Hey everyone! I built Nightshade, an open-source (Apache-2.0) static analyzer for Compact, and wanted to share it here.
It reads your Compact source and flags patterns worth a second look, like a private secret that gets published to the ledger after it’s used in an authorization check, witness values treated as proof of identity, discarded signature checks, caller-supplied time with no chain-time bound, and Merkle proofs that never get checked for membership. There are 96 rules in total, and every finding comes with the source line, the data path and a suggested fix.
How I tested it:
- Planted bugs: it caught 263 of 266 positive test cases and stayed quiet on 240 of 242 fixed versions.
- Real code: I ran it over 300 public Compact contracts from 144 repos with 0 crashes. 258 got full analysis; the rest are reported as incomplete, never as clean.
- The evaluation page has every denominator and the method: Evaluation · Nightshade
A few details:
- Runs fully offline on your local source. No compiler or network needed to scan.
- Supports Compact compiler versions 0.28 through 0.35.
- Text, JSON and SARIF output, plus a GitHub Action so findings show up in PRs.
Code: GitHub - DicksonWu654/nightshade: Offline static security analysis for Compact smart contracts · GitHub
Docs: https://nightshade.dicksonwu.xyz
Tweet: Dickson on X: "I built a static analyzer for @MidnightNtwrk's Compact contracts and open sourcing it! Introducing Nightshade! Nightshade has 96 rules that catch privacy leaks, spoofable auth, ignored signature checks, and a lot more @MidnightNtwrk @midnightfdn @shieldedtech" / X
It’s v0.1.1 so there will be rough edges. I’d really appreciate feedback, false positives you hit, or rules you’d want added. Happy to help anyone set up the Action too!