Nightshade Bring Security Analysis come Midnight’s Compact Contracts

Nightshade na static analysis tool wey dem design to help developers review smart contracts wey dem write for Compact, the programming language wey people dey use build applications for Midnight.

Wu introduce am for Midnight Forum on October 29, and the tool dey check source code against 96 rules and e dey flag patterns wey fit need closer look. The findings dey point the exact line of code wey relate to the matter and e include info wey go help developers investigate the issue well.

Nightshade Dey Check Compact Code for Security Patterns

Static analysis dey examine source code without to run the contract. Nightshade dey use this approach to find patterns wey relate to privacy, authorization, and other parts of the contract logic.

One example wey Wu identify involve private secret wey dem publish go the ledger after dem don use am for authorization check. Developer fit intend to use the secret to confirm user permission while e still keep the value private. If dem publish am afterward, e fit expose information wey suppose remain protected.

Other checks dey look for discarded signature verification results and cases wey witness values dey treated as proof of identity. The tool still dey flag patterns wey involve caller-supplied time without bound based on chain time, plus Merkle proofs wey dem no check for membership.

For each finding, Nightshade dey provide the relevant source line, the path wey the data take, and suggested fix, according to Wu. This one dey give developer starting point to examine how value dey move through the contract and where the flagged behavior dey happen.

Warning on its own no mean say dem don exploit contract or say information don leak. Likewise, even if analysis complete, e no be guarantee say the contract secure.

Dickson Wu Share Nightshade Test Results

Wu evaluate Nightshade against test cases wey get deliberately planted bugs. E report say the tool detect 263 of 266 positive cases wey the evaluation cover.

The developer still test corrected versions of those cases. Nightshade no produce any warning for 240 of 242 fixed versions, but e issue findings for the other two. The results just describe the test cases wey dem use for that evaluation and e no establish detection rate for every possible security issue.

After that, Wu run the tool against 300 public Compact contracts from 144 repositories. E report say no crash happen during the exercise and e identify 258 contracts wey receive complete analysis.

The difference important because to complete scan and to find no issues be two separate results. According to Wu, contracts wey no receive full analysis, dem report them as incomplete, no be as clean.

The developer publish the evaluation method and test counts alongside the tool, so others fit examine how dem take get the reported results.

[NEWSBREAK]

Offline Analysis and Developer Integration

Nightshade dey run locally and e no need internet connection or Compact compiler to scan source code, according to Wu. The tool dey support Compact compiler versions 0.28 through 0.35.

Developers fit view findings as text or export them for JSON and SARIF formats. GitHub Action still dey available to display results during review of proposed code changes, placing the findings inside workflow wey developers fit already dey use to examine updates.

The tool dey released under the Apache 2.0 open-source license. Wu introduce version 0.1.1 and invite developers to share feedback, report false positives, and suggest additional rules.