>_ vertexy _
VERTEXY::SYSTEM_ONLINE [SOLANA]

// OPEN_SOURCE :: SECURITY_TOOLCHAIN

VERTEXY

Solana program security analysis
source scanning█

Audit Rust source, inspect Anchor constraints, fetch deployed programs, disassemble sBPF, and map control flow from one CLI.

$ git clone vertexy ./ explore commands $ $VERTEXY
Vertexy logo
vertexy@local:~/solana/program bash
vertexy@local:~/program$ █
STATIC_ANALYSIS//ANCHOR_RECAP//SBPF_DISASSEMBLY//CFG_GENERATION//RPC_FETCH//STARLARK_RULES// STATIC_ANALYSIS//ANCHOR_RECAP//SBPF_DISASSEMBLY//CFG_GENERATION//RPC_FETCH//STARLARK_RULES//

// 01 :: COMMAND_SURFACE

ONE BINARY.
FULL ANALYSIS PATH.

[01/04]
01

scan

Run source-level security analysis with bundled or custom Starlark rules.

$ vertexy scan --target-dir ./program
02

recap

Extract instruction, signer, writable-account, PDA, and constraint context from Anchor.

$ vertexy recap --target-dir ./anchor
03

fetch

Pull executable programs, ProgramData, or raw accounts from a Solana RPC endpoint.

$ vertexy fetch --program-id <ADDRESS>
04

reverse

Disassemble sBPF, track immediates, label functions, and generate control-flow graphs.

$ vertexy reverse --mode both --bytecodes-file program.so
05

ast

Expose Rust syntax-tree data for building and debugging custom detections.

$ vertexy ast --file-path ./src/lib.rs --starlark-syn-ast
06

build

Build Anchor or native SBF programs and stage compiled program binaries.

$ vertexy build --target-dir ./program

// 02 :: ANALYSIS_PIPELINE

FROM SOURCE
TO BYTECODE.

[02/04]
0x01INGESTRust / Anchor / .so / RPC
0x02PARSEAST / account metadata
0x03ANALYZERules / sBPF / immediates
0x04MAPFindings / CFG / recap
rules/syn_ast/example.starUTF-8 
01 def detect(node):
02     # inspect prepared Rust AST
03     if is_instruction(node):
04         accounts = node.accounts
05         for account in accounts:
06             if requires_signer(account):
07                 emit(
08                     severity="high",
09                     message="signer validation"
10                 )
11
12 register(detect)

// RULE_ENGINE :: STARLARK

EXTEND THE SCANNER.
DON'T RECOMPILE IT.

Readable Starlark rules make it possible to add project-specific checks while keeping the core CLI stable. Vertexy ships with checks for common Solana security patterns and lets you bring your own rules.

  • [+] signer + owner validation
  • [+] arbitrary CPI patterns
  • [+] PDA sharing + bump handling
  • [+] duplicate mutable accounts
  • [+] reinitialization + realloc risks
  • [+] checked arithmetic misuse

// 03 :: BOOT_SEQUENCE

CLONE. BUILD.
ANALYZE.

[03/04]
01git clone https://github.com/AndrewKCollins/vertexy.git
02cd vertexy
03cargo install --path .
04vertexy --help

// SOURCE_AVAILABLE :: REVIEW / FORK / CONTRIBUTE

READ THE CODE.
BREAK THE ASSUMPTIONS.

TOKEN_CA::CA_PENDING
$ open github_repository