| --- |
| title: Smart Contract Security Scanner |
| emoji: 🔒 |
| colorFrom: yellow |
| colorTo: blue |
| sdk: docker |
| pinned: false |
| license: mit |
| --- |
| |
| # Smart Contract Security Scanner |
|
|
| ## Question |
|
|
| Can we make a first-pass Solidity security review transparent and educational? |
|
|
| ## System Boundary |
|
|
| This Streamlit Space is a rule-based audit assistant. It is not a formal verifier and should not be used as the sole basis for deployment decisions. |
|
|
| ## Method |
|
|
| The app scans Solidity source code for high-signal patterns such as reentrancy-shaped value transfers, `tx.origin` authorization, `delegatecall`, missing events, and low-level calls. Each finding includes evidence, severity, reason, and remediation. |
|
|
| ## Technique |
|
|
| This is static-analysis triage. Rules search source code for patterns that correlate with common vulnerability classes. |
|
|
| The method is deliberately interpretable: each rule has an ID, evidence span, severity, reason, and fix. |
|
|
| ## Output |
|
|
| The app returns a risk score, finding table, severity breakdown, and extension notes. |
|
|
| ## Why It Matters |
|
|
| Security tools should teach the reader what was detected and why. Transparent rules are a useful baseline before adding model-based triage. |
|
|
| ## What To Notice |
|
|
| A finding is not automatically a vulnerability. It is a reason to inspect a line of code more carefully. |
|
|
| ## Effect In Practice |
|
|
| Rule-based triage can catch obvious risks early, create labeled examples for training, and provide context for a model-based security assistant. |
|
|
| ## Hugging Face Extension |
|
|
| The Space can publish vulnerable and fixed Solidity snippets as a Dataset and compare rule-based, LLM-based, and hybrid scanners. |
|
|
| ## Limitations |
|
|
| Rule-based scanners miss many vulnerabilities and can produce false positives. Production auditing should combine static analysis, tests, formal methods, expert review, and model-assisted explanation. |
|
|
| ## Run Locally |
|
|
| ```bash |
| pip install -r requirements.txt |
| streamlit run app.py |
| ``` |
|
|
