How decurity/semgrep-smart-contracts works
This repository is a Semgrep rule pack for smart-contract vulnerabilities and gas optimizations. The main workflow is that an engineer selects rules and supplies smart-contract source to Semgrep, which evaluates the rules and reports matches. The rules span Solidity security, performance and best practices, plus Cairo and Rust. The README documents local and registry-based use; implementation details of the external Semgrep engine are outside this repository.
Main entry points: security Security Rules · performance Performance Rules · best-practice Best Practices · cairo Cairo Rules
Components 10
Solidity Rules
- Security Rules
solidity/security - Performance Rules
solidity/performance - Best Practices
solidity/best-practice
Other Languages
- Cairo Rules
cairo - Rust Rules
rust
Scanning Workflow
- Semgrep Engine
- Rule Findings
Other components
- Engineer
- Target Contracts
- Semgrep Registry
Connections 11
- Engineer → Semgrep Engine: runs scan
- Engineer → Target Contracts: supplies source
- Semgrep Engine → Target Contracts: scans
- Security Rules → Semgrep Engine: configures
- Performance Rules → Semgrep Engine: configures
- Best Practices → Semgrep Engine: configures
- Cairo Rules → Semgrep Engine: configures
- Rust Rules → Semgrep Engine: configures
- Semgrep Engine → Rule Findings: reports matches
- Rule Findings → Engineer: returns results
- Semgrep Registry → Semgrep Engine: provides rules