Scout is an extensible open-source tool intended to assist ink! smart contract developers and auditors detect common security issues and deviations from best practices.
This tool will help developers write secure and more robust smart contracts.
Our interest in this project comes from our experience in manual auditing and our usage of comparable tools in other blockchains. To improve coverage and precision, we´ll persist in research efforts on static and dynamic analysis techniques. Find more about our ongoing research at our associated repository.
Install Scout Audit:
Make sure that Cargo is installed on your computer. Then, install Scout with the following command:
cargo install cargo-scout-audit
Run Scout Audit:
To run Scout on your project execute the following command:
cargo scout-audit
💡 Scout supports Cargo Workspaces. When run on a workspace, Scout will be executed on all packages specified as members of the workspace.
For more information on installation and usage, please refer to the Getting Started section in our documentation below.
Visit Scout's website to view the full documentation.
To validate our tool, we provide a set of code examples located in the test-cases folder.
In order to run the integration tests, navigate to apps/cargo-scout-audit
and run:
cargo test --all --all-features
In order to run the tests for a particular test-case, run the same command on that particular test-case folder (e.g: test-cases/delegate-call/delegate-call-1/vulnerable-example
)
Scout is an open source vulnerability analyzer developed by CoinFabrik's Research and Development team.
We received support through grants from both the Web3 Foundation Grants Program and the Aleph Zero Ecosystem Funding Program.
Grant Program | Description |
---|---|
Proof of Concept: We collaborated with the Laboratory on Foundations and Tools for Software Engineering (LaFHIS) at the University of Buenos Aires to establish analysis techniques and tools for our detectors, as well as to create an initial list of vulnerability classes and code examples. View Grant | Application Form. Prototype: We built a functioning prototype using linting detectors built with Dylint and expanded the list of vulnerability classes, detectors, and test cases. View Prototype | Application Form. |
|
We improved the precision and number of detectors for the tool with a multi-phase approach. This included a manual vulnerability analysis of projects within the Aleph Zero ecosystem, comprehensive testing of the tool on leading projects, and refining its detection accuracy. |
We - CoinFabrik - are a research and development company specialized in Web3, with a strong background in cybersecurity. Founded in 2014, we have worked on over 180 blockchain-related projects, EVM based and also for Solana, Algorand, and Polkadot. Beyond development, we offer security audits through a dedicated in-house team of senior cybersecurity professionals, currently working on code in Substrate, Solidity, Clarity, Rust, and TEAL.
Our team has an academic background in computer science and mathematics, with work experience focused on cybersecurity and software development, including academic publications, patents turned into products, and conference presentations. Furthermore, we have an ongoing collaboration on knowledge transfer and open-source projects with the University of Buenos Aires.
Scout is licensed and distributed under a MIT license. Contact us if you're looking for an exception to the terms.