solaudit 0.3.0 → 0.3.2

package/dist/cli.js

@@ -1,5 +1,222 @@
 #!/usr/bin/env node
 
+// ../packages/core/src/anchor.ts
+function stripComments(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, "").split(/\r\n|\r|\n/).map((line) => line.replace(/\/\/.*$/, "")).join(`
+`);
+}
+function stripStringLiterals(line) {
+  return line.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+}
+function matchBraces(content, openIdx) {
+  let depth = 0;
+  let i = openIdx;
+  let inLineComment = false;
+  let inBlockComment = false;
+  let inString = false;
+  let inChar = false;
+  while (i < content.length) {
+    const c = content[i];
+    const next = i + 1 < content.length ? content[i + 1] : "";
+    if (inLineComment) {
+      if (c === `
+`)
+        inLineComment = false;
+    } else if (inBlockComment) {
+      if (c === "*" && next === "/") {
+        inBlockComment = false;
+        i++;
+      }
+    } else if (inString) {
+      if (c === "\\")
+        i++;
+      else if (c === '"')
+        inString = false;
+    } else if (inChar) {
+      if (c === "\\")
+        i++;
+      else if (c === "'")
+        inChar = false;
+    } else if (c === "/" && next === "/") {
+      inLineComment = true;
+      i++;
+    } else if (c === "/" && next === "*") {
+      inBlockComment = true;
+      i++;
+    } else if (c === '"') {
+      inString = true;
+    } else if (c === "'" && /[a-zA-Z0-9_]/.test(next) && content[i + 2] === "'") {
+      inChar = true;
+    } else if (c === "{") {
+      depth++;
+    } else if (c === "}") {
+      depth--;
+      if (depth === 0)
+        return i + 1;
+    }
+    i++;
+  }
+  return content.length;
+}
+var RAW_WRAPPERS = new Set(["AccountInfo", "UncheckedAccount"]);
+function parseFields(structBody, structBodyOffset, content) {
+  const fields = [];
+  const fieldRe = /((?:\s*(?:#\[[\s\S]*?\]|\/\/[^\n]*))*)\s*pub\s+(\w+)\s*:\s*((?:Box\s*<\s*)*)([\w:]+)\s*<\s*'info\s*(?:,\s*([\w:]+)\s*)?>[\s>]*/g;
+  let m;
+  while ((m = fieldRe.exec(structBody)) !== null) {
+    const attrs = stripComments(m[1] || "");
+    const name = m[2];
+    const wrapperType = m[4];
+    const genericArg = m[5] || null;
+    const offset = structBodyOffset + m.index;
+    const line = content.slice(0, offset).split(/\r\n|\r|\n/).length;
+    fields.push({
+      name,
+      wrapperType,
+      genericArg,
+      attrs,
+      isRaw: RAW_WRAPPERS.has(wrapperType),
+      isSignerTyped: wrapperType === "Signer" || /#\s*\[\s*account\(\s*signer\s*\)\s*\]/.test(attrs),
+      isTokenAccount: genericArg === "TokenAccount",
+      isMint: genericArg === "Mint",
+      validated: /\b(owner|constraint|has_one|address|seeds)\s*=/.test(attrs),
+      bindsTokenMint: /\b(?:token|associated_token)::mint\b/.test(attrs),
+      hasInit: /\binit(_if_needed)?\b/.test(attrs),
+      line
+    });
+  }
+  return fields;
+}
+function parseStructs(content) {
+  const structs = [];
+  const deriveRe = /#\s*\[\s*derive\(\s*Accounts(?:\s*,\s*[\w:]+)*\s*\)\s*\]/g;
+  let m;
+  while ((m = deriveRe.exec(content)) !== null) {
+    const afterIdx = m.index + m[0].length;
+    const structRe = /pub\s+struct\s+(\w+)[^{]*\{/g;
+    structRe.lastIndex = afterIdx;
+    const sm = structRe.exec(content);
+    if (!sm || sm.index - afterIdx > 400)
+      continue;
+    const openBrace = sm.index + sm[0].length - 1;
+    const end = matchBraces(content, openBrace);
+    const body = content.slice(openBrace + 1, end - 1);
+    structs.push({
+      name: sm[1],
+      start: m.index,
+      end,
+      fields: parseFields(body, openBrace + 1, content)
+    });
+  }
+  return structs;
+}
+function parseRegions(content) {
+  const regions = [];
+  const implRe = /\bimpl(?:\s*<[^>]*>)?\s+(\w+)(?:\s*<[^>]*>)?(?:\s+for\s+\w+(?:\s*<[^>]*>)?)?\s*\{/g;
+  let im;
+  while ((im = implRe.exec(content)) !== null) {
+    const forMatch = im[0].match(/\bfor\s+(\w+)/);
+    const implType = forMatch ? forMatch[1] : im[1];
+    const openBrace = im.index + im[0].length - 1;
+    const end = matchBraces(content, openBrace);
+    regions.push({ start: im.index, end, contextType: null, implType });
+  }
+  const fnRe = /\bfn\s+\w+\s*(?:<[^>]*>)?\s*\(\s*(?:mut\s+)?ctx\s*:\s*Context\s*<\s*(?:(?:'\w+|'_)\s*,\s*)*(\w+)(?:\s*<[^>]*>)?\s*[,>]/g;
+  let fm;
+  while ((fm = fnRe.exec(content)) !== null) {
+    let i = fm.index + fm[0].length;
+    let parenDepth = 0;
+    parenDepth = 1;
+    while (i < content.length && parenDepth > 0) {
+      if (content[i] === "(")
+        parenDepth++;
+      else if (content[i] === ")")
+        parenDepth--;
+      i++;
+    }
+    while (i < content.length && content[i] !== "{") {
+      if (content[i] === ";")
+        break;
+      i++;
+    }
+    if (i >= content.length || content[i] !== "{")
+      continue;
+    const end = matchBraces(content, i);
+    regions.push({ start: fm.index, end, contextType: fm[1], implType: null });
+  }
+  return regions;
+}
+function parseTestRanges(content) {
+  const ranges = [];
+  const re = /#\s*\[\s*cfg\(\s*test\s*\)\s*\]/g;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const braceIdx = content.indexOf("{", m.index + m[0].length);
+    if (braceIdx === -1)
+      continue;
+    ranges.push([m.index, matchBraces(content, braceIdx)]);
+  }
+  return ranges;
+}
+function buildModel(content) {
+  return {
+    structs: parseStructs(content),
+    regions: parseRegions(content),
+    testRanges: parseTestRanges(content)
+  };
+}
+var cached = null;
+function getConstraintModel(content) {
+  if (cached && cached.content === content)
+    return cached.model;
+  const model = buildModel(content);
+  cached = { content, model };
+  return model;
+}
+function inRanges(offset, ranges) {
+  return ranges.some(([s, e]) => offset >= s && offset < e);
+}
+function innermostRegionAt(model, offset) {
+  let best = null;
+  for (const r of model.regions) {
+    if (offset >= r.start && offset < r.end) {
+      if (!best || r.end - r.start < best.end - best.start)
+        best = r;
+    }
+  }
+  return best;
+}
+function structAt(model, offset) {
+  const region = innermostRegionAt(model, offset);
+  if (!region)
+    return null;
+  const name = region.contextType ?? region.implType;
+  if (!name)
+    return null;
+  return model.structs.find((s) => s.name === name) ?? null;
+}
+function findField(model, name) {
+  for (const s of model.structs) {
+    const f = s.fields.find((f) => f.name === name);
+    if (f)
+      return f;
+  }
+  return null;
+}
+function lineOffset(lines, idx) {
+  let off = 0;
+  for (let i = 0;i < idx && i < lines.length; i++)
+    off += lines[i].length + 1;
+  return off;
+}
+function isTestLikePath(filePath) {
+  const p = filePath.replace(/\\/g, "/");
+  if (/(^|\/)(tests?|test[-_]utils?|testing|fuzz|fixtures?|benches|benchmarks|examples?)(\/|$)/i.test(p))
+    return true;
+  const base = (p.split("/").pop() || "").toLowerCase();
+  return /^(tests|e2e)\.rs$/.test(base) || /^test_.*\.rs$/.test(base) || /(_tests?|_e2e)\.rs$/.test(base);
+}
+
 // ../packages/core/src/rules/index.ts
 function makeFinding(rule, filePath, line, snippet, description) {
   return {
@@ -23,23 +240,63 @@ var missingSignerCheck = {
   id: "SOL-001",
   name: "Missing Signer Check",
   severity: "CRITICAL",
-  description: "A transfer or mint_to call was found without an is_signer / Signer<'info> check within the preceding 10 lines. Add a `Signer<'info>` account type or an explicit `require!(ctx.accounts.authority.is_signer, ...)` check before authorizing fund movement.",
+  description: "A transfer or mint_to call was found with no signer evidence: no is_signer check nearby, no Signer<'info> field on the governing Accounts struct, and no PDA signing (invoke_signed / new_with_signer). Add a `Signer<'info>` account type or an explicit `require!(ctx.accounts.authority.is_signer, ...)` check before authorizing fund movement.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const callPattern = /\b(transfer|mint_to)\s*\(/;
-    lines.forEach((line, idx) => {
+    const callPattern = /\b(?:transfer|mint_to|transfer_checked|mint_to_checked)\s*\(/;
+    const declPattern = /\bfn\s+(?:transfer|mint_to|transfer_checked|mint_to_checked)\s*\(/;
+    const model = getConstraintModel(fileContent);
+    lines.forEach((rawLine, idx) => {
+      if (declPattern.test(rawLine))
+        return;
+      const line = stripStringLiterals(rawLine);
       if (!callPattern.test(line))
         return;
       if (!line.includes("ctx.accounts.") && !fileContent.includes("ctx.accounts."))
         return;
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
       const windowStart = Math.max(0, idx - 10);
       const window = lines.slice(windowStart, idx + 1).join(`
 `);
       const hasSignerEvidence = /is_signer/.test(window) || /Signer<\s*'info\s*>/.test(window) || /#\[account\([^)]*signer[^)]*\)\]/i.test(window);
-      if (!hasSignerEvidence) {
-        findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, line, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
+      if (hasSignerEvidence)
+        return;
+      const struct = structAt(model, offset);
+      const extWindow = lines.slice(windowStart, Math.min(lines.length, idx + 16)).join(`
+`);
+      if (/\binvoke_signed\b/.test(extWindow)) {
+        if (struct && !struct.fields.some((f) => f.isSignerTyped)) {
+          const callBlock = lines.slice(idx, Math.min(lines.length, idx + 8)).join(`
+`);
+          if (/system_instruction::transfer|::transfer(?:_checked)?\s*\(/.test(callBlock)) {
+            const refs = [...callBlock.matchAll(/ctx\.accounts\.(\w+)/g)].map((m) => m[1]);
+            const toField = refs.length >= 2 ? findField(model, refs[1]) : null;
+            if (toField && toField.isRaw && !toField.validated) {
+              findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, rawLine, `This instruction PDA-signs a transfer whose destination (\`${refs[1]}\`) is a caller-supplied unchecked account, and its Accounts struct has no Signer — anyone can call it and drain the vault. Require an authority Signer and bind the recipient to validated state.`));
+            }
+          }
+        }
+        return;
       }
+      if (/\bnew_with_signer\b/.test(extWindow))
+        return;
+      if (/system_instruction::transfer/.test(line) && /\binvoke(?:_signed)?\s*\(/.test(extWindow)) {
+        return;
+      }
+      if (!line.includes("::")) {
+        const beforeMatch = line.slice(0, line.search(callPattern));
+        if (/\binvoke(?:_signed)?\s*\([^)]*$/.test(beforeMatch))
+          return;
+        const prevLines = lines.slice(Math.max(0, idx - 3), idx);
+        if (prevLines.some((l) => /\binvoke(?:_signed)?\s*\([^)]*$/.test(l)))
+          return;
+      }
+      if (struct && struct.fields.some((f) => f.isSignerTyped))
+        return;
+      findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, rawLine, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
     });
     return findings;
   }
@@ -53,14 +310,25 @@ var uncheckedDeserialization = {
     const findings = [];
     const lines = splitLines(fileContent);
     const pattern = /(Account|AccountLoader)::try_from\s*\(/;
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
       if (!pattern.test(line))
         return;
-      const prevLine = idx > 0 ? lines[idx - 1] : "";
-      const hasConstraint = /#\[account\(/.test(prevLine) || /#\[account\(/.test(line);
-      if (!hasConstraint) {
-        findings.push(makeFinding(uncheckedDeserialization, filePath, idx + 1, line, "Add a `#[account(constraint = ..., owner = ...)]` attribute, or replace with a typed `Account<'info, T>` field so Anchor validates ownership and discriminator automatically."));
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const windowStart = Math.max(0, idx - 3);
+      const window = lines.slice(windowStart, idx + 1).join(`
+`);
+      if (/#\[account\(/.test(window))
+        return;
+      const argMatch = line.match(/::try_from\s*\(\s*&?\s*(?:ctx\.accounts\.|self\.)?(\w+)/);
+      if (argMatch) {
+        const field = findField(model, argMatch[1]);
+        if (field && field.validated)
+          return;
       }
+      findings.push(makeFinding(uncheckedDeserialization, filePath, idx + 1, line, "Add a `#[account(constraint = ..., owner = ...)]` attribute, or replace with a typed `Account<'info, T>` field so Anchor validates ownership and discriminator automatically."));
     });
     return findings;
   }
@@ -73,17 +341,35 @@ var arbitraryCpi = {
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const cpiPattern = /\b(invoke|invoke_signed)\s*\(/;
+    const cpiPattern = /\b(?:invoke|invoke_signed)\s*\(/;
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
       if (!cpiPattern.test(line))
         return;
-      const windowStart = Math.max(0, idx - 3);
-      const windowEnd = Math.min(lines.length, idx + 4);
-      const window = lines.slice(windowStart, windowEnd).join(`
-`);
-      const usesAccountsAsProgram = /ctx\.accounts\.\w+\.(to_account_info\(\)|key\(\))/.test(window) && !/Program<\s*'info/.test(window);
-      if (usesAccountsAsProgram) {
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const windowStart = Math.max(0, idx - 12);
+      const windowEnd = Math.min(lines.length, idx + 12);
+      const window = stripLineComments(lines.slice(windowStart, windowEnd).join(`
+`));
+      const suspectNames = new Set;
+      for (const m of window.matchAll(/program_id\s*:\s*[*&]?\s*(?:ctx\.accounts\.)?(\w+)/g)) {
+        suspectNames.add(m[1]);
+      }
+      for (const m of window.matchAll(/ctx\.accounts\.(\w*(?:^|_)program\w*)/g)) {
+        suspectNames.add(m[1]);
+      }
+      for (const name of suspectNames) {
+        const field = findField(model, name);
+        if (field && field.wrapperType === "Program")
+          continue;
+        if (field && !field.isRaw)
+          continue;
+        if (!field && /Program<\s*'info/.test(window))
+          continue;
         findings.push(makeFinding(arbitraryCpi, filePath, idx + 1, line, "Validate the target program ID against a known constant (e.g. `token_program.key() == spl_token::ID`) or type the account as `Program<'info, T>` before invoking it."));
+        break;
       }
     });
     return findings;
@@ -93,24 +379,63 @@ var missingBumpCanonicalization = {
   id: "SOL-004",
   name: "Missing Bump Seed Canonicalization",
   severity: "HIGH",
-  description: "PDA bump seeds must be derived via `find_program_address` and the canonical bump stored/validated on-chain. Calling `create_program_address` directly, or discarding the bump returned by `find_program_address`, allows bump-seed forgery attacks.",
+  description: "PDA bump seeds must be derived via `find_program_address` (which returns the canonical bump by construction) and stored/validated on-chain. Calling `create_program_address` directly with a caller-supplied bump allows bump-seed forgery attacks.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
-      if (/create_program_address\s*\(/.test(line) && !/find_program_address/.test(line)) {
-        findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
+      if (!/create_program_address\s*\(/.test(line))
+        return;
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
         return;
+      const windowStart = Math.max(0, idx - 10);
+      const windowEnd = Math.min(lines.length, idx + 3);
+      const window = stripLineComments(lines.slice(windowStart, windowEnd).join(`
+`));
+      if (/find_program_address/.test(window))
+        return;
+      findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
+    });
+    if (model.structs.length > 0) {
+      const offsets = [];
+      let acc = 0;
+      for (const l of lines) {
+        offsets.push(acc);
+        acc += l.length + 1;
       }
-      const fpaMatch = line.match(/let\s+(\([^)]*\)|\w+)\s*=\s*[\w:]*find_program_address\s*\(/);
-      if (fpaMatch) {
-        const binding = fpaMatch[1];
-        const bindsBump = /\(\s*\w+\s*,\s*\w+\s*\)/.test(binding);
-        if (!bindsBump) {
-          findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Destructure and store the bump returned by `find_program_address` (e.g. `let (pda, bump) = ...`) and persist/validate it instead of discarding it."));
+      for (const s of model.structs) {
+        const regions = model.regions.filter((r) => r.contextType === s.name);
+        const regionText = regions.length > 0 ? regions.map((r) => fileContent.slice(r.start, r.end)).join(`
+`) : fileContent;
+        const movesValue = /system_instruction::transfer|token::transfer|try_borrow_mut_lamports|lamports\.borrow_mut/.test(stripLineComments(regionText));
+        if (!movesValue)
+          continue;
+        const inScope = (lineIdx) => {
+          if (regions.length === 0)
+            return true;
+          const off = offsets[lineIdx];
+          return regions.some((r) => off >= r.start && off < r.end);
+        };
+        for (const f of s.fields) {
+          if (!f.isRaw || f.validated)
+            continue;
+          if (!/\bmut\b/.test(f.attrs))
+            continue;
+          if (!/vault|treasury|pool|escrow|fund|bank|reward/i.test(f.name))
+            continue;
+          for (let i = 0;i < lines.length; i++) {
+            if (!inScope(i))
+              continue;
+            if (!lines[i].includes(`ctx.accounts.${f.name}`))
+              continue;
+            findings.push(makeFinding(missingBumpCanonicalization, filePath, i + 1, lines[i], `\`${f.name}\` is a mutable unchecked account used in value movement with no \`seeds\` binding. Verify it against its derived PDA (\`seeds = [...], bump\`) or pin it with \`address =\` — otherwise the caller can substitute an attacker-controlled account and redirect the funds.`));
+            break;
+          }
         }
       }
-    });
+    }
     return findings;
   }
 };
@@ -118,19 +443,32 @@ var integerOverflowRisk = {
   id: "SOL-005",
   name: "Integer Overflow Risk",
   severity: "MEDIUM",
-  description: "Raw arithmetic (`+`, `-`, `*`) was performed on u64/u128-typed values without using checked or saturating arithmetic. Unchecked overflow can wrap silently in release builds without `overflow-checks = true`, corrupting balances. Use `.checked_add`/`.checked_sub`/`.checked_mul` or `saturating_*` and handle the `None` case.",
+  description: "Raw arithmetic (`+`, `-`, `*`) was written into account state (a field assignment or compound assignment) on amount-like values without checked or saturating arithmetic. Unchecked overflow can wrap silently in release builds without `overflow-checks = true`, corrupting balances. Use `.checked_add`/`.checked_sub`/`.checked_mul` or `saturating_*` and handle the `None` case.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const arithmeticPattern = /\b(\w*(amount|balance|supply|total|shares|stake)\w*)\s*(\+|\-|\*)\s*\w/i;
+    if (isTestLikePath(filePath))
+      return findings;
+    const model = getConstraintModel(fileContent);
+    const arithmeticPattern = /\b(\w*(amount|balance|supply|total|shares|stake|reserve|collateral|liquidity|principal)\w*)\s*(\+|\-|\*)\s*\w/i;
     const alreadySafe = /checked_(add|sub|mul|div)|saturating_(add|sub|mul)|wrapping_(add|sub|mul)/;
+    const stateWritePattern = /^\s*(?:[\w.\[\]]+\.)[\w.\[\]]+\s*(?:=|\+=|-=|\*=)\s*[^=>]|\b\w+\s*(?:\+=|-=|\*=)\s*[^=]/;
     lines.forEach((line, idx) => {
       if (alreadySafe.test(line))
         return;
       if (line.trim().startsWith("//"))
         return;
-      if (arithmeticPattern.test(line)) {
-        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
+      if (/\d\.\d/.test(line))
+        return;
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const code = stripStringLiterals(line);
+      if (arithmeticPattern.test(code) && stateWritePattern.test(code)) {
+        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic written to state with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
+      }
+      if (/\.pow\s*\([^)]*[a-zA-Z_]/.test(code) && !/checked_pow|saturating|wrapping/.test(code)) {
+        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Exponentiation with a non-constant exponent overflows silently and quickly (2^64 wraps a u64 to 0). Use `checked_pow` with error propagation, or bound the exponent explicitly."));
       }
     });
     return findings;
@@ -174,10 +512,11 @@ var insecureInit = {
         continue;
       const hasPayer = /\bpayer\s*=/.test(block);
       const hasSpace = /\bspace\s*=/.test(block);
-      if (!hasPayer || !hasSpace) {
+      const isTokenInit = /\b(associated_token|token)::/.test(block);
+      if (!hasPayer || !hasSpace && !isTokenInit) {
         const upToMatch = fileContent.slice(0, match.index);
         const line = upToMatch.split(/\r\n|\r|\n/).length;
-        const missing = [!hasPayer && "payer", !hasSpace && "space"].filter(Boolean).join(" and ");
+        const missing = [!hasPayer && "payer", !hasSpace && !isTokenInit && "space"].filter(Boolean).join(" and ");
         findings.push(makeFinding(insecureInit, filePath, line, `#[account(${block.trim()})]`, `Add the missing \`${missing}\` argument(s) to this init constraint so Anchor allocates and rent-exempts the account correctly.`));
       }
     }
@@ -188,10 +527,64 @@ var missingOwnerCheck = {
   id: "SOL-008",
   name: "Missing Owner Check",
   severity: "LOW",
-  description: "A raw `AccountInfo` field is accessed via `ctx.accounts.` without a nearby `.owner` comparison. Raw `AccountInfo` accounts bypass Anchor's automatic ownership validation, so the program must manually verify `account.owner == expected_program_id` before trusting its data.",
+  description: "A raw `AccountInfo`/`UncheckedAccount` field carries no `owner`/`constraint`/`has_one` binding in its Accounts struct and no `.owner` comparison anywhere in the file. Raw accounts bypass Anchor's automatic ownership validation, so the program must manually verify `account.owner == expected_program_id` before trusting its data.",
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
+    if (model.structs.length > 0) {
+      const codeOnly = stripLineComments(fileContent);
+      const offsets = [];
+      {
+        let off = 0;
+        for (const l of lines) {
+          offsets.push(off);
+          off += l.length + 1;
+        }
+      }
+      const touchPattern = /try_borrow_data|try_borrow_mut_data|try_borrow_mut_lamports|\.load\s*\(|data\.borrow|try_from|\.lamports\s*\(\s*\)|accessor::/;
+      for (const s of model.structs) {
+        const regions = model.regions.filter((r) => r.contextType === s.name);
+        const inScope = (lineIdx) => {
+          if (regions.length === 0)
+            return true;
+          const off = offsets[lineIdx];
+          return regions.some((r) => off >= r.start && off < r.end);
+        };
+        for (const f of s.fields) {
+          if (!f.isRaw || f.validated)
+            continue;
+          const ownerCheck = new RegExp(`\\b${f.name}\\.owner\\s*==|require!\\([^)]*\\b${f.name}\\.owner\\b|require_keys_eq!\\([^)]*\\b${f.name}\\b`);
+          if (ownerCheck.test(codeOnly))
+            continue;
+          const aliases = new Set;
+          const aliasRe = new RegExp(`let\\s+(\\w+)\\s*=\\s*&?\\s*ctx\\.accounts\\.${f.name}\\b`, "g");
+          let am;
+          while ((am = aliasRe.exec(codeOnly)) !== null)
+            aliases.add(am[1]);
+          let reportLine = -1;
+          let snippet = "";
+          for (let i = 0;i < lines.length; i++) {
+            if (!inScope(i))
+              continue;
+            const l = lines[i];
+            const direct = l.includes(`ctx.accounts.${f.name}`);
+            const aliasTouch = [...aliases].some((a) => new RegExp(`\\b${a}\\s*\\.`).test(l) && touchPattern.test(l));
+            const directTouch = direct && touchPattern.test(l);
+            const keyAssign = direct && new RegExp(`=\\s*&?\\s*ctx\\.accounts\\.${f.name}\\.key\\s*\\(`).test(l) && !/==|require_keys_eq/.test(l);
+            if (aliasTouch || directTouch || keyAssign) {
+              reportLine = i + 1;
+              snippet = l;
+              break;
+            }
+          }
+          if (reportLine === -1)
+            continue;
+          findings.push(makeFinding(missingOwnerCheck, filePath, reportLine, snippet, `\`${f.name}\` is a raw AccountInfo with no constraint binding. Add an explicit \`require!(ctx.accounts.${f.name}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check (or an \`#[account(owner = ...)]\` constraint) before trusting its data.`));
+        }
+      }
+      return findings;
+    }
     const rawFieldPattern = /pub\s+(\w+)\s*:\s*AccountInfo<\s*'info\s*>/;
     const rawFields = new Set;
     lines.forEach((line) => {
@@ -201,8 +594,11 @@ var missingOwnerCheck = {
     });
     if (rawFields.size === 0)
       return findings;
+    const flagged = new Set;
     lines.forEach((line, idx) => {
       for (const field of rawFields) {
+        if (flagged.has(field))
+          continue;
         const usagePattern = new RegExp(`ctx\\.accounts\\.${field}\\b`);
         if (!usagePattern.test(line))
           continue;
@@ -212,6 +608,7 @@ var missingOwnerCheck = {
 `);
         const hasOwnerCheck = new RegExp(`${field}\\.owner`).test(window) || /\.owner\s*==/.test(window);
         if (!hasOwnerCheck) {
+          flagged.add(field);
           findings.push(makeFinding(missingOwnerCheck, filePath, idx + 1, line, `Add an explicit \`require!(ctx.accounts.${field}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check before using this raw AccountInfo.`));
         }
       }
@@ -227,7 +624,7 @@ var insecureAccountClosure = {
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const zeroLamportsPattern = /\.lamports\.borrow_mut\(\)\s*=\s*0\s*;/;
+    const zeroLamportsPattern = /(?:\.lamports\.borrow_mut\(\)|\.try_borrow_mut_lamports\(\)\??)\s*=\s*0\s*;/;
     lines.forEach((line, idx) => {
       if (!zeroLamportsPattern.test(line))
         return;
@@ -344,6 +741,30 @@ var missingRentExemptCheck = {
     return findings;
   }
 };
+var unboundTokenMint = {
+  id: "SOL-013",
+  name: "Token Account Not Bound to Mint",
+  severity: "MEDIUM",
+  description: "A token-account field and a mint field coexist in the same Accounts struct, but the token account is never bound to the mint (`token::mint = ...`, `associated_token::mint = ...`, or a constraint/address pin). The instruction may accept a token account of an unintended mint — the vulnerability class behind the Cashio infinite-mint exploit. Bind the token account to the mint in the `#[account(...)]` constraint.",
+  check(fileContent, filePath) {
+    const findings = [];
+    const lines = splitLines(fileContent);
+    const model = getConstraintModel(fileContent);
+    for (const s of model.structs) {
+      const mintFields = s.fields.filter((f) => f.isMint);
+      if (mintFields.length === 0)
+        continue;
+      for (const f of s.fields) {
+        if (!f.isTokenAccount)
+          continue;
+        if (f.bindsTokenMint || f.hasInit || f.validated)
+          continue;
+        findings.push(makeFinding(unboundTokenMint, filePath, f.line, lines[f.line - 1] || f.name, `\`${f.name}\` is a TokenAccount but is never bound to a mint, although this instruction also takes a mint account (${mintFields.map((m) => `\`${m.name}\``).join(", ")}). Add \`token::mint = ${mintFields[0].name}\` (and usually \`token::authority\`) to the field's #[account(...)] constraint so a token account of an unintended mint is rejected.`));
+      }
+    }
+    return findings;
+  }
+};
 var rules = [
   missingSignerCheck,
   uncheckedDeserialization,
@@ -357,7 +778,7 @@ var rules = [
   initIfNeededReinit,
   missingRentExemptCheck
 ];
-var experimentalRules = [duplicateMutableAccounts];
+var experimentalRules = [duplicateMutableAccounts, unboundTokenMint];
 // ../packages/core/src/scanner.ts
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -377,16 +798,36 @@ function scanFile(filePath, rules) {
   const content = readFileSync(filePath, "utf8");
   return scanContent(content, filePath, rules);
 }
-function walk(dirPath, files = []) {
+var EXCLUDED_DIR_NAMES = new Set([
+  "tests",
+  "test",
+  "test-utils",
+  "test_utils",
+  "testing",
+  "fuzz",
+  "fixtures",
+  "fixture",
+  "benches",
+  "benchmarks",
+  "examples",
+  "example"
+]);
+function walk(dirPath, files = [], includeTests = false, rootPath) {
+  const root = rootPath ?? dirPath;
   const entries = readdirSync(dirPath);
   for (const entry of entries) {
     if (entry === "node_modules" || entry === "target" || entry === ".git")
       continue;
+    if (!includeTests && EXCLUDED_DIR_NAMES.has(entry.toLowerCase()))
+      continue;
     const fullPath = join(dirPath, entry);
     const stat = statSync(fullPath);
     if (stat.isDirectory()) {
-      walk(fullPath, files);
+      walk(fullPath, files, includeTests, root);
     } else if (stat.isFile() && fullPath.endsWith(".rs")) {
+      const rel = fullPath.slice(root.length).replace(/^[\/\\]/, "");
+      if (!includeTests && isTestLikePath(rel))
+        continue;
       files.push(fullPath);
     }
   }
@@ -434,9 +875,9 @@ function sortAndSummarize(rsFileCount, allFindings) {
     summary: tallySummary(allFindings)
   };
 }
-async function scanDirectory(targetPath, rules) {
+async function scanDirectory(targetPath, rules, opts = {}) {
   const stat = statSync(targetPath);
-  const rsFiles = stat.isDirectory() ? walk(targetPath) : targetPath.endsWith(".rs") ? [targetPath] : [];
+  const rsFiles = stat.isDirectory() ? walk(targetPath, [], opts.includeTests ?? false) : targetPath.endsWith(".rs") ? [targetPath] : [];
   const allFindings = [];
   for (const file of rsFiles) {
     allFindings.push(...scanFile(file, rules));
@@ -475,7 +916,7 @@ function badge(severity) {
 var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 function printReport(result) {
   const timestamp = new Date().toISOString();
-  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.0 — static analysis for Anchor/Solana programs${RESET}`);
+  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.2 — static analysis for Anchor/Solana programs${RESET}`);
   console.log(`${DIM}Scanned ${result.scannedFiles} file(s) at ${timestamp}${RESET}`);
   console.log(`${GRAY}${"─".repeat(70)}${RESET}`);
   if (result.findings.length === 0) {
@@ -589,6 +1030,8 @@ Options:
                           (CRITICAL | HIGH | MEDIUM | LOW | INFO)
   --experimental          Also run experimental rules (e.g. SOL-012 duplicate
                           mutable accounts). Higher signal, more false positives.
+  --include-tests         Also scan test/fuzz/fixture/example code (skipped by
+                          default; findings there are rarely actionable)
   --help                  Show this help message
 
 Examples:
@@ -610,6 +1053,7 @@ async function main() {
   const wantsJson = args.includes("--json");
   const wantsSarif = args.includes("--sarif");
   const wantsExperimental = args.includes("--experimental");
+  const includeTests = args.includes("--include-tests");
   let minSeverity = "INFO";
   const minSeverityIdx = args.indexOf("--min-severity");
   if (minSeverityIdx !== -1) {
@@ -630,7 +1074,7 @@ async function main() {
   });
   const targetPath = positional[0] || ".";
   const activeRules = wantsExperimental ? [...rules, ...experimentalRules] : rules;
-  const result = await scanDirectory(targetPath, activeRules);
+  const result = await scanDirectory(targetPath, activeRules, { includeTests });
   result.findings = result.findings.filter((finding) => SEVERITY_RANK[finding.severity] <= SEVERITY_RANK[minSeverity]);
   if (wantsSarif) {
     console.log(JSON.stringify(toSarif(result), null, 2));