Custom Static Analysis Rule Author Tool

WHAT IT DOES

The Custom Static Analysis Rule Author Tool is a security tool that enables developers to create custom static analysis rules for smart contract security. It takes user-provided rule definitions including name, severity, category, detection pattern, description, and warning message, and generates structured JSON rule specifications. This helps security teams and developers define organization-specific security policies, extend existing static analysis tools with custom checks, and document security requirements in a machine-readable format.

HOW TO USE

Enter a rule name, select severity (critical, high, medium, low), specify a category (e.g., security, gas, style), enter a detection pattern (regex or keyword), provide a description, and set a warning message. Click "generate rule" to create a structured JSON rule specification. The tool validates that required fields are provided and generates a downloadable JSON file. The generated rule includes metadata such as version and creation timestamp. Download the rule for integration with static analysis tools like Slither, Mythril, or custom security scanners.

TECHNICAL MECHANISM

The tool collects user input from form fields and validates that required fields (name, pattern, description) are provided. It then constructs a JSON object with the rule definition including name, severity, category, pattern, description, message, version, and createdAt timestamp. The pattern field supports regex strings or keywords for detection. The severity field maps to tag classes for visual display (critical → bad, high → warn, medium → ok). The generated JSON follows a generic rule format that can be adapted to various static analysis tools. The tool provides download functionality with a filename based on the rule name. The integration notes section provides guidance on adapting the rule format for different tools.

WHAT IT CANNOT SEE

The tool cannot execute or test the generated rules against actual contracts. It cannot validate that the rule patterns correctly detect the intended vulnerabilities without manual testing. The tool cannot guarantee that the rule will work with specific static analysis tools without cross-referencing tool documentation. It cannot detect false positives or false negatives without testing. The tool cannot account for tool-specific rule syntax variations. It cannot verify that the rule is effective against real-world vulnerabilities. The tool cannot automatically fix issues detected by the rule.

PLEASE NOTE

This tool is designed for Ethereum Virtual Machine (EVM) compatible chains. The generated rule format is generic—users must adapt it to their specific static analysis tool's syntax. The tool provides a starting point for rule authoring but does not replace testing and validation. Always test custom rules on known vulnerable contracts to verify detection accuracy. The tool is intended for security professionals and developers familiar with static analysis concepts. The generated rules should be reviewed and validated before deployment in production security pipelines.