STACY - Stacks Static Analyzer for Clarity
Stacy is an open-source static analyzer for Clarity smart contracts. It is intended to assist Clarity smart contract developers and auditors detect common security issues and deviations from best practices.
This tool will help developers write secure and more robust smart contracts.
Install
HTTPS
git clone --recurse-submodules -j8 https://github.com/CoinFabrik/stacy.git
cd stacy
make
SSH
git clone --recurse-submodules -j8 git@github.com:CoinFabrik/stacy.git
cd stacy
make
If you already have an initialized python venv, use make install
If you have a shell other than bash, use make <shell>
Run
stacy-analyzer lint <path/to/.clar>
You can run recursively over all .clar files in a directory. For this, run
stacy-analyzer lint <path/to/contract/folder>
Tests
To run tests, run
make test
Common issues
tree-sitter-clar installation fails
If the installation of tree-sitter-clar fails, go into stacks_analyzer/tree-sitter-clarity and run
tree-sitter generate && tree-sitter-build
Ensure that the submodule is loaded.
Documentation
Detectors
Severities are based on worst case scenarios and the detector's finding may vary depending on the context.
| Detector ID | What it Detects | Test Cases | Severity |
|---|---|---|---|
| assert-block-height | Usage of block-height as time tracker. |
1 | Critical |
| call-inside-as-contract | Calling another contract losing the first contract's context. | 1 | Critical |
| divide-before-multiply | Performing a division operation before a multiplication, leading to loss of precision. | 1 | Critical |
| private-function-not-used | Dead code(private functions) inside the smart contract. | 1 | Enhancement |
| todo-comment | TODO comments left in the smart contract. | 1 | Enhancement |
| tx-sender-in-assert | Usage of tx-sender in assert is truly intended. | 1 | High |
| unwrap-panic-usage | Inappropriate usage of the unwrap-panic method, causing unexpected program crashes. |
1 | Enhancement |
| var-could-be-constant | Code that does not change and could be re-define. | 1 | Enhancement |
| updated-functions | Old functions. | 1 | Enhancement |
| tx-sender-in-assert | Usage of tx-sender in assert is truly intended. | 1 | High |
| unwrap-panic-usage | Inappropriate usage of the unwrap-panic method, causing unexpected program crashes. |
1 | Enhancement |
| var-could-be-constant | Code that does not change and could be re-define. | 1 | Enhancement |
About CoinFabrik
We - CoinFabrik - are a research and development company specialized in Web3, with a strong background in cybersecurity. Founded in 2014, we have worked on over 180 blockchain-related projects, EVM based and also for Solana, Algorand, and Polkadot. Beyond development, we offer security audits through a dedicated in-house team of senior cybersecurity professionals, currently working on code in Substrate, Solidity, Clarity, Rust, and TEAL.
Our team has an academic background in computer science and mathematics, with work experience focused on cybersecurity and software development, including academic publications, patents turned into products, and conference presentations. Furthermore, we have an ongoing collaboration on knowledge transfer and open-source projects with the University of Buenos Aires.
License
Stacy is licensed and distributed under a MIT license. Contact us if you're looking for an exception to the terms.
1 maintainer
Metadata
1 maintainer
Release files for stacy-analyzer 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| stacy_analyzer-0.1.0.tar.gz | 14.2 kB | Without provenance | Details for stacy_analyzer-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| stacy_analyzer-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for stacy_analyzer-0.1.0-py3-none-any.whl |
Total release size: 31.1 kB
Release files / stacy_analyzer-0.1.0.tar.gz
| Download URL | stacy_analyzer-0.1.0.tar.gz |
|---|---|
| Size | 14.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
1b4cfacbe6df964e97a223a757eeb489ae7f2a648cb813709506d99ffbb420f3
|
|
BLAKE2b-256 checksum How to use checksums |
be340c4c4bd61d671bf3fad8805adffe13b278dd13268067834ec39f344bbcf4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.0.0 CPython/3.12.3
|
Release files / stacy_analyzer-0.1.0-py3-none-any.whl
| Download URL | stacy_analyzer-0.1.0-py3-none-any.whl |
|---|---|
| Size | 16.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
dc0915f628220e9f538c447c5d026b6195e04d9a83ee7d288387bb5e0dfe9fce
|
|
BLAKE2b-256 checksum How to use checksums |
38380f2853dab3337f1ddf16dfd9291fd3280cfd12d78059758b4fe5d1ceaaa6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.0.0 CPython/3.12.3
|
Security for stacy-analyzer 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
