damlisk 0.0.1__tar.gz

damlisk-0.0.1/.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.dpm
+            examples/dars
+          key: dars-${{ runner.os }}-${{ hashFiles('Makefile', 'scripts/fetch_dars.py') }}
+          restore-keys: dars-${{ runner.os }}-
+
+      - name: Build DARs, lint and test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: nix develop --command make ci

damlisk-0.0.1/.github/workflows/workflow.yml

@@ -0,0 +1,66 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Version from tag
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+|\.post[0-9]+|\.dev[0-9]+)?$'; then
+            echo "Invalid PEP 440 version: $VERSION"
+            exit 1
+          fi
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip build twine
+
+      - name: Build sdist and wheel
+        run: SETUPTOOLS_SCM_PRETEND_VERSION="$VERSION" python -m build
+
+      - name: Verify package metadata
+        run: twine check --strict dist/*
+
+      - name: Verify damlisk --version
+        run: |
+          python -m pip install dist/*.whl
+          test "$(damlisk --version)" = "damlisk, version $VERSION"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: damlisk-${{ env.VERSION }}
+          path: dist/*
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/damlisk/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist/
+          merge-multiple: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

damlisk-0.0.1/.gitignore

@@ -0,0 +1,39 @@
+__pycache__/
+*.py[cod]
+*$py.class
+
+build/
+.eggs/
+dist/
+*.egg-info/
+
+.pytest_cache/
+.python-version
+.env
+
+.venv/
+venv/
+ENV/
+uv.lock
+
+.coverage*
+.cache/
+htmlcov/
+coverage.xml
+
+.idea/
+.vscode/
+.tox/
+.mypy_cache/
+
+damlisk/version.py
+damlisk/damlisk_git_commithash.txt
+
+.DS_Store
+
+examples/**/.daml/
+examples/dars/
+examples/vulnerable/**/*.dar
+.claude/*
+*.puml
+checks-feasibility.md

damlisk-0.0.1/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

damlisk-0.0.1/Makefile

@@ -0,0 +1,91 @@
+VERSION ?= 0.0.1
+PYTHON ?= python3
+
+DARS_REF ?= main
+DARS_ONLY ?=
+DPM ?= $(shell command -v dpm || echo $(HOME)/.dpm/bin/dpm)
+DAML_SDK ?= 3.4.8
+VENV ?= .venv
+
+.PHONY: ci dpm dars init dev-init test lint mypy black flake8 isort build dev dev-release release clean clean-pyc clean-build clean-test
+
+init:
+	$(PYTHON) setup.py install
+
+dev-init:
+	$(PYTHON) -m pip install -e . --group dev
+
+ci:
+	$(PYTHON) -m venv $(VENV)
+	$(VENV)/bin/pip install -q -U pip
+	$(VENV)/bin/pip install -q -e . --group dev
+	$(MAKE) dpm dars PYTHON=$(VENV)/bin/python
+	PATH="$(CURDIR)/$(VENV)/bin:$$PATH" $(MAKE) lint test
+	git diff --exit-code -- damlisk tests setup.py
+
+dpm:
+	[ -x "$(DPM)" ] || curl -sSL https://get.digitalasset.com/install/install.sh | sh
+	$(DPM) install $(DAML_SDK)
+
+dars:
+	$(PYTHON) scripts/fetch_dars.py --out examples/dars --ref $(DARS_REF) --only "$(DARS_ONLY)"
+	@for dir in examples/vulnerable/*/; do \
+		name=$$(basename $$dir); \
+		echo "building $$name"; \
+		log=$$(cd $$dir && $(DPM) build -o $$name.dar 2>&1) || { echo "$$log"; exit 1; }; \
+		rm -rf $$dir.daml; \
+	done
+
+test:
+	pytest
+
+lint: mypy black flake8 isort
+
+mypy:
+	mypy -p damlisk
+
+black:
+	black damlisk/ tests/ setup.py
+
+flake8: black
+	flake8 damlisk/ tests/
+
+isort: black
+	isort damlisk/ tests/ setup.py
+
+build: clean
+	$(PYTHON) -m build
+	ls -la dist/
+
+dev:
+	SETUPTOOLS_SCM_PRETEND_VERSION=$(VERSION) $(MAKE) build
+
+dev-release:
+	SETUPTOOLS_SCM_PRETEND_VERSION=$(VERSION) \
+	$(PYTHON) -m pip install --no-deps --force-reinstall -e .
+
+release: build
+	twine check dist/*
+
+clean: clean-build clean-pyc clean-test
+
+clean-build:
+	@echo Cleaning python build files...
+	@rm -fr build/
+	@rm -fr dist/
+	@rm -fr *.egg-info
+	@rm -f damlisk/version.py damlisk/damlisk_git_commithash.txt
+
+clean-pyc:
+	@echo Cleaning python files...
+	@find . -path ./.venv -prune -o -name '*.pyc' -exec rm -f {} +
+	@find . -path ./.venv -prune -o -name '*.pyo' -exec rm -f {} +
+	@find . -path ./.venv -prune -o -name '__pycache__' -exec rm -rf {} +
+
+clean-test:
+	@echo Cleaning test files...
+	@find . -path ./.venv -prune -o -name 'htmlcov' -exec rm -rf {} +
+	@rm -fr coverage.xml
+	@rm -fr .coverage
+	@rm -fr .pytest_cache/
+	@rm -fr .mypy_cache/

damlisk-0.0.1/PKG-INFO

@@ -0,0 +1,215 @@
+Metadata-Version: 2.4
+Name: damlisk
+Version: 0.0.1
+Summary: Damlisk: static analyzer for Daml-LF packages (.dar)
+Home-page: https://github.com/DIGIAPP-LLC/damlisk
+Author: Artem
+Author-email: artem@kekpool.com
+Maintainer: DIGIAPP LLC
+Keywords: daml canton daml-lf static analysis security
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.11,<4
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: dazl>=8.9
+Requires-Dist: click<9,>=8.1
+Requires-Dist: loguru
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: requires-python
+Dynamic: summary
+
+<div align="center">
+
+<img src="docs/logo.svg" alt="damlisk" width="120">
+
+# damlisk
+
+**Static analyzer for Daml smart contracts.**
+
+[![PyPI](https://img.shields.io/pypi/v/damlisk)](https://pypi.org/project/damlisk/)
+[![CI](https://github.com/DIGIAPP-LLC/damlisk/actions/workflows/ci.yml/badge.svg)](.github/workflows/ci.yml)
+[![Python](https://img.shields.io/badge/python-3.11%2B-blue)](setup.py)
+[![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)
+
+[Detectors](#documentation) · [Examples](examples/vulnerable)
+
+</div>
+
+damlisk reads the Daml-LF inside a `.dar` through
+[dazl](https://github.com/digital-asset/dazl-client), walks every template, choice and value,
+and runs detectors over it. It needs no Daml source and no running ledger: what damlc
+compiled is what gets checked.
+
+## How it works
+
+**1. Install damlisk** (Python 3.11 or newer):
+
+```bash
+pip install damlisk
+```
+
+**2. Build your Daml project** with `dpm build`. This choice uses a fetched value after its
+contract was replaced:
+
+```haskell
+    nonconsuming choice PayOut : ContractId Receipt
+      with
+        cid : ContractId Account
+      controller owner
+      do
+        acc <- fetch cid
+        _ <- exercise cid Withdraw with amt = 10.0
+        create Receipt with bank; owner; remaining = acc.amount
+```
+
+**3. Scan the DAR:**
+
+```text
+$ damlisk scan examples/vulnerable/stale-fetch/stale-fetch.dar --detect stale-fetch
+[Medium] stale-fetch Main.daml:29
+    Main:Desk.PayOut: `acc` is used after `Withdraw`
+[Medium] stale-fetch Main.daml:38
+    Main:Desk.PayTwice: `acc` is used after `Withdraw`
+2 finding(s).
+```
+
+## Documentation
+
+Each page explains its detectors: what they report, why it matters, an example with the
+scan output, and how the check works and what it misses.
+
+| # | Page | Detectors |
+|---|---|---|
+| 1 | [Authorization](docs/detectors/01-authorization.md) | `controller-from-argument`, `hardcoded-party`, `unprotected-archive`, `over-disclosure`, `delegated-authority-leak` |
+| 2 | [Assets](docs/detectors/02-assets.md) | `stuck-asset`, `value-to-arbitrary-party` |
+| 3 | [Contracts](docs/detectors/03-contracts.md) | `unsafe-primitive`, `untrusted-interface-exercise`, `stale-fetch` |
+| 4 | [Validation](docs/detectors/04-validation.md) | `missing-amount-check`, `partial-function`, `nonconsuming-create`, `unchecked-fetch`, `time-from-argument`, `amount-tolerance`, `divide-before-multiply`, `unconsumed-input`, `hash-concat-collision`, `time-equality`, `missing-ensure`, `ignored-optional` |
+| 5 | [Time](docs/detectors/05-time.md) | `time-dependence`, `weak-randomness` |
+| 6 | [Loops](docs/detectors/06-loops.md) | `ledger-op-in-loop`, `unbounded-input-loop` |
+| 7 | [Hygiene](docs/detectors/07-hygiene.md) | `boolean-cst`, `boolean-equal`, `unused-template-field`, `discarded-update`, `aborting-choice`, `tautological-compare`, `debug-trace`, `rtlo` |
+| 8 | [Upgrade](docs/detectors/08-upgrade.md) | `sdk-version` |
+
+<details>
+<summary><b>All detectors</b> with impact and confidence</summary>
+
+| Detector | Impact | Confidence | What it finds |
+|---|---|---|---|
+| [`boolean-cst`](docs/detectors/07-hygiene.md#boolean-cst) | Medium | Medium | Boolean constants used as conditions |
+| [`boolean-equal`](docs/detectors/07-hygiene.md#boolean-equal) | Informational | High | Comparison to `True` / `False` |
+| [`controller-from-argument`](docs/detectors/01-authorization.md#controller-from-argument) | High | Medium | Consuming choice controlled only by an unchecked argument party |
+| [`missing-amount-check`](docs/detectors/04-validation.md#missing-amount-check) | Low | Medium | `Decimal` template field not constrained by `ensure` |
+| [`unused-template-field`](docs/detectors/07-hygiene.md#unused-template-field) | Informational | Medium | Template field that no ledger code reads |
+| [`hardcoded-party`](docs/detectors/01-authorization.md#hardcoded-party) | Medium | High | Party identity built from or compared with a text literal |
+| [`partial-function`](docs/detectors/04-validation.md#partial-function) | Low | Medium | Choice argument passed to `head`, `fromSome`, `!!`, ... |
+| [`discarded-update`](docs/detectors/07-hygiene.md#discarded-update) | Medium | High | Ledger actions wrapped in `pure` and never run |
+| [`nonconsuming-create`](docs/detectors/04-validation.md#nonconsuming-create) | High | Medium | Nonconsuming choice creates its own template without archiving `self` |
+| [`unchecked-fetch`](docs/detectors/04-validation.md#unchecked-fetch) | High | Medium | Contract fetched from a choice argument and used without validation |
+| [`time-from-argument`](docs/detectors/04-validation.md#time-from-argument) | Medium | Medium | Deadline logic on a caller-supplied `Time` instead of ledger time |
+| [`amount-tolerance`](docs/detectors/04-validation.md#amount-tolerance) | Medium | High | `Decimal` amounts compared with `abs (a - b) < eps` instead of exactly |
+| [`divide-before-multiply`](docs/detectors/04-validation.md#divide-before-multiply) | Medium | Medium | Result of a division multiplied, compounding its rounding error |
+| [`unconsumed-input`](docs/detectors/04-validation.md#unconsumed-input) | High | Medium | Input contract of the same template read but not archived |
+| [`aborting-choice`](docs/detectors/07-hygiene.md#aborting-choice) | Informational | High | Choice whose body always aborts |
+| [`hash-concat-collision`](docs/detectors/04-validation.md#hash-concat-collision) | Medium | Medium | `sha256` of texts joined without a separator |
+| [`time-equality`](docs/detectors/04-validation.md#time-equality) | Medium | High | Ledger time compared with `==` or `/=` |
+| [`tautological-compare`](docs/detectors/07-hygiene.md#tautological-compare) | Medium | High | Value compared with itself (`payer == payer`) |
+| [`unprotected-archive`](docs/detectors/01-authorization.md#unprotected-archive) | High | Medium | Consuming choice controlled by a non-signatory |
+| [`missing-ensure`](docs/detectors/04-validation.md#missing-ensure) | Medium | High | Template with amount or time fields and no or trivial `ensure` |
+| [`over-disclosure`](docs/detectors/01-authorization.md#over-disclosure) | Medium | Medium | Choice observers taken from the choice argument |
+| [`unsafe-primitive`](docs/detectors/03-contracts.md#unsafe-primitive) | High | High | Unchecked cast of a contract id, interface or `Any` value |
+| [`debug-trace`](docs/detectors/07-hygiene.md#debug-trace) | Informational | High | Debug trace left in production code |
+| [`stuck-asset`](docs/detectors/02-assets.md#stuck-asset) | Medium | Medium | Asset its owner cannot move: no owner-controlled consuming choice |
+| [`sdk-version`](docs/detectors/08-upgrade.md#sdk-version) | Informational | High | DAR built for a Daml-LF 1.x target |
+| [`rtlo`](docs/detectors/07-hygiene.md#rtlo) | High | High | Bidirectional control character (right-to-left override) in source or `Text` |
+| [`delegated-authority-leak`](docs/detectors/01-authorization.md#delegated-authority-leak) | High | Medium | Non-signatory controller passes parties or amounts into a create or exercise |
+| [`untrusted-interface-exercise`](docs/detectors/03-contracts.md#untrusted-interface-exercise) | High | Medium | Interface contract id from the choice argument is exercised or fetched |
+| [`value-to-arbitrary-party`](docs/detectors/02-assets.md#value-to-arbitrary-party) | High | Medium | Asset created for an owner from the choice argument by a non-owner controller |
+| [`time-dependence`](docs/detectors/05-time.md#time-dependence) | Low | Medium | Ledger time decides a branch |
+| [`weak-randomness`](docs/detectors/05-time.md#weak-randomness) | High | Medium | Ledger time or a hash picks a list element or map entry |
+| [`ledger-op-in-loop`](docs/detectors/06-loops.md#ledger-op-in-loop) | Low | Medium | Create, exercise or fetch inside a loop |
+| [`unbounded-input-loop`](docs/detectors/06-loops.md#unbounded-input-loop) | Medium | Medium | Loop over a list from the choice argument with no length check |
+| [`stale-fetch`](docs/detectors/03-contracts.md#stale-fetch) | Medium | Medium | Fetched value used after the contract was replaced by a successor |
+| [`ignored-optional`](docs/detectors/04-validation.md#ignored-optional) | Medium | Medium | `Optional` result discarded or forced with `fromSome` |
+
+</details>
+
+## Commands
+
+```bash
+damlisk --help                       # top-level usage and command list
+damlisk --version                    # installed version
+damlisk list-detectors               # every detector with impact and confidence
+damlisk info path/to/project.dar     # packages, Daml-LF versions and declarations
+damlisk scan path/to/project.dar     # run all detectors on the main package
+```
+
+`scan` options:
+
+| Option | Meaning |
+|---|---|
+| `--detect a,b` | Run only these detectors |
+| `--exclude a,b` | Skip these detectors |
+| `--json` / `--pretty-json` | Print findings as JSON |
+| `--fail-on <impact>` | Exit with code 1 on a finding of this impact or higher (`high`, `medium`, `low`, `informational`, `none`) |
+| `--traceback` | Show a Python traceback on error |
+
+## Examples
+
+[`examples/vulnerable/`](examples/vulnerable) has one small Daml project per detector. Each
+holds the cases that are reported and the look-alikes that are not. `examples/dars/` holds the
+Splice DARs used as a real-world baseline in the tests. No DAR is committed: `make dars`
+builds every example with `dpm build` and downloads every published Splice version from the
+official [Splice repository](https://github.com/canton-network/splice/tree/main/daml/dars).
+
+## Local development
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+make dev-init        # editable install with the dev dependency group
+make dars            # build the example DARs and download the Splice DARs (needs dpm)
+```
+
+Run the tests and linters, and build the wheel:
+
+```bash
+make test            # pytest
+make lint            # mypy, black, flake8, isort
+make build           # dist/damlisk-<version>-py3-none-any.whl
+```
+
+CI ([`.github/workflows/ci.yml`](.github/workflows/ci.yml)) is started by hand from the Actions
+tab (**Run workflow**). It runs the same steps inside the Nix dev shell from
+[`flake.nix`](flake.nix): it installs dpm and the Daml SDK, runs `make dars`, then lint and
+tests. Run it locally with:
+
+```bash
+nix develop --command make ci
+```
+
+## Publishing to PyPI
+
+Pushing a `v*.*.*` tag runs [`.github/workflows/workflow.yml`](.github/workflows/workflow.yml).
+It builds the sdist and wheel with the tag as the version (`v0.2.0` gives `damlisk --version`
+= `0.2.0`), checks that, and uploads to PyPI through trusted publishing, so no API token is
+stored in the repository:
+
+```bash
+git tag v0.2.0
+git push origin v0.2.0
+```
+
+## License
+
+damlisk is licensed under the [Apache License, Version 2.0](LICENSE).