solaudit 0.3.0 → 0.3.1

package/README.md

@@ -44,7 +44,8 @@ solaudit [path] [options]
 | `--json` | Print raw scan results as JSON |
 | `--sarif` | Print results as SARIF 2.1.0 (for GitHub Code Scanning) |
 | `--min-severity <level>` | Only report findings at or above `CRITICAL`\|`HIGH`\|`MEDIUM`\|`LOW`\|`INFO` |
-| `--experimental` | Also run opt-in experimental rules (currently `SOL-012` Duplicate Mutable Accounts); higher signal, more false positives |
+| `--experimental` | Also run opt-in experimental rules (`SOL-012` Duplicate Mutable Accounts, `SOL-013` Token Account Not Bound to Mint); higher signal, more false positives |
+| `--include-tests` | Also scan test/fuzz/fixture/example code (skipped by default; findings there are rarely actionable) |
 | `--help` | Show usage |
 
 ### Example
@@ -54,7 +55,7 @@ $ solaudit ./examples
 ```
 
 ```
-SolAudit v0.3.0 — static analysis for Anchor/Solana programs
+SolAudit v0.3.1 — static analysis for Anchor/Solana programs
 Scanned 1 file(s) at 2026-08-27T06:00:00.000Z
 ──────────────────────────────────────────────────────────────────────
 
@@ -95,14 +96,14 @@ bun run dev
 
 | ID | Severity | Name | What it catches |
 |---|---|---|---|
-| `SOL-001` | CRITICAL | Missing Signer Check | `transfer`/`mint_to` calls made without a nearby `Signer<'info>` type or `.is_signer` check |
-| `SOL-002` | HIGH | Unchecked Account Deserialization | `Account::try_from` / `AccountLoader::try_from` used without a validating `#[account(...)]` constraint |
+| `SOL-001` | CRITICAL | Missing Signer Check | `transfer`/`mint_to` calls with no signer evidence anywhere: no nearby `is_signer` check, no `Signer<'info>` field on the governing Accounts struct, and no PDA signing (`invoke_signed` / `new_with_signer`) |
+| `SOL-002` | HIGH | Unchecked Account Deserialization | `Account::try_from` / `AccountLoader::try_from` on an account with no validating `#[account(...)]` constraint (constraint-aware: fields carrying `owner`/`constraint`/`has_one` bindings are recognized as validated) |
 | `SOL-003` | HIGH | Arbitrary CPI | `invoke`/`invoke_signed` targeting a program ID sourced from a caller-supplied account instead of a verified constant |
-| `SOL-004` | HIGH | Missing Bump Seed Canonicalization | `create_program_address` used directly, or `find_program_address`'s bump discarded instead of stored/validated |
-| `SOL-005` | MEDIUM | Integer Overflow Risk | Raw `+`/`-`/`*` arithmetic on balance-like fields instead of `checked_*`/`saturating_*` |
+| `SOL-004` | HIGH | Missing Bump Seed Canonicalization | `create_program_address` called directly with a bump that didn't come from a nearby `find_program_address` (which is canonical by construction) |
+| `SOL-005` | MEDIUM | Integer Overflow Risk | Raw `+`/`-`/`*` arithmetic *written into account state* (field/compound assignment) on balance-like values instead of `checked_*`/`saturating_*` |
 | `SOL-006` | HIGH | Type Cosplay / Missing Discriminator Check | Manual `try_from_slice` deserialization with no discriminator validation or `Account<'info, T>` wrapper |
 | `SOL-007` | MEDIUM | Insecure Account Initialization | `#[account(init, ...)]` constraints missing `payer` and/or `space` |
-| `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo` fields used without a nearby `.owner` comparison |
+| `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo`/`UncheckedAccount` fields with no constraint binding whose data is trusted (deserialized/read) or whose key is assigned into persistent state, with no `.owner` check anywhere in the file |
 | `SOL-009` | HIGH | Insecure Manual Account Closure | An account's lamports manually drained to zero without discriminator zeroing or owner reassignment (unlike Anchor's `close = destination`), enabling closed-account revival |
 | `SOL-010` | MEDIUM | Reinitialization Risk via init_if_needed | `#[account(init_if_needed, ...)]` without canonical PDA seeds / `has_one` constraints, letting a pre-existing attacker-crafted account pass as freshly initialized |
 | `SOL-011` | MEDIUM | Missing Rent-Exemption Check | A partial lamport withdrawal with no nearby `Rent::get()?.minimum_balance(...)` check, risking runtime garbage-collection of the account |
@@ -111,16 +112,26 @@ Each rule is implemented as real regex/line-scanning logic in [`packages/core/sr
 
 ## Accuracy
 
-On the committed labeled suite in [`benchmark/`](./benchmark), the deterministic engine scores **94.1% precision, 100% recall, 97.0% F1** on rule-covered categories.
+On the committed labeled suite in [`benchmark/`](./benchmark), the deterministic engine scores **100% precision, 100% recall, 100% F1** on rule-covered categories.
 
-**Duplicate mutable accounts** is covered by the experimental `SOL-012` rule, available via `solaudit --experimental`. A “distinctness” heuristic false-positives on common legitimate patterns (for example a deposit instruction’s user/vault token accounts of the same type with no explicit `!=` constraint), so it stays opt-in to protect the default ruleset's precision. These numbers describe this suite, not general security effectiveness.
+### Real-world validation (0.3.1)
+
+0.3.0 was scanned against 9 major open-source protocols (marginfi, Drift, Orca Whirlpools, Marinade, Squads, Phoenix, Clockwork, Saber, and Cashio — the real $50M exploit, as a control). The result drove a rewrite of how the engine reads Anchor code: it now parses `#[derive(Accounts)]` structs and understands the constraint layer (`Signer`, `owner`/`has_one`/`constraint`/`seeds`, handler `Context<T>` mapping, `#[cfg(test)]` exclusion), instead of pattern-matching handler bodies alone.
+
+- **Default findings across the 9 repos dropped from 1,232 to 158 (−87%)** — marginfi went from 521 findings to 20; Drift from 454 to 77.
+- The remaining findings are *more* actionable, not fewer ideas: suppressions only happen on positive evidence of validation.
+- Under `--experimental`, the new `SOL-013` rule fires on Cashio's actual vulnerable pattern — a token account whose mint is never bound despite a mint account being in scope (the class behind the infinite-mint exploit).
+
+Benchmark label integrity note: three samples' labels were revised in 0.3.1 to match SOL-008's sharpened definition (raw accounts whose *data* is trusted or whose key is *assigned into state*); each revision is documented inline in [`benchmark/labels.json`](./benchmark/labels.json).
+
+**Duplicate mutable accounts** and **token accounts unbound to their mint** (the Cashio class) are covered by the experimental `SOL-012` and `SOL-013` rules, available via `solaudit --experimental`. A “distinctness” heuristic false-positives on common legitimate patterns (for example a deposit instruction’s user/vault token accounts of the same type with no explicit `!=` constraint), so it stays opt-in to protect the default ruleset's precision. These numbers describe this suite, not general security effectiveness.
 
 ## Output formats (CLI)
 
 - **Human** (default) — colorized terminal report grouped by severity.
 - **JSON** (`--json`) — the full `ScanResult` object (`scannedFiles`, `findings[]`, `summary`).
 - **SARIF** (`--sarif`) — [SARIF 2.1.0](https://sarifweb.azurewebsites.net/) output compatible with GitHub Code Scanning.
-- **Experimental rules** (`--experimental`) — opt into noisier, higher-signal heuristics (currently `SOL-012` Duplicate Mutable Accounts). Recommended for deep manual reviews rather than CI gates.
+- **Experimental rules** (`--experimental`) — opt into noisier, higher-signal heuristics (`SOL-012` Duplicate Mutable Accounts, `SOL-013` Token Account Not Bound to Mint). Recommended for deep manual reviews rather than CI gates.
 
 ## GitHub Actions
 

package/dist/cli.js

@@ -1,5 +1,222 @@
 #!/usr/bin/env node
 
+// ../packages/core/src/anchor.ts
+function stripComments(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, "").split(/\r\n|\r|\n/).map((line) => line.replace(/\/\/.*$/, "")).join(`
+`);
+}
+function stripStringLiterals(line) {
+  return line.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+}
+function matchBraces(content, openIdx) {
+  let depth = 0;
+  let i = openIdx;
+  let inLineComment = false;
+  let inBlockComment = false;
+  let inString = false;
+  let inChar = false;
+  while (i < content.length) {
+    const c = content[i];
+    const next = i + 1 < content.length ? content[i + 1] : "";
+    if (inLineComment) {
+      if (c === `
+`)
+        inLineComment = false;
+    } else if (inBlockComment) {
+      if (c === "*" && next === "/") {
+        inBlockComment = false;
+        i++;
+      }
+    } else if (inString) {
+      if (c === "\\")
+        i++;
+      else if (c === '"')
+        inString = false;
+    } else if (inChar) {
+      if (c === "\\")
+        i++;
+      else if (c === "'")
+        inChar = false;
+    } else if (c === "/" && next === "/") {
+      inLineComment = true;
+      i++;
+    } else if (c === "/" && next === "*") {
+      inBlockComment = true;
+      i++;
+    } else if (c === '"') {
+      inString = true;
+    } else if (c === "'" && /[a-zA-Z0-9_]/.test(next) && content[i + 2] === "'") {
+      inChar = true;
+    } else if (c === "{") {
+      depth++;
+    } else if (c === "}") {
+      depth--;
+      if (depth === 0)
+        return i + 1;
+    }
+    i++;
+  }
+  return content.length;
+}
+var RAW_WRAPPERS = new Set(["AccountInfo", "UncheckedAccount"]);
+function parseFields(structBody, structBodyOffset, content) {
+  const fields = [];
+  const fieldRe = /((?:\s*(?:#\[[\s\S]*?\]|\/\/[^\n]*))*)\s*pub\s+(\w+)\s*:\s*((?:Box\s*<\s*)*)([\w:]+)\s*<\s*'info\s*(?:,\s*([\w:]+)\s*)?>[\s>]*/g;
+  let m;
+  while ((m = fieldRe.exec(structBody)) !== null) {
+    const attrs = stripComments(m[1] || "");
+    const name = m[2];
+    const wrapperType = m[4];
+    const genericArg = m[5] || null;
+    const offset = structBodyOffset + m.index;
+    const line = content.slice(0, offset).split(/\r\n|\r|\n/).length;
+    fields.push({
+      name,
+      wrapperType,
+      genericArg,
+      attrs,
+      isRaw: RAW_WRAPPERS.has(wrapperType),
+      isSignerTyped: wrapperType === "Signer" || /#\s*\[\s*account\(\s*signer\s*\)\s*\]/.test(attrs),
+      isTokenAccount: genericArg === "TokenAccount",
+      isMint: genericArg === "Mint",
+      validated: /\b(owner|constraint|has_one|address|seeds)\s*=/.test(attrs),
+      bindsTokenMint: /\b(?:token|associated_token)::mint\b/.test(attrs),
+      hasInit: /\binit(_if_needed)?\b/.test(attrs),
+      line
+    });
+  }
+  return fields;
+}
+function parseStructs(content) {
+  const structs = [];
+  const deriveRe = /#\s*\[\s*derive\(\s*Accounts(?:\s*,\s*[\w:]+)*\s*\)\s*\]/g;
+  let m;
+  while ((m = deriveRe.exec(content)) !== null) {
+    const afterIdx = m.index + m[0].length;
+    const structRe = /pub\s+struct\s+(\w+)[^{]*\{/g;
+    structRe.lastIndex = afterIdx;
+    const sm = structRe.exec(content);
+    if (!sm || sm.index - afterIdx > 400)
+      continue;
+    const openBrace = sm.index + sm[0].length - 1;
+    const end = matchBraces(content, openBrace);
+    const body = content.slice(openBrace + 1, end - 1);
+    structs.push({
+      name: sm[1],
+      start: m.index,
+      end,
+      fields: parseFields(body, openBrace + 1, content)
+    });
+  }
+  return structs;
+}
+function parseRegions(content) {
+  const regions = [];
+  const implRe = /\bimpl(?:\s*<[^>]*>)?\s+(\w+)(?:\s*<[^>]*>)?(?:\s+for\s+\w+(?:\s*<[^>]*>)?)?\s*\{/g;
+  let im;
+  while ((im = implRe.exec(content)) !== null) {
+    const forMatch = im[0].match(/\bfor\s+(\w+)/);
+    const implType = forMatch ? forMatch[1] : im[1];
+    const openBrace = im.index + im[0].length - 1;
+    const end = matchBraces(content, openBrace);
+    regions.push({ start: im.index, end, contextType: null, implType });
+  }
+  const fnRe = /\bfn\s+\w+\s*(?:<[^>]*>)?\s*\(\s*(?:mut\s+)?ctx\s*:\s*Context\s*<\s*(?:(?:'\w+|'_)\s*,\s*)*(\w+)(?:\s*<[^>]*>)?\s*[,>]/g;
+  let fm;
+  while ((fm = fnRe.exec(content)) !== null) {
+    let i = fm.index + fm[0].length;
+    let parenDepth = 0;
+    parenDepth = 1;
+    while (i < content.length && parenDepth > 0) {
+      if (content[i] === "(")
+        parenDepth++;
+      else if (content[i] === ")")
+        parenDepth--;
+      i++;
+    }
+    while (i < content.length && content[i] !== "{") {
+      if (content[i] === ";")
+        break;
+      i++;
+    }
+    if (i >= content.length || content[i] !== "{")
+      continue;
+    const end = matchBraces(content, i);
+    regions.push({ start: fm.index, end, contextType: fm[1], implType: null });
+  }
+  return regions;
+}
+function parseTestRanges(content) {
+  const ranges = [];
+  const re = /#\s*\[\s*cfg\(\s*test\s*\)\s*\]/g;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const braceIdx = content.indexOf("{", m.index + m[0].length);
+    if (braceIdx === -1)
+      continue;
+    ranges.push([m.index, matchBraces(content, braceIdx)]);
+  }
+  return ranges;
+}
+function buildModel(content) {
+  return {
+    structs: parseStructs(content),
+    regions: parseRegions(content),
+    testRanges: parseTestRanges(content)
+  };
+}
+var cached = null;
+function getConstraintModel(content) {
+  if (cached && cached.content === content)
+    return cached.model;
+  const model = buildModel(content);
+  cached = { content, model };
+  return model;
+}
+function inRanges(offset, ranges) {
+  return ranges.some(([s, e]) => offset >= s && offset < e);
+}
+function innermostRegionAt(model, offset) {
+  let best = null;
+  for (const r of model.regions) {
+    if (offset >= r.start && offset < r.end) {
+      if (!best || r.end - r.start < best.end - best.start)
+        best = r;
+    }
+  }
+  return best;
+}
+function structAt(model, offset) {
+  const region = innermostRegionAt(model, offset);
+  if (!region)
+    return null;
+  const name = region.contextType ?? region.implType;
+  if (!name)
+    return null;
+  return model.structs.find((s) => s.name === name) ?? null;
+}
+function findField(model, name) {
+  for (const s of model.structs) {
+    const f = s.fields.find((f) => f.name === name);
+    if (f)
+      return f;
+  }
+  return null;
+}
+function lineOffset(lines, idx) {
+  let off = 0;
+  for (let i = 0;i < idx && i < lines.length; i++)
+    off += lines[i].length + 1;
+  return off;
+}
+function isTestLikePath(filePath) {
+  const p = filePath.replace(/\\/g, "/");
+  if (/(^|\/)(tests?|test[-_]utils?|testing|fuzz|fixtures?|benches|benchmarks|examples?)(\/|$)/i.test(p))
+    return true;
+  const base = (p.split("/").pop() || "").toLowerCase();
+  return /^(tests|e2e)\.rs$/.test(base) || /^test_.*\.rs$/.test(base) || /(_tests?|_e2e)\.rs$/.test(base);
+}
+
 // ../packages/core/src/rules/index.ts
 function makeFinding(rule, filePath, line, snippet, description) {
   return {
@@ -23,23 +240,51 @@ var missingSignerCheck = {
   id: "SOL-001",
   name: "Missing Signer Check",
   severity: "CRITICAL",
-  description: "A transfer or mint_to call was found without an is_signer / Signer<'info> check within the preceding 10 lines. Add a `Signer<'info>` account type or an explicit `require!(ctx.accounts.authority.is_signer, ...)` check before authorizing fund movement.",
+  description: "A transfer or mint_to call was found with no signer evidence: no is_signer check nearby, no Signer<'info> field on the governing Accounts struct, and no PDA signing (invoke_signed / new_with_signer). Add a `Signer<'info>` account type or an explicit `require!(ctx.accounts.authority.is_signer, ...)` check before authorizing fund movement.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const callPattern = /\b(transfer|mint_to)\s*\(/;
-    lines.forEach((line, idx) => {
+    const callPattern = /\b(?:transfer|mint_to|transfer_checked|mint_to_checked)\s*\(/;
+    const declPattern = /\bfn\s+(?:transfer|mint_to|transfer_checked|mint_to_checked)\s*\(/;
+    const model = getConstraintModel(fileContent);
+    lines.forEach((rawLine, idx) => {
+      if (declPattern.test(rawLine))
+        return;
+      const line = stripStringLiterals(rawLine);
       if (!callPattern.test(line))
         return;
       if (!line.includes("ctx.accounts.") && !fileContent.includes("ctx.accounts."))
         return;
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
       const windowStart = Math.max(0, idx - 10);
       const window = lines.slice(windowStart, idx + 1).join(`
 `);
       const hasSignerEvidence = /is_signer/.test(window) || /Signer<\s*'info\s*>/.test(window) || /#\[account\([^)]*signer[^)]*\)\]/i.test(window);
-      if (!hasSignerEvidence) {
-        findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, line, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
+      if (hasSignerEvidence)
+        return;
+      const extWindow = lines.slice(windowStart, Math.min(lines.length, idx + 16)).join(`
+`);
+      if (/\binvoke_signed\b/.test(extWindow))
+        return;
+      if (/\bnew_with_signer\b/.test(extWindow))
+        return;
+      if (/system_instruction::transfer/.test(line) && /\binvoke(?:_signed)?\s*\(/.test(extWindow)) {
+        return;
       }
+      if (!line.includes("::")) {
+        const beforeMatch = line.slice(0, line.search(callPattern));
+        if (/\binvoke(?:_signed)?\s*\([^)]*$/.test(beforeMatch))
+          return;
+        const prevLines = lines.slice(Math.max(0, idx - 3), idx);
+        if (prevLines.some((l) => /\binvoke(?:_signed)?\s*\([^)]*$/.test(l)))
+          return;
+      }
+      const struct = structAt(model, offset);
+      if (struct && struct.fields.some((f) => f.isSignerTyped))
+        return;
+      findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, rawLine, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
     });
     return findings;
   }
@@ -53,14 +298,25 @@ var uncheckedDeserialization = {
     const findings = [];
     const lines = splitLines(fileContent);
     const pattern = /(Account|AccountLoader)::try_from\s*\(/;
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
       if (!pattern.test(line))
         return;
-      const prevLine = idx > 0 ? lines[idx - 1] : "";
-      const hasConstraint = /#\[account\(/.test(prevLine) || /#\[account\(/.test(line);
-      if (!hasConstraint) {
-        findings.push(makeFinding(uncheckedDeserialization, filePath, idx + 1, line, "Add a `#[account(constraint = ..., owner = ...)]` attribute, or replace with a typed `Account<'info, T>` field so Anchor validates ownership and discriminator automatically."));
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const windowStart = Math.max(0, idx - 3);
+      const window = lines.slice(windowStart, idx + 1).join(`
+`);
+      if (/#\[account\(/.test(window))
+        return;
+      const argMatch = line.match(/::try_from\s*\(\s*&?\s*(?:ctx\.accounts\.|self\.)?(\w+)/);
+      if (argMatch) {
+        const field = findField(model, argMatch[1]);
+        if (field && field.validated)
+          return;
       }
+      findings.push(makeFinding(uncheckedDeserialization, filePath, idx + 1, line, "Add a `#[account(constraint = ..., owner = ...)]` attribute, or replace with a typed `Account<'info, T>` field so Anchor validates ownership and discriminator automatically."));
     });
     return findings;
   }
@@ -93,23 +349,24 @@ var missingBumpCanonicalization = {
   id: "SOL-004",
   name: "Missing Bump Seed Canonicalization",
   severity: "HIGH",
-  description: "PDA bump seeds must be derived via `find_program_address` and the canonical bump stored/validated on-chain. Calling `create_program_address` directly, or discarding the bump returned by `find_program_address`, allows bump-seed forgery attacks.",
+  description: "PDA bump seeds must be derived via `find_program_address` (which returns the canonical bump by construction) and stored/validated on-chain. Calling `create_program_address` directly with a caller-supplied bump allows bump-seed forgery attacks.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
-      if (/create_program_address\s*\(/.test(line) && !/find_program_address/.test(line)) {
-        findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
+      if (!/create_program_address\s*\(/.test(line))
         return;
-      }
-      const fpaMatch = line.match(/let\s+(\([^)]*\)|\w+)\s*=\s*[\w:]*find_program_address\s*\(/);
-      if (fpaMatch) {
-        const binding = fpaMatch[1];
-        const bindsBump = /\(\s*\w+\s*,\s*\w+\s*\)/.test(binding);
-        if (!bindsBump) {
-          findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Destructure and store the bump returned by `find_program_address` (e.g. `let (pda, bump) = ...`) and persist/validate it instead of discarding it."));
-        }
-      }
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const windowStart = Math.max(0, idx - 10);
+      const windowEnd = Math.min(lines.length, idx + 3);
+      const window = stripLineComments(lines.slice(windowStart, windowEnd).join(`
+`));
+      if (/find_program_address/.test(window))
+        return;
+      findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
     });
     return findings;
   }
@@ -118,19 +375,29 @@ var integerOverflowRisk = {
   id: "SOL-005",
   name: "Integer Overflow Risk",
   severity: "MEDIUM",
-  description: "Raw arithmetic (`+`, `-`, `*`) was performed on u64/u128-typed values without using checked or saturating arithmetic. Unchecked overflow can wrap silently in release builds without `overflow-checks = true`, corrupting balances. Use `.checked_add`/`.checked_sub`/`.checked_mul` or `saturating_*` and handle the `None` case.",
+  description: "Raw arithmetic (`+`, `-`, `*`) was written into account state (a field assignment or compound assignment) on amount-like values without checked or saturating arithmetic. Unchecked overflow can wrap silently in release builds without `overflow-checks = true`, corrupting balances. Use `.checked_add`/`.checked_sub`/`.checked_mul` or `saturating_*` and handle the `None` case.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const arithmeticPattern = /\b(\w*(amount|balance|supply|total|shares|stake)\w*)\s*(\+|\-|\*)\s*\w/i;
+    if (isTestLikePath(filePath))
+      return findings;
+    const model = getConstraintModel(fileContent);
+    const arithmeticPattern = /\b(\w*(amount|balance|supply|total|shares|stake|reserve|collateral|liquidity|principal)\w*)\s*(\+|\-|\*)\s*\w/i;
     const alreadySafe = /checked_(add|sub|mul|div)|saturating_(add|sub|mul)|wrapping_(add|sub|mul)/;
+    const stateWritePattern = /^\s*(?:[\w.\[\]]+\.)[\w.\[\]]+\s*(?:=|\+=|-=|\*=)\s*[^=>]|\b\w+\s*(?:\+=|-=|\*=)\s*[^=]/;
     lines.forEach((line, idx) => {
       if (alreadySafe.test(line))
         return;
       if (line.trim().startsWith("//"))
         return;
-      if (arithmeticPattern.test(line)) {
-        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
+      if (/\d\.\d/.test(line))
+        return;
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const code = stripStringLiterals(line);
+      if (arithmeticPattern.test(code) && stateWritePattern.test(code)) {
+        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic written to state with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
       }
     });
     return findings;
@@ -174,10 +441,11 @@ var insecureInit = {
         continue;
       const hasPayer = /\bpayer\s*=/.test(block);
       const hasSpace = /\bspace\s*=/.test(block);
-      if (!hasPayer || !hasSpace) {
+      const isTokenInit = /\b(associated_token|token)::/.test(block);
+      if (!hasPayer || !hasSpace && !isTokenInit) {
         const upToMatch = fileContent.slice(0, match.index);
         const line = upToMatch.split(/\r\n|\r|\n/).length;
-        const missing = [!hasPayer && "payer", !hasSpace && "space"].filter(Boolean).join(" and ");
+        const missing = [!hasPayer && "payer", !hasSpace && !isTokenInit && "space"].filter(Boolean).join(" and ");
         findings.push(makeFinding(insecureInit, filePath, line, `#[account(${block.trim()})]`, `Add the missing \`${missing}\` argument(s) to this init constraint so Anchor allocates and rent-exempts the account correctly.`));
       }
     }
@@ -188,10 +456,62 @@ var missingOwnerCheck = {
   id: "SOL-008",
   name: "Missing Owner Check",
   severity: "LOW",
-  description: "A raw `AccountInfo` field is accessed via `ctx.accounts.` without a nearby `.owner` comparison. Raw `AccountInfo` accounts bypass Anchor's automatic ownership validation, so the program must manually verify `account.owner == expected_program_id` before trusting its data.",
+  description: "A raw `AccountInfo`/`UncheckedAccount` field carries no `owner`/`constraint`/`has_one` binding in its Accounts struct and no `.owner` comparison anywhere in the file. Raw accounts bypass Anchor's automatic ownership validation, so the program must manually verify `account.owner == expected_program_id` before trusting its data.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
+    if (model.structs.length > 0) {
+      const validatedNames = new Set;
+      for (const s of model.structs) {
+        for (const f of s.fields) {
+          if (f.validated)
+            validatedNames.add(f.name);
+        }
+      }
+      const suspects = new Map;
+      for (const s of model.structs) {
+        for (const f of s.fields) {
+          if (!f.isRaw || validatedNames.has(f.name))
+            continue;
+          if (new RegExp(`\\b${f.name}\\s*\\.owner\\b`).test(stripLineComments(fileContent))) {
+            continue;
+          }
+          if (!suspects.has(f.name))
+            suspects.set(f.name, f.line);
+        }
+      }
+      for (const [name, declLine] of suspects) {
+        const usagePattern = new RegExp(`ctx\\.accounts\\.${name}\\b`);
+        let reportLine = declLine;
+        let snippet = lines[declLine - 1] || name;
+        let touchesData = false;
+        for (let i = 0;i < lines.length; i++) {
+          if (!usagePattern.test(lines[i]) || i + 1 === declLine)
+            continue;
+          if (reportLine === declLine) {
+            reportLine = i + 1;
+            snippet = lines[i];
+          }
+          if (/try_borrow_data|\.load\s*\(|data\.borrow|try_from|\.lamports\s*\(|accessor::/.test(lines[i])) {
+            touchesData = true;
+            reportLine = i + 1;
+            snippet = lines[i];
+          }
+          if (new RegExp(`=\\s*(?:&)?ctx\\.accounts\\.${name}\\.key\\s*\\(`).test(lines[i]) && !/==|require_keys_eq/.test(lines[i])) {
+            touchesData = true;
+            reportLine = i + 1;
+            snippet = lines[i];
+          }
+        }
+        if (reportLine === declLine)
+          continue;
+        if (!touchesData)
+          continue;
+        findings.push(makeFinding(missingOwnerCheck, filePath, reportLine, snippet, `\`${name}\` is a raw AccountInfo with no constraint binding. Add an explicit \`require!(ctx.accounts.${name}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check (or an \`#[account(owner = ...)]\` constraint) before trusting its data.`));
+      }
+      return findings;
+    }
     const rawFieldPattern = /pub\s+(\w+)\s*:\s*AccountInfo<\s*'info\s*>/;
     const rawFields = new Set;
     lines.forEach((line) => {
@@ -201,8 +521,11 @@ var missingOwnerCheck = {
     });
     if (rawFields.size === 0)
       return findings;
+    const flagged = new Set;
     lines.forEach((line, idx) => {
       for (const field of rawFields) {
+        if (flagged.has(field))
+          continue;
         const usagePattern = new RegExp(`ctx\\.accounts\\.${field}\\b`);
         if (!usagePattern.test(line))
           continue;
@@ -212,6 +535,7 @@ var missingOwnerCheck = {
 `);
         const hasOwnerCheck = new RegExp(`${field}\\.owner`).test(window) || /\.owner\s*==/.test(window);
         if (!hasOwnerCheck) {
+          flagged.add(field);
           findings.push(makeFinding(missingOwnerCheck, filePath, idx + 1, line, `Add an explicit \`require!(ctx.accounts.${field}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check before using this raw AccountInfo.`));
         }
       }
@@ -344,6 +668,30 @@ var missingRentExemptCheck = {
     return findings;
   }
 };
+var unboundTokenMint = {
+  id: "SOL-013",
+  name: "Token Account Not Bound to Mint",
+  severity: "MEDIUM",
+  description: "A token-account field and a mint field coexist in the same Accounts struct, but the token account is never bound to the mint (`token::mint = ...`, `associated_token::mint = ...`, or a constraint/address pin). The instruction may accept a token account of an unintended mint — the vulnerability class behind the Cashio infinite-mint exploit. Bind the token account to the mint in the `#[account(...)]` constraint.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
+    for (const s of model.structs) {
+      const mintFields = s.fields.filter((f) => f.isMint);
+      if (mintFields.length === 0)
+        continue;
+      for (const f of s.fields) {
+        if (!f.isTokenAccount)
+          continue;
+        if (f.bindsTokenMint || f.hasInit || f.validated)
+          continue;
+        findings.push(makeFinding(unboundTokenMint, filePath, f.line, lines[f.line - 1] || f.name, `\`${f.name}\` is a TokenAccount but is never bound to a mint, although this instruction also takes a mint account (${mintFields.map((m) => `\`${m.name}\``).join(", ")}). Add \`token::mint = ${mintFields[0].name}\` (and usually \`token::authority\`) to the field's #[account(...)] constraint so a token account of an unintended mint is rejected.`));
+      }
+    }
+    return findings;
+  }
+};
 var rules = [
   missingSignerCheck,
   uncheckedDeserialization,
@@ -357,7 +705,7 @@ var rules = [
   initIfNeededReinit,
   missingRentExemptCheck
 ];
-var experimentalRules = [duplicateMutableAccounts];
+var experimentalRules = [duplicateMutableAccounts, unboundTokenMint];
 // ../packages/core/src/scanner.ts
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -377,16 +725,36 @@ function scanFile(filePath, rules) {
   const content = readFileSync(filePath, "utf8");
   return scanContent(content, filePath, rules);
 }
-function walk(dirPath, files = []) {
+var EXCLUDED_DIR_NAMES = new Set([
+  "tests",
+  "test",
+  "test-utils",
+  "test_utils",
+  "testing",
+  "fuzz",
+  "fixtures",
+  "fixture",
+  "benches",
+  "benchmarks",
+  "examples",
+  "example"
+]);
+function walk(dirPath, files = [], includeTests = false, rootPath) {
+  const root = rootPath ?? dirPath;
   const entries = readdirSync(dirPath);
   for (const entry of entries) {
     if (entry === "node_modules" || entry === "target" || entry === ".git")
       continue;
+    if (!includeTests && EXCLUDED_DIR_NAMES.has(entry.toLowerCase()))
+      continue;
     const fullPath = join(dirPath, entry);
     const stat = statSync(fullPath);
     if (stat.isDirectory()) {
-      walk(fullPath, files);
+      walk(fullPath, files, includeTests, root);
     } else if (stat.isFile() && fullPath.endsWith(".rs")) {
+      const rel = fullPath.slice(root.length).replace(/^[\/\\]/, "");
+      if (!includeTests && isTestLikePath(rel))
+        continue;
       files.push(fullPath);
     }
   }
@@ -434,9 +802,9 @@ function sortAndSummarize(rsFileCount, allFindings) {
     summary: tallySummary(allFindings)
   };
 }
-async function scanDirectory(targetPath, rules) {
+async function scanDirectory(targetPath, rules, opts = {}) {
   const stat = statSync(targetPath);
-  const rsFiles = stat.isDirectory() ? walk(targetPath) : targetPath.endsWith(".rs") ? [targetPath] : [];
+  const rsFiles = stat.isDirectory() ? walk(targetPath, [], opts.includeTests ?? false) : targetPath.endsWith(".rs") ? [targetPath] : [];
   const allFindings = [];
   for (const file of rsFiles) {
     allFindings.push(...scanFile(file, rules));
@@ -475,7 +843,7 @@ function badge(severity) {
 var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 function printReport(result) {
   const timestamp = new Date().toISOString();
-  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.0 — static analysis for Anchor/Solana programs${RESET}`);
+  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.1 — static analysis for Anchor/Solana programs${RESET}`);
   console.log(`${DIM}Scanned ${result.scannedFiles} file(s) at ${timestamp}${RESET}`);
   console.log(`${GRAY}${"─".repeat(70)}${RESET}`);
   if (result.findings.length === 0) {
@@ -589,6 +957,8 @@ Options:
                           (CRITICAL | HIGH | MEDIUM | LOW | INFO)
   --experimental          Also run experimental rules (e.g. SOL-012 duplicate
                           mutable accounts). Higher signal, more false positives.
+  --include-tests         Also scan test/fuzz/fixture/example code (skipped by
+                          default; findings there are rarely actionable)
   --help                  Show this help message
 
 Examples:
@@ -610,6 +980,7 @@ async function main() {
   const wantsJson = args.includes("--json");
   const wantsSarif = args.includes("--sarif");
   const wantsExperimental = args.includes("--experimental");
+  const includeTests = args.includes("--include-tests");
   let minSeverity = "INFO";
   const minSeverityIdx = args.indexOf("--min-severity");
   if (minSeverityIdx !== -1) {
@@ -630,7 +1001,7 @@ async function main() {
   });
   const targetPath = positional[0] || ".";
   const activeRules = wantsExperimental ? [...rules, ...experimentalRules] : rules;
-  const result = await scanDirectory(targetPath, activeRules);
+  const result = await scanDirectory(targetPath, activeRules, { includeTests });
   result.findings = result.findings.filter((finding) => SEVERITY_RANK[finding.severity] <= SEVERITY_RANK[minSeverity]);
   if (wantsSarif) {
     console.log(JSON.stringify(toSarif(result), null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solaudit",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Open-source static analysis CLI for Anchor/Solana programs",
   "type": "module",
   "bin": {