solaudit 0.2.0 → 0.3.1

package/README.md

@@ -1,7 +1,7 @@
 # SolAudit
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
-[![npm version](https://img.shields.io/badge/npm-v0.2.0-blue.svg)](https://www.npmjs.com/package/solaudit)
+[![npm version](https://img.shields.io/badge/npm-v0.3.0-blue.svg)](https://www.npmjs.com/package/solaudit)
 [![build](https://img.shields.io/badge/build-passing-brightgreen.svg)](./.github/workflows/ci.yml)
 
 **A zero-dependency static-analysis engine that scans Anchor/Solana Rust programs for the vulnerability patterns behind the most common on-chain exploits — available as a CLI and as a free web app.**
@@ -44,6 +44,8 @@ solaudit [path] [options]
 | `--json` | Print raw scan results as JSON |
 | `--sarif` | Print results as SARIF 2.1.0 (for GitHub Code Scanning) |
 | `--min-severity <level>` | Only report findings at or above `CRITICAL`\|`HIGH`\|`MEDIUM`\|`LOW`\|`INFO` |
+| `--experimental` | Also run opt-in experimental rules (`SOL-012` Duplicate Mutable Accounts, `SOL-013` Token Account Not Bound to Mint); higher signal, more false positives |
+| `--include-tests` | Also scan test/fuzz/fixture/example code (skipped by default; findings there are rarely actionable) |
 | `--help` | Show usage |
 
 ### Example
@@ -53,7 +55,7 @@ $ solaudit ./examples
 ```
 
 ```
-SolAudit v0.2.0 — static analysis for Anchor/Solana programs
+SolAudit v0.3.1 — static analysis for Anchor/Solana programs
 Scanned 1 file(s) at 2026-08-27T06:00:00.000Z
 ──────────────────────────────────────────────────────────────────────
 
@@ -94,30 +96,42 @@ bun run dev
 
 | ID | Severity | Name | What it catches |
 |---|---|---|---|
-| `SOL-001` | CRITICAL | Missing Signer Check | `transfer`/`mint_to` calls made without a nearby `Signer<'info>` type or `.is_signer` check |
-| `SOL-002` | HIGH | Unchecked Account Deserialization | `Account::try_from` / `AccountLoader::try_from` used without a validating `#[account(...)]` constraint |
+| `SOL-001` | CRITICAL | Missing Signer Check | `transfer`/`mint_to` calls with no signer evidence anywhere: no nearby `is_signer` check, no `Signer<'info>` field on the governing Accounts struct, and no PDA signing (`invoke_signed` / `new_with_signer`) |
+| `SOL-002` | HIGH | Unchecked Account Deserialization | `Account::try_from` / `AccountLoader::try_from` on an account with no validating `#[account(...)]` constraint (constraint-aware: fields carrying `owner`/`constraint`/`has_one` bindings are recognized as validated) |
 | `SOL-003` | HIGH | Arbitrary CPI | `invoke`/`invoke_signed` targeting a program ID sourced from a caller-supplied account instead of a verified constant |
-| `SOL-004` | HIGH | Missing Bump Seed Canonicalization | `create_program_address` used directly, or `find_program_address`'s bump discarded instead of stored/validated |
-| `SOL-005` | MEDIUM | Integer Overflow Risk | Raw `+`/`-`/`*` arithmetic on balance-like fields instead of `checked_*`/`saturating_*` |
+| `SOL-004` | HIGH | Missing Bump Seed Canonicalization | `create_program_address` called directly with a bump that didn't come from a nearby `find_program_address` (which is canonical by construction) |
+| `SOL-005` | MEDIUM | Integer Overflow Risk | Raw `+`/`-`/`*` arithmetic *written into account state* (field/compound assignment) on balance-like values instead of `checked_*`/`saturating_*` |
 | `SOL-006` | HIGH | Type Cosplay / Missing Discriminator Check | Manual `try_from_slice` deserialization with no discriminator validation or `Account<'info, T>` wrapper |
 | `SOL-007` | MEDIUM | Insecure Account Initialization | `#[account(init, ...)]` constraints missing `payer` and/or `space` |
-| `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo` fields used without a nearby `.owner` comparison |
+| `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo`/`UncheckedAccount` fields with no constraint binding whose data is trusted (deserialized/read) or whose key is assigned into persistent state, with no `.owner` check anywhere in the file |
 | `SOL-009` | HIGH | Insecure Manual Account Closure | An account's lamports manually drained to zero without discriminator zeroing or owner reassignment (unlike Anchor's `close = destination`), enabling closed-account revival |
+| `SOL-010` | MEDIUM | Reinitialization Risk via init_if_needed | `#[account(init_if_needed, ...)]` without canonical PDA seeds / `has_one` constraints, letting a pre-existing attacker-crafted account pass as freshly initialized |
 | `SOL-011` | MEDIUM | Missing Rent-Exemption Check | A partial lamport withdrawal with no nearby `Rent::get()?.minimum_balance(...)` check, risking runtime garbage-collection of the account |
 
 Each rule is implemented as real regex/line-scanning logic in [`packages/core/src/rules/index.ts`](./packages/core/src/rules/index.ts) — see that file (and its accompanying [tests](./packages/core/src/rules/index.test.ts)) for the exact matching heuristics and false-positive guards.
 
 ## Accuracy
 
-On the committed labeled suite in [`benchmark/`](./benchmark), the deterministic engine scores **93.8% precision, 100% recall, 96.8% F1** on rule-covered categories.
+On the committed labeled suite in [`benchmark/`](./benchmark), the deterministic engine scores **100% precision, 100% recall, 100% F1** on rule-covered categories.
 
-One known gap remains: **duplicate mutable accounts**. A regex “distinctness” heuristic produced false positives on common legitimate patterns (for example a deposit instruction’s user/vault token accounts of the same type), so that rule was not shipped. These numbers describe this suite, not general security effectiveness.
+### Real-world validation (0.3.1)
+
+0.3.0 was scanned against 9 major open-source protocols (marginfi, Drift, Orca Whirlpools, Marinade, Squads, Phoenix, Clockwork, Saber, and Cashio — the real $50M exploit, as a control). The result drove a rewrite of how the engine reads Anchor code: it now parses `#[derive(Accounts)]` structs and understands the constraint layer (`Signer`, `owner`/`has_one`/`constraint`/`seeds`, handler `Context<T>` mapping, `#[cfg(test)]` exclusion), instead of pattern-matching handler bodies alone.
+
+- **Default findings across the 9 repos dropped from 1,232 to 158 (−87%)** — marginfi went from 521 findings to 20; Drift from 454 to 77.
+- The remaining findings are *more* actionable, not fewer ideas: suppressions only happen on positive evidence of validation.
+- Under `--experimental`, the new `SOL-013` rule fires on Cashio's actual vulnerable pattern — a token account whose mint is never bound despite a mint account being in scope (the class behind the infinite-mint exploit).
+
+Benchmark label integrity note: three samples' labels were revised in 0.3.1 to match SOL-008's sharpened definition (raw accounts whose *data* is trusted or whose key is *assigned into state*); each revision is documented inline in [`benchmark/labels.json`](./benchmark/labels.json).
+
+**Duplicate mutable accounts** and **token accounts unbound to their mint** (the Cashio class) are covered by the experimental `SOL-012` and `SOL-013` rules, available via `solaudit --experimental`. A “distinctness” heuristic false-positives on common legitimate patterns (for example a deposit instruction’s user/vault token accounts of the same type with no explicit `!=` constraint), so it stays opt-in to protect the default ruleset's precision. These numbers describe this suite, not general security effectiveness.
 
 ## Output formats (CLI)
 
 - **Human** (default) — colorized terminal report grouped by severity.
 - **JSON** (`--json`) — the full `ScanResult` object (`scannedFiles`, `findings[]`, `summary`).
 - **SARIF** (`--sarif`) — [SARIF 2.1.0](https://sarifweb.azurewebsites.net/) output compatible with GitHub Code Scanning.
+- **Experimental rules** (`--experimental`) — opt into noisier, higher-signal heuristics (`SOL-012` Duplicate Mutable Accounts, `SOL-013` Token Account Not Bound to Mint). Recommended for deep manual reviews rather than CI gates.
 
 ## GitHub Actions
 
@@ -179,6 +193,10 @@ Contributions are very welcome — new rules, false-positive fixes, additional o
 
 Please open an issue first for larger changes so we can discuss the approach.
 
+## Support
+
+SolAudit is free and open source, and development continues with or without tips. If it catches a bug or saves you real time and you'd like to say thanks, tips are appreciated — never expected: [flipcash.com/d142ad60-e966-4967-bfa3-6d2332e59342](https://flipcash.com/d142ad60-e966-4967-bfa3-6d2332e59342)
+
 ## License
 
 [MIT](./LICENSE) © 2026 Cody Pack

package/dist/cli.js

@@ -1,5 +1,222 @@
 #!/usr/bin/env node
 
+// ../packages/core/src/anchor.ts
+function stripComments(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, "").split(/\r\n|\r|\n/).map((line) => line.replace(/\/\/.*$/, "")).join(`
+`);
+}
+function stripStringLiterals(line) {
+  return line.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+}
+function matchBraces(content, openIdx) {
+  let depth = 0;
+  let i = openIdx;
+  let inLineComment = false;
+  let inBlockComment = false;
+  let inString = false;
+  let inChar = false;
+  while (i < content.length) {
+    const c = content[i];
+    const next = i + 1 < content.length ? content[i + 1] : "";
+    if (inLineComment) {
+      if (c === `
+`)
+        inLineComment = false;
+    } else if (inBlockComment) {
+      if (c === "*" && next === "/") {
+        inBlockComment = false;
+        i++;
+      }
+    } else if (inString) {
+      if (c === "\\")
+        i++;
+      else if (c === '"')
+        inString = false;
+    } else if (inChar) {
+      if (c === "\\")
+        i++;
+      else if (c === "'")
+        inChar = false;
+    } else if (c === "/" && next === "/") {
+      inLineComment = true;
+      i++;
+    } else if (c === "/" && next === "*") {
+      inBlockComment = true;
+      i++;
+    } else if (c === '"') {
+      inString = true;
+    } else if (c === "'" && /[a-zA-Z0-9_]/.test(next) && content[i + 2] === "'") {
+      inChar = true;
+    } else if (c === "{") {
+      depth++;
+    } else if (c === "}") {
+      depth--;
+      if (depth === 0)
+        return i + 1;
+    }
+    i++;
+  }
+  return content.length;
+}
+var RAW_WRAPPERS = new Set(["AccountInfo", "UncheckedAccount"]);
+function parseFields(structBody, structBodyOffset, content) {
+  const fields = [];
+  const fieldRe = /((?:\s*(?:#\[[\s\S]*?\]|\/\/[^\n]*))*)\s*pub\s+(\w+)\s*:\s*((?:Box\s*<\s*)*)([\w:]+)\s*<\s*'info\s*(?:,\s*([\w:]+)\s*)?>[\s>]*/g;
+  let m;
+  while ((m = fieldRe.exec(structBody)) !== null) {
+    const attrs = stripComments(m[1] || "");
+    const name = m[2];
+    const wrapperType = m[4];
+    const genericArg = m[5] || null;
+    const offset = structBodyOffset + m.index;
+    const line = content.slice(0, offset).split(/\r\n|\r|\n/).length;
+    fields.push({
+      name,
+      wrapperType,
+      genericArg,
+      attrs,
+      isRaw: RAW_WRAPPERS.has(wrapperType),
+      isSignerTyped: wrapperType === "Signer" || /#\s*\[\s*account\(\s*signer\s*\)\s*\]/.test(attrs),
+      isTokenAccount: genericArg === "TokenAccount",
+      isMint: genericArg === "Mint",
+      validated: /\b(owner|constraint|has_one|address|seeds)\s*=/.test(attrs),
+      bindsTokenMint: /\b(?:token|associated_token)::mint\b/.test(attrs),
+      hasInit: /\binit(_if_needed)?\b/.test(attrs),
+      line
+    });
+  }
+  return fields;
+}
+function parseStructs(content) {
+  const structs = [];
+  const deriveRe = /#\s*\[\s*derive\(\s*Accounts(?:\s*,\s*[\w:]+)*\s*\)\s*\]/g;
+  let m;
+  while ((m = deriveRe.exec(content)) !== null) {
+    const afterIdx = m.index + m[0].length;
+    const structRe = /pub\s+struct\s+(\w+)[^{]*\{/g;
+    structRe.lastIndex = afterIdx;
+    const sm = structRe.exec(content);
+    if (!sm || sm.index - afterIdx > 400)
+      continue;
+    const openBrace = sm.index + sm[0].length - 1;
+    const end = matchBraces(content, openBrace);
+    const body = content.slice(openBrace + 1, end - 1);
+    structs.push({
+      name: sm[1],
+      start: m.index,
+      end,
+      fields: parseFields(body, openBrace + 1, content)
+    });
+  }
+  return structs;
+}
+function parseRegions(content) {
+  const regions = [];
+  const implRe = /\bimpl(?:\s*<[^>]*>)?\s+(\w+)(?:\s*<[^>]*>)?(?:\s+for\s+\w+(?:\s*<[^>]*>)?)?\s*\{/g;
+  let im;
+  while ((im = implRe.exec(content)) !== null) {
+    const forMatch = im[0].match(/\bfor\s+(\w+)/);
+    const implType = forMatch ? forMatch[1] : im[1];
+    const openBrace = im.index + im[0].length - 1;
+    const end = matchBraces(content, openBrace);
+    regions.push({ start: im.index, end, contextType: null, implType });
+  }
+  const fnRe = /\bfn\s+\w+\s*(?:<[^>]*>)?\s*\(\s*(?:mut\s+)?ctx\s*:\s*Context\s*<\s*(?:(?:'\w+|'_)\s*,\s*)*(\w+)(?:\s*<[^>]*>)?\s*[,>]/g;
+  let fm;
+  while ((fm = fnRe.exec(content)) !== null) {
+    let i = fm.index + fm[0].length;
+    let parenDepth = 0;
+    parenDepth = 1;
+    while (i < content.length && parenDepth > 0) {
+      if (content[i] === "(")
+        parenDepth++;
+      else if (content[i] === ")")
+        parenDepth--;
+      i++;
+    }
+    while (i < content.length && content[i] !== "{") {
+      if (content[i] === ";")
+        break;
+      i++;
+    }
+    if (i >= content.length || content[i] !== "{")
+      continue;
+    const end = matchBraces(content, i);
+    regions.push({ start: fm.index, end, contextType: fm[1], implType: null });
+  }
+  return regions;
+}
+function parseTestRanges(content) {
+  const ranges = [];
+  const re = /#\s*\[\s*cfg\(\s*test\s*\)\s*\]/g;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const braceIdx = content.indexOf("{", m.index + m[0].length);
+    if (braceIdx === -1)
+      continue;
+    ranges.push([m.index, matchBraces(content, braceIdx)]);
+  }
+  return ranges;
+}
+function buildModel(content) {
+  return {
+    structs: parseStructs(content),
+    regions: parseRegions(content),
+    testRanges: parseTestRanges(content)
+  };
+}
+var cached = null;
+function getConstraintModel(content) {
+  if (cached && cached.content === content)
+    return cached.model;
+  const model = buildModel(content);
+  cached = { content, model };
+  return model;
+}
+function inRanges(offset, ranges) {
+  return ranges.some(([s, e]) => offset >= s && offset < e);
+}
+function innermostRegionAt(model, offset) {
+  let best = null;
+  for (const r of model.regions) {
+    if (offset >= r.start && offset < r.end) {
+      if (!best || r.end - r.start < best.end - best.start)
+        best = r;
+    }
+  }
+  return best;
+}
+function structAt(model, offset) {
+  const region = innermostRegionAt(model, offset);
+  if (!region)
+    return null;
+  const name = region.contextType ?? region.implType;
+  if (!name)
+    return null;
+  return model.structs.find((s) => s.name === name) ?? null;
+}
+function findField(model, name) {
+  for (const s of model.structs) {
+    const f = s.fields.find((f) => f.name === name);
+    if (f)
+      return f;
+  }
+  return null;
+}
+function lineOffset(lines, idx) {
+  let off = 0;
+  for (let i = 0;i < idx && i < lines.length; i++)
+    off += lines[i].length + 1;
+  return off;
+}
+function isTestLikePath(filePath) {
+  const p = filePath.replace(/\\/g, "/");
+  if (/(^|\/)(tests?|test[-_]utils?|testing|fuzz|fixtures?|benches|benchmarks|examples?)(\/|$)/i.test(p))
+    return true;
+  const base = (p.split("/").pop() || "").toLowerCase();
+  return /^(tests|e2e)\.rs$/.test(base) || /^test_.*\.rs$/.test(base) || /(_tests?|_e2e)\.rs$/.test(base);
+}
+
 // ../packages/core/src/rules/index.ts
 function makeFinding(rule, filePath, line, snippet, description) {
   return {
@@ -23,23 +240,51 @@ var missingSignerCheck = {
   id: "SOL-001",
   name: "Missing Signer Check",
   severity: "CRITICAL",
-  description: "A transfer or mint_to call was found without an is_signer / Signer<'info> check within the preceding 10 lines. Add a `Signer<'info>` account type or an explicit `require!(ctx.accounts.authority.is_signer, ...)` check before authorizing fund movement.",
+  description: "A transfer or mint_to call was found with no signer evidence: no is_signer check nearby, no Signer<'info> field on the governing Accounts struct, and no PDA signing (invoke_signed / new_with_signer). Add a `Signer<'info>` account type or an explicit `require!(ctx.accounts.authority.is_signer, ...)` check before authorizing fund movement.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const callPattern = /\b(transfer|mint_to)\s*\(/;
-    lines.forEach((line, idx) => {
+    const callPattern = /\b(?:transfer|mint_to|transfer_checked|mint_to_checked)\s*\(/;
+    const declPattern = /\bfn\s+(?:transfer|mint_to|transfer_checked|mint_to_checked)\s*\(/;
+    const model = getConstraintModel(fileContent);
+    lines.forEach((rawLine, idx) => {
+      if (declPattern.test(rawLine))
+        return;
+      const line = stripStringLiterals(rawLine);
       if (!callPattern.test(line))
         return;
       if (!line.includes("ctx.accounts.") && !fileContent.includes("ctx.accounts."))
         return;
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
       const windowStart = Math.max(0, idx - 10);
       const window = lines.slice(windowStart, idx + 1).join(`
 `);
       const hasSignerEvidence = /is_signer/.test(window) || /Signer<\s*'info\s*>/.test(window) || /#\[account\([^)]*signer[^)]*\)\]/i.test(window);
-      if (!hasSignerEvidence) {
-        findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, line, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
+      if (hasSignerEvidence)
+        return;
+      const extWindow = lines.slice(windowStart, Math.min(lines.length, idx + 16)).join(`
+`);
+      if (/\binvoke_signed\b/.test(extWindow))
+        return;
+      if (/\bnew_with_signer\b/.test(extWindow))
+        return;
+      if (/system_instruction::transfer/.test(line) && /\binvoke(?:_signed)?\s*\(/.test(extWindow)) {
+        return;
+      }
+      if (!line.includes("::")) {
+        const beforeMatch = line.slice(0, line.search(callPattern));
+        if (/\binvoke(?:_signed)?\s*\([^)]*$/.test(beforeMatch))
+          return;
+        const prevLines = lines.slice(Math.max(0, idx - 3), idx);
+        if (prevLines.some((l) => /\binvoke(?:_signed)?\s*\([^)]*$/.test(l)))
+          return;
       }
+      const struct = structAt(model, offset);
+      if (struct && struct.fields.some((f) => f.isSignerTyped))
+        return;
+      findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, rawLine, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
     });
     return findings;
   }
@@ -53,14 +298,25 @@ var uncheckedDeserialization = {
     const findings = [];
     const lines = splitLines(fileContent);
     const pattern = /(Account|AccountLoader)::try_from\s*\(/;
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
       if (!pattern.test(line))
         return;
-      const prevLine = idx > 0 ? lines[idx - 1] : "";
-      const hasConstraint = /#\[account\(/.test(prevLine) || /#\[account\(/.test(line);
-      if (!hasConstraint) {
-        findings.push(makeFinding(uncheckedDeserialization, filePath, idx + 1, line, "Add a `#[account(constraint = ..., owner = ...)]` attribute, or replace with a typed `Account<'info, T>` field so Anchor validates ownership and discriminator automatically."));
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const windowStart = Math.max(0, idx - 3);
+      const window = lines.slice(windowStart, idx + 1).join(`
+`);
+      if (/#\[account\(/.test(window))
+        return;
+      const argMatch = line.match(/::try_from\s*\(\s*&?\s*(?:ctx\.accounts\.|self\.)?(\w+)/);
+      if (argMatch) {
+        const field = findField(model, argMatch[1]);
+        if (field && field.validated)
+          return;
       }
+      findings.push(makeFinding(uncheckedDeserialization, filePath, idx + 1, line, "Add a `#[account(constraint = ..., owner = ...)]` attribute, or replace with a typed `Account<'info, T>` field so Anchor validates ownership and discriminator automatically."));
     });
     return findings;
   }
@@ -93,23 +349,24 @@ var missingBumpCanonicalization = {
   id: "SOL-004",
   name: "Missing Bump Seed Canonicalization",
   severity: "HIGH",
-  description: "PDA bump seeds must be derived via `find_program_address` and the canonical bump stored/validated on-chain. Calling `create_program_address` directly, or discarding the bump returned by `find_program_address`, allows bump-seed forgery attacks.",
+  description: "PDA bump seeds must be derived via `find_program_address` (which returns the canonical bump by construction) and stored/validated on-chain. Calling `create_program_address` directly with a caller-supplied bump allows bump-seed forgery attacks.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
-      if (/create_program_address\s*\(/.test(line) && !/find_program_address/.test(line)) {
-        findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
+      if (!/create_program_address\s*\(/.test(line))
         return;
-      }
-      const fpaMatch = line.match(/let\s+(\([^)]*\)|\w+)\s*=\s*[\w:]*find_program_address\s*\(/);
-      if (fpaMatch) {
-        const binding = fpaMatch[1];
-        const bindsBump = /\(\s*\w+\s*,\s*\w+\s*\)/.test(binding);
-        if (!bindsBump) {
-          findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Destructure and store the bump returned by `find_program_address` (e.g. `let (pda, bump) = ...`) and persist/validate it instead of discarding it."));
-        }
-      }
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const windowStart = Math.max(0, idx - 10);
+      const windowEnd = Math.min(lines.length, idx + 3);
+      const window = stripLineComments(lines.slice(windowStart, windowEnd).join(`
+`));
+      if (/find_program_address/.test(window))
+        return;
+      findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
     });
     return findings;
   }
@@ -118,19 +375,29 @@ var integerOverflowRisk = {
   id: "SOL-005",
   name: "Integer Overflow Risk",
   severity: "MEDIUM",
-  description: "Raw arithmetic (`+`, `-`, `*`) was performed on u64/u128-typed values without using checked or saturating arithmetic. Unchecked overflow can wrap silently in release builds without `overflow-checks = true`, corrupting balances. Use `.checked_add`/`.checked_sub`/`.checked_mul` or `saturating_*` and handle the `None` case.",
+  description: "Raw arithmetic (`+`, `-`, `*`) was written into account state (a field assignment or compound assignment) on amount-like values without checked or saturating arithmetic. Unchecked overflow can wrap silently in release builds without `overflow-checks = true`, corrupting balances. Use `.checked_add`/`.checked_sub`/`.checked_mul` or `saturating_*` and handle the `None` case.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const arithmeticPattern = /\b(\w*(amount|balance|supply|total|shares|stake)\w*)\s*(\+|\-|\*)\s*\w/i;
+    if (isTestLikePath(filePath))
+      return findings;
+    const model = getConstraintModel(fileContent);
+    const arithmeticPattern = /\b(\w*(amount|balance|supply|total|shares|stake|reserve|collateral|liquidity|principal)\w*)\s*(\+|\-|\*)\s*\w/i;
     const alreadySafe = /checked_(add|sub|mul|div)|saturating_(add|sub|mul)|wrapping_(add|sub|mul)/;
+    const stateWritePattern = /^\s*(?:[\w.\[\]]+\.)[\w.\[\]]+\s*(?:=|\+=|-=|\*=)\s*[^=>]|\b\w+\s*(?:\+=|-=|\*=)\s*[^=]/;
     lines.forEach((line, idx) => {
       if (alreadySafe.test(line))
         return;
       if (line.trim().startsWith("//"))
         return;
-      if (arithmeticPattern.test(line)) {
-        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
+      if (/\d\.\d/.test(line))
+        return;
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const code = stripStringLiterals(line);
+      if (arithmeticPattern.test(code) && stateWritePattern.test(code)) {
+        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic written to state with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
       }
     });
     return findings;
@@ -174,10 +441,11 @@ var insecureInit = {
         continue;
       const hasPayer = /\bpayer\s*=/.test(block);
       const hasSpace = /\bspace\s*=/.test(block);
-      if (!hasPayer || !hasSpace) {
+      const isTokenInit = /\b(associated_token|token)::/.test(block);
+      if (!hasPayer || !hasSpace && !isTokenInit) {
         const upToMatch = fileContent.slice(0, match.index);
         const line = upToMatch.split(/\r\n|\r|\n/).length;
-        const missing = [!hasPayer && "payer", !hasSpace && "space"].filter(Boolean).join(" and ");
+        const missing = [!hasPayer && "payer", !hasSpace && !isTokenInit && "space"].filter(Boolean).join(" and ");
         findings.push(makeFinding(insecureInit, filePath, line, `#[account(${block.trim()})]`, `Add the missing \`${missing}\` argument(s) to this init constraint so Anchor allocates and rent-exempts the account correctly.`));
       }
     }
@@ -188,10 +456,62 @@ var missingOwnerCheck = {
   id: "SOL-008",
   name: "Missing Owner Check",
   severity: "LOW",
-  description: "A raw `AccountInfo` field is accessed via `ctx.accounts.` without a nearby `.owner` comparison. Raw `AccountInfo` accounts bypass Anchor's automatic ownership validation, so the program must manually verify `account.owner == expected_program_id` before trusting its data.",
+  description: "A raw `AccountInfo`/`UncheckedAccount` field carries no `owner`/`constraint`/`has_one` binding in its Accounts struct and no `.owner` comparison anywhere in the file. Raw accounts bypass Anchor's automatic ownership validation, so the program must manually verify `account.owner == expected_program_id` before trusting its data.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
+    if (model.structs.length > 0) {
+      const validatedNames = new Set;
+      for (const s of model.structs) {
+        for (const f of s.fields) {
+          if (f.validated)
+            validatedNames.add(f.name);
+        }
+      }
+      const suspects = new Map;
+      for (const s of model.structs) {
+        for (const f of s.fields) {
+          if (!f.isRaw || validatedNames.has(f.name))
+            continue;
+          if (new RegExp(`\\b${f.name}\\s*\\.owner\\b`).test(stripLineComments(fileContent))) {
+            continue;
+          }
+          if (!suspects.has(f.name))
+            suspects.set(f.name, f.line);
+        }
+      }
+      for (const [name, declLine] of suspects) {
+        const usagePattern = new RegExp(`ctx\\.accounts\\.${name}\\b`);
+        let reportLine = declLine;
+        let snippet = lines[declLine - 1] || name;
+        let touchesData = false;
+        for (let i = 0;i < lines.length; i++) {
+          if (!usagePattern.test(lines[i]) || i + 1 === declLine)
+            continue;
+          if (reportLine === declLine) {
+            reportLine = i + 1;
+            snippet = lines[i];
+          }
+          if (/try_borrow_data|\.load\s*\(|data\.borrow|try_from|\.lamports\s*\(|accessor::/.test(lines[i])) {
+            touchesData = true;
+            reportLine = i + 1;
+            snippet = lines[i];
+          }
+          if (new RegExp(`=\\s*(?:&)?ctx\\.accounts\\.${name}\\.key\\s*\\(`).test(lines[i]) && !/==|require_keys_eq/.test(lines[i])) {
+            touchesData = true;
+            reportLine = i + 1;
+            snippet = lines[i];
+          }
+        }
+        if (reportLine === declLine)
+          continue;
+        if (!touchesData)
+          continue;
+        findings.push(makeFinding(missingOwnerCheck, filePath, reportLine, snippet, `\`${name}\` is a raw AccountInfo with no constraint binding. Add an explicit \`require!(ctx.accounts.${name}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check (or an \`#[account(owner = ...)]\` constraint) before trusting its data.`));
+      }
+      return findings;
+    }
     const rawFieldPattern = /pub\s+(\w+)\s*:\s*AccountInfo<\s*'info\s*>/;
     const rawFields = new Set;
     lines.forEach((line) => {
@@ -201,8 +521,11 @@ var missingOwnerCheck = {
     });
     if (rawFields.size === 0)
       return findings;
+    const flagged = new Set;
     lines.forEach((line, idx) => {
       for (const field of rawFields) {
+        if (flagged.has(field))
+          continue;
         const usagePattern = new RegExp(`ctx\\.accounts\\.${field}\\b`);
         if (!usagePattern.test(line))
           continue;
@@ -212,6 +535,7 @@ var missingOwnerCheck = {
 `);
         const hasOwnerCheck = new RegExp(`${field}\\.owner`).test(window) || /\.owner\s*==/.test(window);
         if (!hasOwnerCheck) {
+          flagged.add(field);
           findings.push(makeFinding(missingOwnerCheck, filePath, idx + 1, line, `Add an explicit \`require!(ctx.accounts.${field}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check before using this raw AccountInfo.`));
         }
       }
@@ -243,6 +567,81 @@ var insecureAccountClosure = {
     return findings;
   }
 };
+var initIfNeededReinit = {
+  id: "SOL-010",
+  name: "Reinitialization Risk via init_if_needed",
+  severity: "MEDIUM",
+  description: "`#[account(init_if_needed, ...)]` initializes the account only when it does not already exist, so a pre-existing account flows through the same validation path. Without canonical PDA seeds/bump and constraints binding the account to expected state, this pattern has enabled reinitialization attacks where an attacker crafts or front-runs account state. Anchor's own documentation recommends avoiding `init_if_needed` unless strictly necessary.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const blockRegex = /#\[account\(([\s\S]*?)\)\]/g;
+    let match;
+    while ((match = blockRegex.exec(fileContent)) !== null) {
+      const block = match[1];
+      if (!/\binit_if_needed\b/.test(block))
+        continue;
+      const line = fileContent.slice(0, match.index).split(/\r\n|\r|\n/).length;
+      findings.push(makeFinding(initIfNeededReinit, filePath, line, `#[account(${block.trim()})]`, "Prefer `init` plus a separate existence check. If `init_if_needed` is unavoidable, make the account a PDA with canonical `seeds`/`bump` and add `has_one`/`constraint` bindings so a pre-existing attacker-controlled account cannot pass validation."));
+    }
+    return findings;
+  }
+};
+var duplicateMutableAccounts = {
+  id: "SOL-012",
+  name: "Duplicate Mutable Accounts (experimental)",
+  severity: "HIGH",
+  description: "Two or more mutable accounts of the same type in one instruction with no `constraint = a.key() != b.key()` forcing distinctness. If the surrounding logic assumes the accounts are different (e.g. reading one balance and writing the other, or debiting one and crediting the other), passing the same account twice can corrupt accounting. Add an explicit inequality constraint or restructure the instruction.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const structStart = /#\[derive\(\s*Accounts\s*\)\][\s\S]*?pub struct\s+\w+[^\{]*\{/g;
+    let sm;
+    while ((sm = structStart.exec(fileContent)) !== null) {
+      let depth = 1;
+      let i = sm.index + sm[0].length;
+      while (i < fileContent.length && depth > 0) {
+        if (fileContent[i] === "{")
+          depth++;
+        else if (fileContent[i] === "}")
+          depth--;
+        i++;
+      }
+      const body = fileContent.slice(sm.index, i);
+      const bodyNoComments = stripLineComments(body);
+      const fields = [];
+      const fieldRegex = /((?:#\[[\s\S]*?\]\s*)*)pub\s+(\w+)\s*:\s*([\w:]+)\s*<\s*'info\s*(?:,\s*([\w:]+)\s*)?>/g;
+      let fm;
+      while ((fm = fieldRegex.exec(body)) !== null) {
+        const attrs = fm[1] || "";
+        const isMut = /#\[account\([\s\S]*?\bmut\b[\s\S]*?\)\]/.test(attrs);
+        const typeName = fm[4] || fm[3];
+        fields.push({ name: fm[2], typeName, isMut, offset: sm.index + fm.index });
+      }
+      const mutByType = new Map;
+      for (const f of fields) {
+        if (!f.isMut)
+          continue;
+        const group = mutByType.get(f.typeName) || [];
+        group.push(f);
+        mutByType.set(f.typeName, group);
+      }
+      for (const group of mutByType.values()) {
+        if (group.length < 2)
+          continue;
+        const first = group[0];
+        for (let g = 1;g < group.length; g++) {
+          const other = group[g];
+          const distinct = new RegExp(`${first.name}\\.key\\(\\)\\s*!=\\s*${other.name}\\.key\\(\\)|` + `${other.name}\\.key\\(\\)\\s*!=\\s*${first.name}\\.key\\(\\)`);
+          if (distinct.test(bodyNoComments))
+            continue;
+          const line = fileContent.slice(0, other.offset).split(/\r\n|\r|\n/).length;
+          findings.push(makeFinding(duplicateMutableAccounts, filePath, line, lines[line - 1] || other.name, `Fields \`${first.name}\` and \`${other.name}\` are both mutable \`${other.typeName}\` accounts with no distinctness constraint. Add \`constraint = ${other.name}.key() != ${first.name}.key()\` (if the instruction requires them to differ) or document why aliasing is safe.`));
+        }
+      }
+    }
+    return findings;
+  }
+};
 var missingRentExemptCheck = {
   id: "SOL-011",
   name: "Missing Rent-Exemption Check on Partial Withdrawal",
@@ -269,6 +668,30 @@ var missingRentExemptCheck = {
     return findings;
   }
 };
+var unboundTokenMint = {
+  id: "SOL-013",
+  name: "Token Account Not Bound to Mint",
+  severity: "MEDIUM",
+  description: "A token-account field and a mint field coexist in the same Accounts struct, but the token account is never bound to the mint (`token::mint = ...`, `associated_token::mint = ...`, or a constraint/address pin). The instruction may accept a token account of an unintended mint — the vulnerability class behind the Cashio infinite-mint exploit. Bind the token account to the mint in the `#[account(...)]` constraint.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
+    for (const s of model.structs) {
+      const mintFields = s.fields.filter((f) => f.isMint);
+      if (mintFields.length === 0)
+        continue;
+      for (const f of s.fields) {
+        if (!f.isTokenAccount)
+          continue;
+        if (f.bindsTokenMint || f.hasInit || f.validated)
+          continue;
+        findings.push(makeFinding(unboundTokenMint, filePath, f.line, lines[f.line - 1] || f.name, `\`${f.name}\` is a TokenAccount but is never bound to a mint, although this instruction also takes a mint account (${mintFields.map((m) => `\`${m.name}\``).join(", ")}). Add \`token::mint = ${mintFields[0].name}\` (and usually \`token::authority\`) to the field's #[account(...)] constraint so a token account of an unintended mint is rejected.`));
+      }
+    }
+    return findings;
+  }
+};
 var rules = [
   missingSignerCheck,
   uncheckedDeserialization,
@@ -279,8 +702,10 @@ var rules = [
   insecureInit,
   missingOwnerCheck,
   insecureAccountClosure,
+  initIfNeededReinit,
   missingRentExemptCheck
 ];
+var experimentalRules = [duplicateMutableAccounts, unboundTokenMint];
 // ../packages/core/src/scanner.ts
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -300,16 +725,36 @@ function scanFile(filePath, rules) {
   const content = readFileSync(filePath, "utf8");
   return scanContent(content, filePath, rules);
 }
-function walk(dirPath, files = []) {
+var EXCLUDED_DIR_NAMES = new Set([
+  "tests",
+  "test",
+  "test-utils",
+  "test_utils",
+  "testing",
+  "fuzz",
+  "fixtures",
+  "fixture",
+  "benches",
+  "benchmarks",
+  "examples",
+  "example"
+]);
+function walk(dirPath, files = [], includeTests = false, rootPath) {
+  const root = rootPath ?? dirPath;
   const entries = readdirSync(dirPath);
   for (const entry of entries) {
     if (entry === "node_modules" || entry === "target" || entry === ".git")
       continue;
+    if (!includeTests && EXCLUDED_DIR_NAMES.has(entry.toLowerCase()))
+      continue;
     const fullPath = join(dirPath, entry);
     const stat = statSync(fullPath);
     if (stat.isDirectory()) {
-      walk(fullPath, files);
+      walk(fullPath, files, includeTests, root);
     } else if (stat.isFile() && fullPath.endsWith(".rs")) {
+      const rel = fullPath.slice(root.length).replace(/^[\/\\]/, "");
+      if (!includeTests && isTestLikePath(rel))
+        continue;
       files.push(fullPath);
     }
   }
@@ -357,9 +802,9 @@ function sortAndSummarize(rsFileCount, allFindings) {
     summary: tallySummary(allFindings)
   };
 }
-async function scanDirectory(targetPath, rules) {
+async function scanDirectory(targetPath, rules, opts = {}) {
   const stat = statSync(targetPath);
-  const rsFiles = stat.isDirectory() ? walk(targetPath) : targetPath.endsWith(".rs") ? [targetPath] : [];
+  const rsFiles = stat.isDirectory() ? walk(targetPath, [], opts.includeTests ?? false) : targetPath.endsWith(".rs") ? [targetPath] : [];
   const allFindings = [];
   for (const file of rsFiles) {
     allFindings.push(...scanFile(file, rules));
@@ -398,7 +843,7 @@ function badge(severity) {
 var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 function printReport(result) {
   const timestamp = new Date().toISOString();
-  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.2.0 — static analysis for Anchor/Solana programs${RESET}`);
+  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.1 — static analysis for Anchor/Solana programs${RESET}`);
   console.log(`${DIM}Scanned ${result.scannedFiles} file(s) at ${timestamp}${RESET}`);
   console.log(`${GRAY}${"─".repeat(70)}${RESET}`);
   if (result.findings.length === 0) {
@@ -433,7 +878,7 @@ function printReport(result) {
 }
 // ../packages/core/src/output/sarif.ts
 var SARIF_VERSION = "2.1.0";
-var TOOL_VERSION = "0.2.0";
+var TOOL_VERSION = "0.3.0";
 function severityToSarifLevel(severity) {
   switch (severity) {
     case "CRITICAL":
@@ -510,6 +955,10 @@ Options:
   --sarif                 Print scan results as SARIF 2.1.0 JSON (for GitHub code scanning)
   --min-severity <level>  Only report findings at or above this severity
                           (CRITICAL | HIGH | MEDIUM | LOW | INFO)
+  --experimental          Also run experimental rules (e.g. SOL-012 duplicate
+                          mutable accounts). Higher signal, more false positives.
+  --include-tests         Also scan test/fuzz/fixture/example code (skipped by
+                          default; findings there are rarely actionable)
   --help                  Show this help message
 
 Examples:
@@ -530,6 +979,8 @@ async function main() {
   }
   const wantsJson = args.includes("--json");
   const wantsSarif = args.includes("--sarif");
+  const wantsExperimental = args.includes("--experimental");
+  const includeTests = args.includes("--include-tests");
   let minSeverity = "INFO";
   const minSeverityIdx = args.indexOf("--min-severity");
   if (minSeverityIdx !== -1) {
@@ -549,7 +1000,8 @@ async function main() {
     return true;
   });
   const targetPath = positional[0] || ".";
-  const result = await scanDirectory(targetPath, rules);
+  const activeRules = wantsExperimental ? [...rules, ...experimentalRules] : rules;
+  const result = await scanDirectory(targetPath, activeRules, { includeTests });
   result.findings = result.findings.filter((finding) => SEVERITY_RANK[finding.severity] <= SEVERITY_RANK[minSeverity]);
   if (wantsSarif) {
     console.log(JSON.stringify(toSarif(result), null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solaudit",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Open-source static analysis CLI for Anchor/Solana programs",
   "type": "module",
   "bin": {