Practical overview
When it fits
Use Radar when a smart-contract team needs repeatable repository scans, commit-time checks or CI gating based on static-analysis findings.
Who it is for
- Smart-contract developers
- Security auditors
- Teams building automated contract security checks
Documented uses
- Scan contract repositories for vulnerable code patterns.
- Run reusable security templates and Python queries.
- Gate builds based on finding severity.
- Add recurring checks to GitHub Actions or pre-commit workflows.
- Create or use templates for additional detection patterns.
Requirements & limits
Radar is provided through a public GitHub repository and is identified with a GPL-3.0 license. The documented installation path requires Docker.
- Supported code ecosystems include Rust, Anchor, Stylus and Solidity.
- Reusable templates and Python queries allow rule-based detection.
- Exit codes and
--fail-onsupport build gating. - Baselines can separate existing findings from newly introduced findings.
- Test code is excluded by default and can be included with
--include-tests.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Install Radar and scan a contract repository
Install Radar and run a static analysis scan against a contract folder.
Before you start
- Docker installed and started.
- An installation script or a cloned Radar repository.
- A contract repository or folder to scan.
Steps
Install Docker and start it.
Install Radar with the provided installation script, or clone the repository and run its installation script.
Run Radar with the contract folder as the project path, such as
radar -p.For a documented repository test, clone
sealevel-attacksand runradar -p sealevel-attacks.
Expected outcome
Radar scans the selected contract project for documented security findings.
Guide limitations
- The documented process does not establish scan accuracy or coverage for every contract pattern.
- The repository test is an example and does not represent a required project type.
Add Radar as a pre-commit check
Run Radar during commits and stop the commit when findings meet the configured threshold.
Before you start
- Radar installed and available to the workflow.
- A Rust smart-contract repository using either a native Git hook or the pre-commit framework.
Steps
For a native hook, place the documented shell hook in
.git/hooks/pre-commit.Alternatively, add the documented local
run-radarhook to.pre-commit-config.yaml.Run Radar against the repository with
--ignore lowas shown in the documented examples.Use the hook's exit result to proceed with or abort the commit.
Expected outcome
The documented hook runs a Radar scan at commit time and aborts when the configured command returns a finding or error.
Guide limitations
- The supplied documentation describes the hook for Rust smart-contract repositories.
- The recipe does not document setup of the pre-commit framework itself.
- The native example installs Radar if it is missing, so its installation path depends on the referenced script.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 1 October 2026
- Original website title
- Auditware/radar · Official homepage title · retained in its source language