VaultLint is a security linter for Rust and Anchor smart contracts. Find missing signer checks, PDA mistakes and unsafe CPIs in minutes — without waiting weeks for a full audit.
$ cargo install vaultlintFree and open source. Runs offline by default — no account, no telemetry.
$ vaultlint scan examples/vulnerable
→ analyzing 5 Rust files …
✗ HIGH missing owner check
examples/vulnerable/missing_owner.rs:5
Account data is deserialised without verifying the account owner. An attacker
can pass a look-alike account owned by another program.
Use `Account<'info, T>`, which checks the owner and discriminator, or add
`require_keys_eq!(*account.owner, crate::ID)` before reading.
https://vaultlint.com/rules/VL002/
⚠ MED overflow-checks is not enabled
Cargo.toml:1
This workspace does not set `overflow-checks = true` under `[profile.release]`.
Solana programs are built in release mode, so arithmetic that overflows wraps
silently instead of aborting the transaction.
Add `[profile.release]` with `overflow-checks = true` to the workspace manifest.
Overflow then aborts the transaction instead of writing a wrapped value.
https://vaultlint.com/rules/VL003/
⚠ MED non-canonical PDA bump
examples/vulnerable/pda_bump.rs:7
`vault` uses `bump = user_bump`, where `user_bump` is an `#[instruction]`
argument. An attacker controls this value and can pass a non-canonical bump to
address a different account.
Store the canonical bump (from `init`) in the account data and validate with
`bump = <account>.bump`.
https://vaultlint.com/rules/VL004/
…
7 issues found · 1 high · 4 medium · 2 low
$ echo $?
1The problem
Audits are slow and expensive
Getting a full Solana smart contract audit costs $30k+ and takes weeks. Fine for a mature protocol, brutal for a small team shipping now.
Most tools target Solidity
Slither, Mythril, MythX — Ethereum-first. For Solana/Rust/Anchor the self-serve options are thin.
One missing check = drained
A forgotten signer constraint or unchecked CPI can empty the vault on the first mainnet block.
How it works
cargo install vaultlint, then vaultlint scan ./programs. Works with Anchor and raw Solana programs.
VaultLint reads your program the way an auditor would — accounts, seeds, CPIs, math. Offline by default, in milliseconds; your code never leaves your machine.
Each finding names the file, line, why it's dangerous, and how to fix it. Runs in CI on every PR.
What we check
Every rule in the vulnerability scanner is written for the way Solana programs actually break — not ported from an EVM checklist. Each one has a page stating exactly what it flags and what it deliberately ignores.
An unvalidated authority account whose key goes into the seeds of an account this instruction creates.
Account data deserialised by hand while nothing proves which program owns the account.
overflow-checks is not enabledThe workspace root does not set overflow-checks, so release-mode arithmetic wraps silently.
A seeds constraint validated against a bump the caller supplied, so the address is not pinned.
A cross-program invocation whose program id is read off an account the caller chose.
VL002 is the only rule that can report High, so at the default --fail-on high it is the only one that fails a build. Test and fuzz code is never scanned.
VaultLint complements — it doesn't replace — a full manual audit. It catches the common, expensive mistakes early, so the audit can focus on the hard stuff.
Why VaultLint
Not a Solidity tool with a Rust checkbox. Every rule is written for Rust smart contract security on Anchor and native Solana programs.
One binary, no build of your program required. Emits SARIF, so findings land as annotations on the pull request instead of after mainnet.
A $30k firm audit takes weeks. VaultLint is on crates.io under MIT/Apache-2.0, answers in minutes, and costs nothing.
Hand-written rules, each measured against real production code and narrowed until it stopped crying wolf. Fewer, higher-signal findings — not walls of noise.
Research
An audit describes the code that existed on the day it was written. We went and asked mainnet how long that stays true.
More in reports.
Releases
The three most recent releases are below; the changelog has the full history. VaultLint follows semantic versioning, and a patch release only ever makes a rule quieter — it will not start reporting something your last clean build passed.
Fewer false positives, and a scan that survives whatever you point it at.
#[access_control(...)], so a check written in an Anchor guard silences the finding it covers.create_program_address call whose bump comes from account data — the rule was firing on the very fix it recommends.First public release.
overflow-checks not enabled, VL004 non-canonical PDA bump, VL005 unchecked CPI to unknown program.human, json and sarif — plus --fail-on to gate CI on severity.// vaultlint:allow VL001 suppression, and Anchor + overflow-checks detection from your Cargo.toml.VaultLint is published on crates.io under MIT/Apache-2.0. It needs a Rust toolchain and nothing else — no account, no API key, and no network access unless you ask for it with --mainnet.
$ cargo install vaultlint
$ vaultlint scan ./programs