Rustle: the First Automatic Auditor for NEAR Community

Rustle, developed by BlockSec, is an automatic auditor for NEAR smart contracts, offering comprehensive vulnerability detection and analysis.

Rustle: the First Automatic Auditor for NEAR Community

We are thrilled to release Rustle: the first automatic auditor offered by BlockSec for NEAR community.

Rustle has several great features:

  • Rustle can currently detect 20+ types of issues in the NEAR contract. See the section Detectors for the full detector list.
  • Rustle is easy to use. We provide thorough installation commands and tutorials. Furthermore, we also prepare a docker for users for quick start.
  • Rustle is rather swift, most of the NEAR contracts can be analyzed within 3 minutes.
  • Rustle is user-friendly with reports in both CSV and JSON format. We also provide a script to help you import the result to Notion.


All vulnerabilities Rustle can detect. The detail documentation can be found here.

Detector Id Description Severity
unhandled-promise Detects Promises that are not handled High
non-private-callback Missing macro #[private] for callback functions High
reentrancy Finds functions that are vulnerable to reentrancy attack High
unsafe-math Lack of overflow check for arithmetic operation High
self-transfer Missing check of sender != receiver High
incorrect-json-type Incorrect type used in parameters or return values High
div-before-mul Precision loss due to incorrect operation order Medium
round Rounding without specifying ceil or floor Medium
lock-callback Panic in callback function may lock contract Medium
yocto-attach No assert_one_yocto in privileged function Medium
prepaid-gas Missing check of prepaid gas in ft_transfer_call Low
non-callback-private Macro #[private] used in non-callback function Low
unused-ret Function result not used or checked Low
upgrade-func No upgrade function in contract Low
tautology Tautology used in conditional branch Low
inconsistency Use of similar but slightly different symbol Low
timestamp Find all uses of timestamp Info
complex-loop Find all loops with complex logic which may lead to DoS Info
ext-call Find all cross-contract invocations Info
promise-result Find all uses of promise result Info
transfer Find all transfer actions Info

How to use

We utilize Rustle to analyze a popular NEAR contract (i.e., LiNEAR). Commands have been tested in Ubuntu 20.04 LTS.

  1. Follow the installation manual on the GitHub page. If you want to use docker, skip this and go to the docker manual.

  2. Prepare the NEAR contract for Rustle to analyze.

     git clone ~/near-repo/LiNEAR
  3. Start analysis by running ./rustle.

     ./rustle -t ~/near-repo/LiNEAR ~/near-repo/LiNEAR/contracts/linear
  1. Check the report at audit-result/summary.csv
  1. You can specify which detectors or severity groups to use.

./rustle -h for details.


./rustle -t ~/near-repo/LiNEAR ~/near-repo/LiNEAR/contracts/linear -d high,medium,complex-loop

One more thing

Rustle can be used in the development process to scan the NEAR smart contracts iteratively. This can save a lot of manual effort and mitigate part of potential issues. However, vulnerabilities in complex logic or related to semantics are still the limitation of Rustle. Locating complicated semantic issues requires the experts in BlockSec to conduct exhaustive and thorough reviews. Contact us for audit service.

Issues and PRs are also welcomed.

About BlockSec

BlockSec is a pioneering blockchain security company established in 2021 by a group of globally distinguished security experts. The company is committed to enhancing security and usability for the emerging Web3 world in order to facilitate its mass adoption. To this end, BlockSec provides smart contract and EVM chain security auditing services, the Phalcon platform for security development and blocking threats proactively, the MetaSleuth platform for fund tracking and investigation, and MetaSuites extension for web3 builders surfing efficiently in the crypto world.

To date, the company has served over 300 esteemed clients such as MetaMask, Uniswap Foundation, Compound, Forta, and PancakeSwap, and received tens of millions of US dollars in two rounds of financing from preeminent investors, including Matrix Partners, Vitalbridge Capital, and Fenbushi Capital.

Official website:

Official Twitter account:

Sign up for the latest updates