solaudit 0.2.0 → 0.3.0

package/README.md

@@ -1,7 +1,7 @@
 # SolAudit
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
-[![npm version](https://img.shields.io/badge/npm-v0.2.0-blue.svg)](https://www.npmjs.com/package/solaudit)
+[![npm version](https://img.shields.io/badge/npm-v0.3.0-blue.svg)](https://www.npmjs.com/package/solaudit)
 [![build](https://img.shields.io/badge/build-passing-brightgreen.svg)](./.github/workflows/ci.yml)
 
 **A zero-dependency static-analysis engine that scans Anchor/Solana Rust programs for the vulnerability patterns behind the most common on-chain exploits — available as a CLI and as a free web app.**
@@ -44,6 +44,7 @@ solaudit [path] [options]
 | `--json` | Print raw scan results as JSON |
 | `--sarif` | Print results as SARIF 2.1.0 (for GitHub Code Scanning) |
 | `--min-severity <level>` | Only report findings at or above `CRITICAL`\|`HIGH`\|`MEDIUM`\|`LOW`\|`INFO` |
+| `--experimental` | Also run opt-in experimental rules (currently `SOL-012` Duplicate Mutable Accounts); higher signal, more false positives |
 | `--help` | Show usage |
 
 ### Example
@@ -53,7 +54,7 @@ $ solaudit ./examples
 ```
 
 ```
-SolAudit v0.2.0 — static analysis for Anchor/Solana programs
+SolAudit v0.3.0 — static analysis for Anchor/Solana programs
 Scanned 1 file(s) at 2026-08-27T06:00:00.000Z
 ──────────────────────────────────────────────────────────────────────
 
@@ -103,21 +104,23 @@ bun run dev
 | `SOL-007` | MEDIUM | Insecure Account Initialization | `#[account(init, ...)]` constraints missing `payer` and/or `space` |
 | `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo` fields used without a nearby `.owner` comparison |
 | `SOL-009` | HIGH | Insecure Manual Account Closure | An account's lamports manually drained to zero without discriminator zeroing or owner reassignment (unlike Anchor's `close = destination`), enabling closed-account revival |
+| `SOL-010` | MEDIUM | Reinitialization Risk via init_if_needed | `#[account(init_if_needed, ...)]` without canonical PDA seeds / `has_one` constraints, letting a pre-existing attacker-crafted account pass as freshly initialized |
 | `SOL-011` | MEDIUM | Missing Rent-Exemption Check | A partial lamport withdrawal with no nearby `Rent::get()?.minimum_balance(...)` check, risking runtime garbage-collection of the account |
 
 Each rule is implemented as real regex/line-scanning logic in [`packages/core/src/rules/index.ts`](./packages/core/src/rules/index.ts) — see that file (and its accompanying [tests](./packages/core/src/rules/index.test.ts)) for the exact matching heuristics and false-positive guards.
 
 ## Accuracy
 
-On the committed labeled suite in [`benchmark/`](./benchmark), the deterministic engine scores **93.8% precision, 100% recall, 96.8% F1** on rule-covered categories.
+On the committed labeled suite in [`benchmark/`](./benchmark), the deterministic engine scores **94.1% precision, 100% recall, 97.0% F1** on rule-covered categories.
 
-One known gap remains: **duplicate mutable accounts**. A regex “distinctness” heuristic produced false positives on common legitimate patterns (for example a deposit instruction’s user/vault token accounts of the same type), so that rule was not shipped. These numbers describe this suite, not general security effectiveness.
+**Duplicate mutable accounts** is covered by the experimental `SOL-012` rule, available via `solaudit --experimental`. A “distinctness” heuristic false-positives on common legitimate patterns (for example a deposit instruction’s user/vault token accounts of the same type with no explicit `!=` constraint), so it stays opt-in to protect the default ruleset's precision. These numbers describe this suite, not general security effectiveness.
 
 ## Output formats (CLI)
 
 - **Human** (default) — colorized terminal report grouped by severity.
 - **JSON** (`--json`) — the full `ScanResult` object (`scannedFiles`, `findings[]`, `summary`).
 - **SARIF** (`--sarif`) — [SARIF 2.1.0](https://sarifweb.azurewebsites.net/) output compatible with GitHub Code Scanning.
+- **Experimental rules** (`--experimental`) — opt into noisier, higher-signal heuristics (currently `SOL-012` Duplicate Mutable Accounts). Recommended for deep manual reviews rather than CI gates.
 
 ## GitHub Actions
 
@@ -179,6 +182,10 @@ Contributions are very welcome — new rules, false-positive fixes, additional o
 
 Please open an issue first for larger changes so we can discuss the approach.
 
+## Support
+
+SolAudit is free and open source, and development continues with or without tips. If it catches a bug or saves you real time and you'd like to say thanks, tips are appreciated — never expected: [flipcash.com/d142ad60-e966-4967-bfa3-6d2332e59342](https://flipcash.com/d142ad60-e966-4967-bfa3-6d2332e59342)
+
 ## License
 
 [MIT](./LICENSE) © 2026 Cody Pack

package/dist/cli.js

@@ -243,6 +243,81 @@ var insecureAccountClosure = {
     return findings;
   }
 };
+var initIfNeededReinit = {
+  id: "SOL-010",
+  name: "Reinitialization Risk via init_if_needed",
+  severity: "MEDIUM",
+  description: "`#[account(init_if_needed, ...)]` initializes the account only when it does not already exist, so a pre-existing account flows through the same validation path. Without canonical PDA seeds/bump and constraints binding the account to expected state, this pattern has enabled reinitialization attacks where an attacker crafts or front-runs account state. Anchor's own documentation recommends avoiding `init_if_needed` unless strictly necessary.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const blockRegex = /#\[account\(([\s\S]*?)\)\]/g;
+    let match;
+    while ((match = blockRegex.exec(fileContent)) !== null) {
+      const block = match[1];
+      if (!/\binit_if_needed\b/.test(block))
+        continue;
+      const line = fileContent.slice(0, match.index).split(/\r\n|\r|\n/).length;
+      findings.push(makeFinding(initIfNeededReinit, filePath, line, `#[account(${block.trim()})]`, "Prefer `init` plus a separate existence check. If `init_if_needed` is unavoidable, make the account a PDA with canonical `seeds`/`bump` and add `has_one`/`constraint` bindings so a pre-existing attacker-controlled account cannot pass validation."));
+    }
+    return findings;
+  }
+};
+var duplicateMutableAccounts = {
+  id: "SOL-012",
+  name: "Duplicate Mutable Accounts (experimental)",
+  severity: "HIGH",
+  description: "Two or more mutable accounts of the same type in one instruction with no `constraint = a.key() != b.key()` forcing distinctness. If the surrounding logic assumes the accounts are different (e.g. reading one balance and writing the other, or debiting one and crediting the other), passing the same account twice can corrupt accounting. Add an explicit inequality constraint or restructure the instruction.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const structStart = /#\[derive\(\s*Accounts\s*\)\][\s\S]*?pub struct\s+\w+[^\{]*\{/g;
+    let sm;
+    while ((sm = structStart.exec(fileContent)) !== null) {
+      let depth = 1;
+      let i = sm.index + sm[0].length;
+      while (i < fileContent.length && depth > 0) {
+        if (fileContent[i] === "{")
+          depth++;
+        else if (fileContent[i] === "}")
+          depth--;
+        i++;
+      }
+      const body = fileContent.slice(sm.index, i);
+      const bodyNoComments = stripLineComments(body);
+      const fields = [];
+      const fieldRegex = /((?:#\[[\s\S]*?\]\s*)*)pub\s+(\w+)\s*:\s*([\w:]+)\s*<\s*'info\s*(?:,\s*([\w:]+)\s*)?>/g;
+      let fm;
+      while ((fm = fieldRegex.exec(body)) !== null) {
+        const attrs = fm[1] || "";
+        const isMut = /#\[account\([\s\S]*?\bmut\b[\s\S]*?\)\]/.test(attrs);
+        const typeName = fm[4] || fm[3];
+        fields.push({ name: fm[2], typeName, isMut, offset: sm.index + fm.index });
+      }
+      const mutByType = new Map;
+      for (const f of fields) {
+        if (!f.isMut)
+          continue;
+        const group = mutByType.get(f.typeName) || [];
+        group.push(f);
+        mutByType.set(f.typeName, group);
+      }
+      for (const group of mutByType.values()) {
+        if (group.length < 2)
+          continue;
+        const first = group[0];
+        for (let g = 1;g < group.length; g++) {
+          const other = group[g];
+          const distinct = new RegExp(`${first.name}\\.key\\(\\)\\s*!=\\s*${other.name}\\.key\\(\\)|` + `${other.name}\\.key\\(\\)\\s*!=\\s*${first.name}\\.key\\(\\)`);
+          if (distinct.test(bodyNoComments))
+            continue;
+          const line = fileContent.slice(0, other.offset).split(/\r\n|\r|\n/).length;
+          findings.push(makeFinding(duplicateMutableAccounts, filePath, line, lines[line - 1] || other.name, `Fields \`${first.name}\` and \`${other.name}\` are both mutable \`${other.typeName}\` accounts with no distinctness constraint. Add \`constraint = ${other.name}.key() != ${first.name}.key()\` (if the instruction requires them to differ) or document why aliasing is safe.`));
+        }
+      }
+    }
+    return findings;
+  }
+};
 var missingRentExemptCheck = {
   id: "SOL-011",
   name: "Missing Rent-Exemption Check on Partial Withdrawal",
@@ -279,8 +354,10 @@ var rules = [
   insecureInit,
   missingOwnerCheck,
   insecureAccountClosure,
+  initIfNeededReinit,
   missingRentExemptCheck
 ];
+var experimentalRules = [duplicateMutableAccounts];
 // ../packages/core/src/scanner.ts
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -398,7 +475,7 @@ function badge(severity) {
 var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 function printReport(result) {
   const timestamp = new Date().toISOString();
-  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.2.0 — static analysis for Anchor/Solana programs${RESET}`);
+  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.0 — static analysis for Anchor/Solana programs${RESET}`);
   console.log(`${DIM}Scanned ${result.scannedFiles} file(s) at ${timestamp}${RESET}`);
   console.log(`${GRAY}${"─".repeat(70)}${RESET}`);
   if (result.findings.length === 0) {
@@ -433,7 +510,7 @@ function printReport(result) {
 }
 // ../packages/core/src/output/sarif.ts
 var SARIF_VERSION = "2.1.0";
-var TOOL_VERSION = "0.2.0";
+var TOOL_VERSION = "0.3.0";
 function severityToSarifLevel(severity) {
   switch (severity) {
     case "CRITICAL":
@@ -510,6 +587,8 @@ Options:
   --sarif                 Print scan results as SARIF 2.1.0 JSON (for GitHub code scanning)
   --min-severity <level>  Only report findings at or above this severity
                           (CRITICAL | HIGH | MEDIUM | LOW | INFO)
+  --experimental          Also run experimental rules (e.g. SOL-012 duplicate
+                          mutable accounts). Higher signal, more false positives.
   --help                  Show this help message
 
 Examples:
@@ -530,6 +609,7 @@ async function main() {
   }
   const wantsJson = args.includes("--json");
   const wantsSarif = args.includes("--sarif");
+  const wantsExperimental = args.includes("--experimental");
   let minSeverity = "INFO";
   const minSeverityIdx = args.indexOf("--min-severity");
   if (minSeverityIdx !== -1) {
@@ -549,7 +629,8 @@ async function main() {
     return true;
   });
   const targetPath = positional[0] || ".";
-  const result = await scanDirectory(targetPath, rules);
+  const activeRules = wantsExperimental ? [...rules, ...experimentalRules] : rules;
+  const result = await scanDirectory(targetPath, activeRules);
   result.findings = result.findings.filter((finding) => SEVERITY_RANK[finding.severity] <= SEVERITY_RANK[minSeverity]);
   if (wantsSarif) {
     console.log(JSON.stringify(toSarif(result), null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solaudit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Open-source static analysis CLI for Anchor/Solana programs",
   "type": "module",
   "bin": {