static analysis · substrate honesty

The honest hack.

Most hacks make a system do something it shouldn't. A white hack makes it tell more truth — it scans your code for the places it lies about its own state.


          node bin/whitehack.js scan .

View on GitHub

MIT · no telemetry · ~250 lines you can read in a sitting

The small lies software tells about itself

The failed read that silently becomes 0. The cached value served as if it were live. The stale price oracle read as current. The token transfer whose failure is dropped on the floor. The score shown to a person with no way to ask why.

These usually aren't bugs in the ordinary sense — the code runs fine. It just isn't honest about its own state, and someone downstream trusts it anyway.

What it checks

8 checks · 2 doctrines

General · JS / TS / JSX

silent-failure medium-high

A read that fails to a falsy default — “could not read” becomes a confident wrong value.

cache-as-live heuristic

A cached / snapshot value returned with no freshness marker — stale read as live.

decision-without-why heuristic

A score / fee / fraud flag shown to a person with no way to ask why.

float-money medium-high

Currency in a binary float — an “exact” amount that silently loses cents.

Blockchain · Solidity

stale-oracle medium-high

A price feed read without checking updatedAt — a halted feed served as a live price.

unchecked-transfer medium-high

An ERC-20 transfer whose bool result is dropped — a failed transfer looks successful.

spot-price-as-fair heuristic

A price from instantaneous reserves — flash-loan-movable, presented as fair value.

silent-revert heuristic

A require()/revert() with no reason — a refusal nobody can inspect.

It would have caught these — on the PR

Run against faithful reconstructions of documented, money-losing incidents. Small hand-built corpus — a demonstration, not a statistical benchmark.

5 / 5

vulnerable lines flagged

false positives on the fixed code

real incidents reproduced (Sherlock #579 · OWASP SC02)

Honest about itself

A honesty tool that overstated its own certainty would be the first thing it ought to flag. So:

✓ It uses heuristics — text patterns, not a full understanding of your program. A flagged line may be a false positive.
✓ Every finding carries a confidence label; only confident findings affect the exit code, so heuristic noise never breaks a CI gate.
✓ An empty result is not proof the code is honest. It surfaces common lies — it cannot prove their absence.
✓ It is a fast, low-noise continuous check — not an audit replacement.
✓ Run it on its own source and it comes back clean.

Quickstart

# clone it — it's small and dependency-free
git clone https://github.com/cambridgetcg/whitehack && cd whitehack

# scan a directory (default: .)
node bin/whitehack.js scan path/to/repo

# exit code is non-zero only on medium-high findings — safe for CI