solsec 0.1.0

Solana Smart Contract Security Toolkit - Find security bugs before deployment
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

# Example solsec configuration file
# Copy this to solsec.toml and customize for your project

# Global settings
[global]
# Scan timeout in seconds (0 = no timeout)
timeout = 300

# Number of parallel workers for analysis
workers = 4

# Minimum severity level to report (low, medium, high, critical)
min_severity = "medium"

# Rules configuration
[rules]
# Enable/disable specific rules
enabled_rules = [
    "integer_overflow",
    "missing_signer_check", 
    "unchecked_account",
    "reentrancy"
]

disabled_rules = [
    # Add rules to disable here
    # "example_rule"
]

# Rule-specific settings
[rule_settings]

[rule_settings.integer_overflow]
# Ignore patterns for files/functions
ignore_patterns = [
    "test_*",
    "mock_*",
    "*_test.rs"
]
# Enable more aggressive checking
strict_mode = false

[rule_settings.missing_signer_check]
# Instructions that must have signer validation
required_for_instructions = [
    "transfer",
    "withdraw",
    "mint",
    "burn"
]
# Allow certain patterns to bypass the check
bypass_patterns = [
    "initialize",
    "create_account"
]

[rule_settings.unchecked_account]
# Accounts that are commonly safe to use unchecked
safe_account_types = [
    "SystemProgram",
    "TokenProgram",
    "AssociatedTokenProgram"
]

[rule_settings.reentrancy]
# Cross-program invocation patterns to check
check_patterns = [
    "invoke",
    "invoke_signed",
    "cpi"
]

# Output configuration
[output]
# Default output directory
directory = "./solsec-results"

# Default report format (json, html, markdown, csv)
format = "json"

# Include source code snippets in reports
include_snippets = true

# Maximum length of code snippets
max_snippet_length = 200

# Fuzz testing configuration
[fuzz]
# Default timeout for fuzzing in seconds
timeout = 300

# Default number of parallel jobs
jobs = 2

# Corpus directory for fuzz inputs
corpus_dir = "./fuzz/corpus"

# Artifacts directory for crashes
artifacts_dir = "./fuzz/artifacts"

# Plugin configuration
[plugins]
# Directory to search for plugins
plugin_dir = "~/.config/solsec/plugins"

# Auto-load plugins from plugin directory
auto_load = true

# Specific plugins to load
load = [
    # "custom_rule.so",
    # "advanced_checks.dll"
]