of result.findings) {
+      const bucket = grouped.get(finding.severity) ?? [];
+      bucket.push(finding);
+      grouped.set(finding.severity, bucket);
+    }
+    for (const severity of SEVERITY_ORDER) {
+      const findings = grouped.get(severity);
+      if (!findings || findings.length === 0)
+        continue;
+      console.log("");
+      console.log(`${colorFor(severity)}${BOLD}${severity} (${findings.length})${RESET}`);
+      for (const finding of findings) {
+        console.log(`  ${badge(finding.severity)} ${BOLD}${finding.ruleId}${RESET} ${finding.ruleName}`);
+        console.log(`    ${DIM}${finding.filePath}:${finding.line}${RESET}`);
+        console.log(`    ${GRAY}│${RESET} ${finding.snippet}`);
+        console.log(`    ${GRAY}└─${RESET} ${finding.description}`);
+      }
+    }
+  }
+  console.log("");
+  console.log(`${GRAY}${"─".repeat(70)}${RESET}`);
+  console.log(`${BOLD}Summary${RESET}`);
+  console.log(`  ${RED}${BOLD}CRITICAL${RESET} ${result.summary.critical}   ` + `${ORANGE}${BOLD}HIGH${RESET} ${result.summary.high}   ` + `${YELLOW}${BOLD}MEDIUM${RESET} ${result.summary.medium}   ` + `${BLUE}${BOLD}LOW${RESET} ${result.summary.low}   ` + `${GRAY}${BOLD}INFO${RESET} ${result.summary.info}`);
+  console.log(`  ${DIM}Total findings: ${result.findings.length} across ${result.scannedFiles} file(s)${RESET}`);
+  console.log("");
+}
+
+// src/output/sarif.ts
+var SARIF_VERSION = "2.1.0";
+var TOOL_VERSION = "0.1.0";
+function severityToSarifLevel(severity) {
+  switch (severity) {
+    case "CRITICAL":
+    case "HIGH":
+      return "error";
+    case "MEDIUM":
+      return "warning";
+    default:
+      return "note";
+  }
+}
+function toFileUri(filePath) {
+  return filePath.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function toSarif(result) {
+  const sarifRules = rules.map((rule) => ({
+    id: rule.id,
+    name: rule.name.replace(/\s+/g, ""),
+    shortDescription: { text: rule.name },
+    fullDescription: { text: rule.description },
+    defaultConfiguration: { level: severityToSarifLevel(rule.severity) },
+    properties: { severity: rule.severity }
+  }));
+  const sarifResults = result.findings.map((finding) => ({
+    ruleId: finding.ruleId,
+    level: severityToSarifLevel(finding.severity),
+    message: { text: `${finding.description} (${finding.snippet})` },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: toFileUri(finding.filePath) },
+          region: { startLine: Math.max(1, finding.line) }
+        }
+      }
+    ]
+  }));
+  return {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    version: SARIF_VERSION,
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "SolAudit",
+            informationUri: "https://github.com/blueeyez425-art/solaudit",
+            version: TOOL_VERSION,
+            rules: sarifRules
+          }
+        },
+        results: sarifResults
+      }
+    ]
+  };
+}
+
+// src/cli.ts
+var SEVERITY_RANK = {
+  CRITICAL: 0,
+  HIGH: 1,
+  MEDIUM: 2,
+  LOW: 3,
+  INFO: 4
+};
+function printHelp() {
+  console.log(`SolAudit — static analysis CLI for Anchor/Solana programs
+
+Usage:
+  solaudit [path] [options]
+
+Arguments:
+  path                    File or directory to scan (default: current directory)
+
+Options:
+  --json                  Print raw scan results as JSON
+  --sarif                 Print scan results as SARIF 2.1.0 JSON (for GitHub code scanning)
+  --min-severity <level>  Only report findings at or above this severity
+                          (CRITICAL | HIGH | MEDIUM | LOW | INFO)
+  --help                  Show this help message
+
+Examples:
+  solaudit ./program
+  bun run solaudit ./programs/vault --min-severity HIGH
+  solaudit . --sarif > results.sarif
+
+Exit codes:
+  0   No CRITICAL or HIGH severity findings
+  1   One or more CRITICAL or HIGH severity findings were found
+`);
+}
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp();
+    process.exit(0);
+  }
+  const wantsJson = args.includes("--json");
+  const wantsSarif = args.includes("--sarif");
+  let minSeverity = "INFO";
+  const minSeverityIdx = args.indexOf("--min-severity");
+  if (minSeverityIdx !== -1) {
+    const value = (args[minSeverityIdx + 1] || "").toUpperCase();
+    if (value in SEVERITY_RANK) {
+      minSeverity = value;
+    } else {
+      console.error(`[solaudit] invalid --min-severity value: "${args[minSeverityIdx + 1]}"`);
+      process.exit(2);
+    }
+  }
+  const positional = args.filter((arg, idx) => {
+    if (arg.startsWith("-"))
+      return false;
+    if (args[idx - 1] === "--min-severity")
+      return false;
+    return true;
+  });
+  const targetPath = positional[0] || ".";
+  const result = await scanDirectory(targetPath, rules);
+  result.findings = result.findings.filter((finding) => SEVERITY_RANK[finding.severity] <= SEVERITY_RANK[minSeverity]);
+  if (wantsSarif) {
+    console.log(JSON.stringify(toSarif(result), null, 2));
+  } else if (wantsJson) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    printReport(result);
+  }
+  const hasBlockingFindings = result.findings.some((f) => f.severity === "CRITICAL" || f.severity === "HIGH");
+  process.exit(hasBlockingFindings ? 1 : 0);
+}
+main().catch((err) => {
+  console.error(`[solaudit] fatal error: ${err.message}`);
+  process.exit(2);
+});

package/examples/vulnerable.rs

@@ -0,0 +1,168 @@
+use anchor_lang::prelude::*;
+use anchor_spl::token::{self, Mint, Token, TokenAccount, Transfer};
+use solana_program::program::{invoke, invoke_signed};
+use solana_program::pubkey::Pubkey;
+
+declare_id!("VauLt111111111111111111111111111111111111");
+
+// A simple token vault / staking contract.
+// NOTE: this file is intentionally left with a few rough edges from the
+// original hackathon build -- flagged for cleanup before mainnet launch.
+#[program]
+pub mod simple_vault {
+    use super::*;
+
+    pub fn initialize_vault(ctx: Context<InitializeVault>, _bump: u8) -> Result<()> {
+        let vault = &mut ctx.accounts.vault;
+        vault.total_staked = 0;
+        vault.authority = ctx.accounts.authority.key();
+        Ok(())
+    }
+
+    // TODO: add signer check before we ship this to mainnet
+    pub fn withdraw(ctx: Context<Withdraw>, amount: u64) -> Result<()> {
+        let vault = &mut ctx.accounts.vault;
+
+        // Naive balance bump -- fine for now, revisit before audit.
+        vault.total_staked = vault.total_staked - amount;
+
+        let cpi_accounts = Transfer {
+            from: ctx.accounts.vault_token_account.to_account_info(),
+            to: ctx.accounts.user_token_account.to_account_info(),
+            authority: ctx.accounts.vault_authority.to_account_info(),
+        };
+        let cpi_ctx = CpiContext::new(ctx.accounts.token_program.to_account_info(), cpi_accounts);
+        token::transfer(cpi_ctx, amount)?;
+
+        Ok(())
+    }
+
+    pub fn stake(ctx: Context<Stake>, amount: u64) -> Result<()> {
+        let vault = &mut ctx.accounts.vault;
+        // Total staked grows with every deposit.
+        vault.total_staked = vault.total_staked + amount;
+
+        token::mint_to(
+            CpiContext::new(
+                ctx.accounts.token_program.to_account_info(),
+                token::MintTo {
+                    mint: ctx.accounts.reward_mint.to_account_info(),
+                    to: ctx.accounts.user_reward_account.to_account_info(),
+                    authority: ctx.accounts.vault_authority.to_account_info(),
+                },
+            ),
+            amount,
+        )?;
+
+        Ok(())
+    }
+
+    // Relay instruction lets callers route a CPI through the vault's authority.
+    // Convenient for composability with partner programs.
+    pub fn relay_cpi(ctx: Context<RelayCpi>, data: Vec<u8>) -> Result<()> {
+        let ix = solana_program::instruction::Instruction {
+            program_id: ctx.accounts.target_program.key(),
+            accounts: vec![],
+            data,
+        };
+        invoke(&ix, &[ctx.accounts.target_program.to_account_info()])?;
+        Ok(())
+    }
+
+    // Derives a vault signer PDA without going through find_program_address --
+    // kept for backwards compatibility with the old bump scheme.
+    pub fn sign_with_legacy_bump(ctx: Context<LegacySign>, bump: u8) -> Result<()> {
+        let seeds = &[b"vault", ctx.accounts.authority.key.as_ref(), &[bump]];
+        let signer_pda = Pubkey::create_program_address(seeds, ctx.program_id)
+            .map_err(|_| ProgramError::InvalidSeeds)?;
+        msg!("legacy signer pda: {}", signer_pda);
+        Ok(())
+    }
+
+    // Loads raw vault bytes for a quick migration script -- bypasses the
+    // normal Account<T> wrapper since we needed this in a hurry.
+    pub fn migrate_vault(ctx: Context<MigrateVault>) -> Result<()> {
+        let data = ctx.accounts.legacy_vault.try_borrow_data()?;
+        let legacy: LegacyVaultData = LegacyVaultData::try_from_slice(&data[8..])?;
+        msg!("migrating vault with {} staked", legacy.total_staked);
+        Ok(())
+    }
+
+    // Reads the fee_collector account directly for logging purposes.
+    pub fn log_fee_collector(ctx: Context<LogFeeCollector>) -> Result<()> {
+        msg!("fee collector: {}", ctx.accounts.fee_collector.key());
+        Ok(())
+    }
+}
+
+#[account]
+pub struct Vault {
+    pub authority: Pubkey,
+    pub total_staked: u64,
+}
+
+#[account]
+pub struct LegacyVaultData {
+    pub total_staked: u64,
+}
+
+#[derive(Accounts)]
+pub struct InitializeVault<'info> {
+    // Missing `space` on this init constraint -- copy-pasted from another
+    // instruction and never finished.
+    #[account(init, payer = authority)]
+    pub vault: Account<'info, Vault>,
+    #[account(mut)]
+    pub authority: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct Withdraw<'info> {
+    #[account(mut)]
+    pub vault: Account<'info, Vault>,
+    #[account(mut)]
+    pub vault_token_account: Account<'info, TokenAccount>,
+    #[account(mut)]
+    pub user_token_account: Account<'info, TokenAccount>,
+    /// CHECK: PDA authority for the vault, checked via seeds elsewhere
+    pub vault_authority: AccountInfo<'info>,
+    pub token_program: Program<'info, Token>,
+}
+
+#[derive(Accounts)]
+pub struct Stake<'info> {
+    #[account(mut)]
+    pub vault: Account<'info, Vault>,
+    #[account(mut)]
+    pub reward_mint: Account<'info, Mint>,
+    #[account(mut)]
+    pub user_reward_account: Account<'info, TokenAccount>,
+    /// CHECK: PDA authority for the vault
+    pub vault_authority: AccountInfo<'info>,
+    pub token_program: Program<'info, Token>,
+}
+
+#[derive(Accounts)]
+pub struct RelayCpi<'info> {
+    /// CHECK: caller-supplied program to relay the call to -- no allowlist yet
+    pub target_program: AccountInfo<'info>,
+    pub authority: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct LegacySign<'info> {
+    pub authority: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct MigrateVault<'info> {
+    /// CHECK: raw legacy account, migrated manually below
+    pub legacy_vault: AccountInfo<'info>,
+}
+
+#[derive(Accounts)]
+pub struct LogFeeCollector<'info> {
+    /// CHECK: only used for logging, never mutated
+    pub fee_collector: AccountInfo<'info>,
+}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "solaudit",
+  "version": "0.1.0",
+  "description": "Open-source static analysis CLI for Anchor/Solana programs",
+  "type": "module",
+  "bin": { "solaudit": "./dist/cli.js" },
+  "main": "./dist/index.js",
+  "files": ["dist", "examples", "README.md", "LICENSE"],
+  "engines": { "node": ">=18" },
+  "scripts": {
+    "build": "bun build src/cli.ts --outdir dist --target node --sourcemap=none",
+    "prepublishOnly": "npm run build",
+    "start": "bun src/cli.ts",
+    "test": "bun test"
+  },
+  "keywords": ["solana", "anchor", "security", "static-analysis", "audit"],
+  "license": "MIT",
+  "author": "Cody Pack",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/blueeyez425-art/solaudit.git"
+  },
+  "devDependencies": {
+    "bun-types": "latest"
+  }
+}