Nightshade Brings Security Analysis to Midnight’s Compact Contracts

Nightshade is a static analysis tool designed to help developers review smart contracts written in Compact, the programming language used to build applications on Midnight.

Introduced by Wu on the Midnight Forum on October 29, the tool checks source code against 96 rules and flags patterns that may warrant closer examination. Its findings identify the relevant line of code and include information intended to help developers investigate the issue.

Nightshade Checks Compact Code for Security Patterns

Static analysis examines source code without requiring the contract to be run. Nightshade uses this approach to look for patterns related to privacy, authorization and other parts of a contract’s logic.

One example Wu identified involves a private secret being published to the ledger after it has been used in an authorization check. A developer might intend to use the secret to confirm a user’s permission while keeping the underlying value private. Publishing it afterward could expose information that was meant to remain protected.

Other checks look for discarded signature verification results and cases where witness values are treated as proof of identity. The tool also flags patterns involving caller-supplied time without a bound based on chain time, as well as Merkle proofs that are not checked for membership.

For each finding, Nightshade provides the relevant source line, the path taken by the data and a suggested fix, according to Wu. This gives a developer a starting point for examining how a value moves through the contract and where the flagged behavior occurs.

A warning does not, by itself, establish that a contract has been exploited or that information has been exposed. Similarly, a completed analysis is not a guarantee that a contract is secure.

Dickson Wu Shares Nightshade Test Results

Wu evaluated Nightshade against test cases containing deliberately planted bugs. He reported that the tool detected 263 of 266 positive cases covered by the evaluation.

The developer also tested corrected versions of those cases. Nightshade produced no warning for 240 of 242 fixed versions, while issuing findings for the other two. The results describe the test cases used in that evaluation and do not establish a detection rate for every possible security issue.

Wu then ran the tool against 300 public Compact contracts from 144 repositories. He reported no crashes during the exercise and identified 258 contracts that received a complete analysis.

The distinction matters because completing a scan and finding no issues are separate results. According to Wu, contracts that did not receive a full analysis were reported as incomplete rather than treated as clean.

The developer published the evaluation method and test counts alongside the tool, allowing others to examine how the reported results were obtained.

[NEWSBREAK]

Offline Analysis and Developer Integration

Nightshade runs locally and does not require an internet connection or a Compact compiler to scan source code, according to Wu. The tool supports Compact compiler versions 0.28 through 0.35.

Developers can view findings as text or export them in JSON and SARIF formats. A GitHub Action is also available to display results during the review of proposed code changes, placing the findings within a workflow developers may already use to examine updates.

The tool is released under the Apache 2.0 open-source license. Wu introduced version 0.1.1 and invited developers to share feedback, report false positives and suggest additional rules.