# Nightshade: open-source static analysis for Compact

**URL:** <https://forum.midnight.network/t/nightshade-open-source-static-analysis-for-compact/1377>\
**Category:** General\
**Tags:** compact, ecosytem, community\
**Created:** [October 29, 2026, 2:45pm UTC](https://forum.midnight.network/t/nightshade-open-source-static-analysis-for-compact/1377 "2026-10-29T14:45:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dickson](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@Dickson](https://forum.midnight.network/u/Dickson)\
**Post date:** [October 29, 2026, 2:45pm UTC](https://forum.midnight.network/t/nightshade-open-source-static-analysis-for-compact/1377/1 "2026-10-29T14:45:33Z")

</div>

Hey everyone! I built Nightshade, an open-source (Apache-2.0) static analyzer for Compact, and wanted to share it here.

It reads your Compact source and flags patterns worth a second look, like a private secret that gets published to the ledger after it’s used in an authorization check, witness values treated as proof of identity, discarded signature checks, caller-supplied time with no chain-time bound, and Merkle proofs that never get checked for membership. There are 96 rules in total, and every finding comes with the source line, the data path and a suggested fix.

How I tested it:

- Planted bugs: it caught 263 of 266 positive test cases and stayed quiet on 240 of 242 fixed versions.
- Real code: I ran it over 300 public Compact contracts from 144 repos with 0 crashes. 258 got full analysis; the rest are reported as incomplete, never as clean.
- The evaluation page has every denominator and the method: [Evaluation · Nightshade](https://nightshade.dicksonwu.xyz/evaluation.html)

A few details:

- Runs fully offline on your local source. No compiler or network needed to scan.
- Supports Compact compiler versions 0.28 through 0.35.
- Text, JSON and SARIF output, plus a GitHub Action so findings show up in PRs.

Code: [GitHub - DicksonWu654/nightshade: Offline static security analysis for Compact smart contracts · GitHub](https://github.com/DicksonWu654/nightshade)  
Docs: [https://nightshade.dicksonwu.xyz](https://nightshade.dicksonwu.xyz)  
Tweet: [Dickson on X: "I built a static analyzer for @MidnightNtwrk's Compact contracts and open sourcing it! Introducing Nightshade! Nightshade has 96 rules that catch privacy leaks, spoofable auth, ignored signature checks, and a lot more @MidnightNtwrk @midnightfdn @shieldedtech" / X](https://x.com/DicksonWuML/status/2115778927490699575?a=kti9HHpn1FcqxioXJRA&s=20)

It’s v0.1.1 so there will be rough edges. I’d really appreciate feedback, false positives you hit, or rules you’d want added. Happy to help anyone set up the Action too!