By Protofire
This is an open source project for linting Solidity code. This project provides both Security and Style Guide validations.
You can install Solhint using npm:
npm install -g solhint
# verify that it was installed correctly
solhint --version
First initialize a configuration file, if you don't have one:
solhint --init
This will create a .solhint.json file with the default rules enabled. Then run Solhint with one or more Globs as arguments. For example, to lint all files inside contracts directory, you can do:
solhint 'contracts/**/*.sol'
To lint a single file:
solhint contracts/MyToken.sol
Run solhint without arguments to get more information:
Usage: solhint [options] <file> [...other_files]
Linter for Solidity programming language
Options:
-V, --version output the version number
-f, --formatter [name] report formatter name (stylish, table, tap, unix, json, compact)
-w, --max-warnings [maxWarningsNumber] number of allowed warnings
-c, --config [file_name] file to use as your .solhint.json
-q, --quiet report errors only - default: false
--ignore-path [file_name] file to use as your .solhintignore
--fix automatically fix problems and show report
--noPrompt do not suggest to backup files when any `fix` option is selected
--init create configuration file for solhint
--disc do not check for solhint updates
--save save report to file on current folder
-h, --help output usage information
Commands:
stdin [options] linting of source code data provided to STDIN
list-rules display covered rules of current .solhint.json
--disc option avoids that check.--save option will create a file named as YYYYMMDDHHMMSS_solhintReport.txt on current folder with default or specified formatThis option currently works on:
You can use a .solhint.json file to configure Solhint for the whole project.
To generate a new sample .solhint.json file in current folder you can do:
solhint --init
This file has the following format:
{
"extends": "solhint:default"
}
The solhint:default configuration contains only two rules: max-line-length & no-console
{
"extends": "solhint:recommended",
"plugins": [],
"rules": {
"avoid-suicide": "error",
"avoid-sha3": "warn"
}
}
A full list of all supported rules can be found here.
To ignore files that do not require validation you can use a .solhintignore file. It supports rules in
the .gitignore format.
node_modules/
additional-tests.sol
The default rulesets provided by solhint are the following:
Use one of these as the value for the "extends" property in your configuration file.
You can use comments in the source code to configure solhint in a given line or file.
For example, to disable all validations in the line following a comment:
// solhint-disable-next-line
uint[] a;
You can disable specific rules on a given line. For example:
// solhint-disable-next-line not-rely-on-time, not-rely-on-block-hash
uint pseudoRand = uint(keccak256(abi.encodePacked(now, blockhash(block.number))));
Disable validation on current line:
uint pseudoRand = uint(keccak256(abi.encodePacked(now, blockhash(block.number)))); // solhint-disable-line
Disable specific rules on current line:
uint pseudoRand = uint(keccak256(abi.encodePacked(now, blockhash(block.number)))); // solhint-disable-line not-rely-on-time, not-rely-on-block-hash
You can disable a rule for a group of lines:
/* solhint-disable avoid-tx-origin */
function transferTo(address to, uint amount) public {
require(tx.origin == owner);
to.call.value(amount)();
}
/* solhint-enable avoid-tx-origin */
Or disable all validations for a group of lines:
/* solhint-disable */
function transferTo(address to, uint amount) public {
require(tx.origin == owner);
to.call.value(amount)();
}
/* solhint-enable */
Full list with all supported Security Rules
Full list with all supported Style Guide Rules
Full list with all supported Best Practices Rules
Related documentation you may find here.
The Solidity parser used is @solidity-parser/parser.
MIT
Solhint is free to use and open-sourced. If you value our effort and feel like helping us to keep pushing this tool forward, you can send us a small donation. We'll highly appreciate it :)
[4.0.0] - 2023-10-01
private-vars-leading-underscore rule to clarify its functionalityno-empty-blocks rule to clarify its functionality--disc) #506fix option now shows the report on screen #509save option to store report on disk with the standard or the specified format #509explicit-types rule #504no-console rule #513private-vars-leading-underscore rule #511one-contract-per-file ignore interfaces #514 (Thanks to @cruzdanilo)FAQs
Solidity Code Linter
We found that solhint demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.
Security News
The npm package for the LottieFiles Player web component was hit with a supply chain attack after a software engineer's npmjs credentials were compromised.