|
1 | | -# Scout |
| 1 | +# Scout: Security Analysis Tool |
2 | 2 |
|
3 | | -We are building an extensible open-source tool (or set of tools) to assist ink! smart contract developers detect common security issues and deviations from best practices. To improve coverage and precision, we will persist in research efforts on static and dynamic analysis techniques. |
| 3 | + |
| 4 | + |
| 5 | +<p align="center"> |
| 6 | + <img src="/assets/scout.png" alt="Scout in a Dark Forest" width="300" center /> |
| 7 | +</p> |
| 8 | + |
| 9 | + |
| 10 | +Scout is an extensible open-source tool intended to assist ink! smart contract developers and auditors detect common security issues and deviations from best practices. |
4 | 11 |
|
5 | 12 | This tool will help developers write secure and more robust smart contracts. |
6 | 13 |
|
7 | 14 | Our interest in this project comes from our experience in manual auditing and our usage of comparable tools in other blockchains. |
| 15 | +To improve coverage and precision, we´ll persist in research efforts on static and dynamic analysis techniques. Find more about our ongoing research at our associated repository. |
| 16 | + |
| 17 | +## Quick Start |
| 18 | + |
| 19 | +Scout is currently available only for Linux/Mac. For a quick start, install Scout by running the following commands: |
| 20 | + |
| 21 | +```bash |
| 22 | +cargo install cargo-scout |
| 23 | +cargo-dylint dylint-link |
| 24 | +``` |
| 25 | + |
| 26 | +To run Scout on your project, navigate to its root directory and execute the following command: |
| 27 | + |
| 28 | +```bash |
| 29 | +cargo scout |
| 30 | +``` |
| 31 | + |
| 32 | +If you're using Windows, you can still run Scout by installing the [Windows Subsistem for Linux](https://learn.microsoft.com/en-us/windows/wsl/install) and using Bash. |
| 33 | + |
| 34 | + |
| 35 | +For more information on installation and usage, please refer to the [Getting Started](http://localhost:3000/docs/intro) section in our documentation below. |
| 36 | + |
| 37 | +## Documentation |
| 38 | + |
| 39 | +* [Getting Started](http://localhost:3000/docs/intro) |
| 40 | +* [Vulnerabilities](http://localhost:3000/docs/vulnerabilities) |
| 41 | +* [Detectors](http://localhost:3000/docs/detectors) |
| 42 | +* [Learn](http://localhost:3000/docs/Learn) |
| 43 | +* [Tutorials](http://localhost:3000/docs/tutorials) |
| 44 | +* [Contribute](http://localhost:3000/docs/contribute) |
| 45 | +* [FAQs](http://localhost:3000/docs/faqs) |
| 46 | +* [Blog](http://localhost:3000/blog) |
| 47 | + |
| 48 | + |
| 49 | +Visit [Scout's website](http://localhost:3000/) to view the full documentation. |
| 50 | + |
| 51 | + |
| 52 | +## Detectors |
| 53 | +| Detector ID | Category | Description | Severity | |
| 54 | +| ----------------------------- | ------------------------------ | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | |
| 55 | +| integer-overflow-or-underflow | Arithmetic | [An arithmetic operation overflows or underflows the available memory allocated to the variable.](./vulnerabilities/examples/integer-overflow-or-underflow/README.md) | Critical | |
| 56 | +| set-contract-storage | Authorization | [Insufficient access control on set_contract_storage() function.](./vulnerabilities/examples/set-contract-storage/README.md) | Critical | |
| 57 | +| reentrancy | Reentrancy | [Consistency of contract state under recursive calls.](./vulnerabilities/examples/reentrancy/README.md) | Critical | |
| 58 | +| panic-error | Validations and error handling | [Code panics on error instead of using descriptive enum.](./vulnerabilities/examples/panic-error/README.md) | Enhancement | |
| 59 | +| unused-return-enum | Validations and error handling | [Return enum from a function is not completely used.](./vulnerabilities/examples/unused-return-enum/README.md) | Minor | |
| 60 | +| dos-unbounded-operation | Denial of Service | [DoS due to unbounded operation.](./vulnerabilities/examples/dos-unbounded-operation/README.md) | Medium | |
| 61 | +| dos-unexpected-revert-with-vector | Denial of Service | [DoS due to improper storage.](./vulnerabilities/examples/dos-unexpected-revert-with-vector/README.md) | Medium |
| 62 | + |
| 63 | +## About CoinFabrik |
| 64 | + |
| 65 | +We - [CoinFabrik](https://www.coinfabrik.com/) - are a research and development company specialized in Web3, with a strong background in cybersecurity. Founded in 2014, we have worked on over 180 blockchain-related projects, EVM based and also for Solana, Algorand, and Polkadot. Beyond development, we offer security audits through a dedicated in-house team of senior cybersecurity, currently working on code in Substrate, Solidity, Clarity, Rust, and TEAL. |
| 66 | + |
| 67 | +Our team has an academic background in computer science and mathematics, with work experience focused on cybersecurity and software development, including academic publications, patents turned into products, and conference presentations. Furthermore, we have an ongoing collaboration on knowledge transfer and open-source projects with the University of Buenos Aires. |
| 68 | + |
| 69 | +## License |
| 70 | + |
| 71 | +Scout is licensed and distributed under a MIT license. [Contact us](https://www.coinfabrik.com/) if you're looking for an exception to the terms. |
0 commit comments