cairo-vulnerability-scanner

Scanning Cairo projects requires static analysis tooling and direct access to the project's source code. The scanner analyzes single or multiple contract files to surface security issues with specific file references and severity ratings for each finding.

An automated security audit detects six critical StarkNet vulnerability patterns, specifically targeting overflow-prone arithmetic, L1-L2 messaging issues, and signature replay risks. It provides concrete remediation steps and best-practice recommendations for each detected vulnerability.

Yes, you can analyze multiple files in a Cairo project for L1-L2 messaging issues. The scanner performs contract-wide analysis across your entire Cairo project and StarkNet outputs, surfacing risk patterns with file references to help prioritize fixes.

Static analysis tooling is required to perform a Cairo security audit using this scanner. You must also provide direct access to the project's source code so the tool can analyze single or multiple contract files and surface critical security issues.

The best way to remediate signature replay risks in Cairo contracts is to use the scanner's actionable remediation feature. It analyzes your code for replay vulnerabilities and provides concrete fixes alongside best-practice recommendations to secure your StarkNet outputs.

A limitation of automated vulnerability scanning for StarkNet outputs is its strict dependency on static analysis tooling and direct source code access. It cannot analyze compiled bytecode without source, and scanning is restricted to six specific vulnerability patterns.