Hi — I maintain sdkt, an offline Soroban dev/security toolkit (crates.io sdkt-cli; GitHub SaboLabs/soroban-devkit). I ran its static analyzer against your public contracts/sharpy/src/lib.rs as a read-only evaluation.
cargo install sdkt-cli
sdkt audit contracts/sharpy/src/lib.rs
Local result on current main: 8 critical AUTH-001 (privileged/admin functions lacking require_auth(), e.g. admin_key) + 41 MOVE-001 (env/arg reuse). These are TOOL FINDINGS requiring your review — some may be intentional read-only getters. sdkt audit can also run as a PR gate via the repo's GitHub Action.
Not asking you to adopt anything; just offering the tool for evaluation. No SCF/promo ask. Reproducible via the command above.
Hi — I maintain
sdkt, an offline Soroban dev/security toolkit (crates.iosdkt-cli; GitHub SaboLabs/soroban-devkit). I ran its static analyzer against your publiccontracts/sharpy/src/lib.rsas a read-only evaluation.Local result on current
main: 8 critical AUTH-001 (privileged/admin functions lacking require_auth(), e.g.admin_key) + 41 MOVE-001 (env/arg reuse). These are TOOL FINDINGS requiring your review — some may be intentional read-only getters.sdkt auditcan also run as a PR gate via the repo's GitHub Action.Not asking you to adopt anything; just offering the tool for evaluation. No SCF/promo ask. Reproducible via the command above.