The Community Packages list and its guidelines are written for libraries
imported into a zkApp — published to npm, o1js as a peer dependency, TypeScript
with d.ts, tests exercising provable code. That's clearly the right bar for
libraries.
I've built something that doesn't fit that shape: o1js-scan, a static analyzer
that reads o1js source and flags application-layer soundness issues — bare
this.x.get() with no precondition, @method arguments and Provable.witness
results that reach a send or state write unconstrained, proof-typed arguments
that are never verified, editState/send permissions weakened to
proofOrSignature/none. It runs as a CLI and a GitHub Action, emits SARIF, and
is dependency-free.
https://github.com/auditinfra-io/o1js-scan
Is there a preferred home for developer tooling like this — a tooling section, a
docs page, or somewhere else? Happy to follow whatever convention you'd like.
The Community Packages list and its guidelines are written for libraries
imported into a zkApp — published to npm, o1js as a peer dependency, TypeScript
with d.ts, tests exercising provable code. That's clearly the right bar for
libraries.
I've built something that doesn't fit that shape: o1js-scan, a static analyzer
that reads o1js source and flags application-layer soundness issues — bare
this.x.get()with no precondition,@methodarguments andProvable.witnessresults that reach a send or state write unconstrained, proof-typed arguments
that are never verified,
editState/sendpermissions weakened toproofOrSignature/none. It runs as a CLI and a GitHub Action, emits SARIF, and
is dependency-free.
https://github.com/auditinfra-io/o1js-scan
Is there a preferred home for developer tooling like this — a tooling section, a
docs page, or somewhere else? Happy to follow whatever convention you'd like.