# Caracal | Static Analyzer For Starknet Smart Contracts **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, hacking\ **Created:** [October 13, 2023, 9:38pm UTC](https://onehack.st/t/caracal-static-analyzer-for-starknet-smart-contracts/258905 "2023-10-13T21:38:24Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\ **Post date:** [October 13, 2023, 9:38pm UTC](https://onehack.st/t/caracal-static-analyzer-for-starknet-smart-contracts/258905/1 "2023-10-13T21:38:24Z")
![image](https://onehack.st/uploads/default/original/3X/8/7/870b49d46f2a74f1b09573cc1776ebc62a937772.jpeg) # [Caracal](https://github.com/crytic/caracal#caracal) Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. ## [Features](https://github.com/crytic/caracal#features) - Detectors to detect vulnerable Cairo code - Printers to report information - Taint analysis - Data flow analysis framework - Easy to run in Scarb projects ## [Installation](https://github.com/crytic/caracal#installation) ### [Precompiled binaries](https://github.com/crytic/caracal#precompiled-binaries) Precompiled binaries are available on our [releases page](https://github.com/crytic/caracal/releases). If you are using Cairo compiler 1.x.x uses the binary v0.1.x otherwise if you are using the Cairo compiler 2.x.x uses v0.2.x. ### [Building from source](https://github.com/crytic/caracal#building-from-source) You need the Rust compiler and Cargo. Building from git: cargo install --git [https://github.com/crytic/caracal](https://github.com/crytic/caracal) --profile release --force Building from a local copy: git clone [https://github.com/crytic/caracal](https://github.com/crytic/caracal) cd caracal cargo install --path . --profile release --force ## [Usage](https://github.com/crytic/caracal#usage) List detectors: caracal detectors List printers: caracal printers ### [Standalone](https://github.com/crytic/caracal#standalone) To use with a standalone cairo file and you have a local cairo compiler binary it’s enough to point it to the file. Otherwise otherwise a bundled compiler is used and you need to pass the path to the [corelib](https://github.com/starkware-libs/cairo/tree/main/corelib) library either with the `--corelib` cli option or by setting the `CORELIB_PATH` environment variable. Run detectors: caracal detect path/file/to/analyze caracal detect path/file/to/analyze --corelib path/to/corelib/src Run printers: caracal print path/file/to/analyze --printer printer\_to\_use --corelib path/to/corelib/src ### [Cairo project](https://github.com/crytic/caracal#cairo-project) If you have a cairo project with multiple files and contracts you may need to specify which contracts with `--contract-path`. The local cairo compiler binary is used if available otherwise a bundled compiler is used. In the latter case you also need to specify the corelib as explained above for the standalone case. The path is the directory where `cairo_project.toml` resides. Run detectors: caracal detect path/to/dir caracal detect path/to/dir --contract-path token::myerc20::… token::myerc721::… Run printers: caracal print path/to/dir --printer printer\_to\_use ### [Scarb](https://github.com/crytic/caracal#scarb) If you have a project that uses Scarb you need to add the following in Scarb.toml: [[target.starknet-contract]] sierra = true [cairo] sierra-replace-ids = true Then pass the path to the directory where Scarb.toml resides. Run detectors: caracal detect path/to/dir Run printers: caracal print path/to/dir --printer printer\_to\_use ## [Detectors](https://github.com/crytic/caracal#detectors) | Num | Detector | What it Detects | Impact | Confidence | Cairo | | --- | --- | --- | --- | --- | --- | | 1 | `controlled-library-call` | Library calls with a user controlled class hash | High | Medium | 1 & 2 | | 2 | `unchecked-l1-handler-from` | Detect L1 handlers without from address check | High | Medium | 1 & 2 | | 3 | `felt252-unsafe-arithmetic` | Detect user controlled operations with felt252 type, which is not overflow/underflow safe | Medium | Medium | 1 & 2 | | 4 | `reentrancy` | Detect when a storage variable is read before an external call and written after | Medium | Medium | 1 & 2 | | 5 | `read-only-reentrancy` | Detect when a view function read a storage variable written after an external call | Medium | Medium | 1 & 2 | | 6 | `unused-events` | Events defined but not emitted | Medium | Medium | 1 & 2 | | 7 | `unused-return` | Unused return values | Medium | Medium | 1 & 2 | | 8 | `unenforced-view` | Function has view decorator but modifies state | Medium | Medium | 1 | | 9 | `unused-arguments` | Unused arguments | Low | Medium | 1 & 2 | | 10 | `reentrancy-benign` | Detect when a storage variable is written after an external call but not read before | Low | Medium | 1 & 2 | | 11 | `reentrancy-events` | Detect when an event is emitted after an external call leading to out-of-order events | Low | Medium | 1 & 2 | | 12 | `dead-code` | Private functions never used | Low | Medium | 1 & 2 | | 13 | `array-use-after-pop-front` | Detect use of an array after removing element(s) | Low | Medium | 1 & 2 | The Cairo column represent the compiler version(s) for which the detector is valid. ## [Printers](https://github.com/crytic/caracal#printers) - `cfg`: Export the CFG of each function to a .dot file - `callgraph`: Export function call graph to a .dot file ## [How to contribute](https://github.com/crytic/caracal#how-to-contribute) Check the wiki on the following topics: - [How to write a detector](https://github.com/crytic/caracal/wiki/How-to-write-a-detector) - [How to write a printer](https://github.com/crytic/caracal/wiki/How-to-write-a-printer) ## [Limitations](https://github.com/crytic/caracal#limitations) - Inlined functions are not handled correctly. - Since it’s working over the SIERRA representation it’s not possible to report where an error is in the source code but we can only report SIERRA instructions/what’s available in a SIERRA program. ## GitHub: > **[GitHub - crytic/caracal: Static Analyzer for Starknet smart contracts](https://github.com/crytic/caracal)** > > Static Analyzer for Starknet smart contracts