Caracal is a free, open-source static analyzer for Starknet smart contracts, made for developers and security reviewers who write or audit Cairo code. It examines contracts in their compiled form without running them, flagging patterns that often point to bugs or vulnerabilities. The project is written in Rust and its latest release is v0.2.3.
Before you start, note the project's age. The last code update is dated January 25, 2024, which is more than two years before this page was published. That does not make the tool useless, but you should expect it to lag behind newer Cairo and Starknet changes. Treat it as one layer in a review, test it on a non-critical project first, and compare its findings with other tools and manual reading of the code.
What Static Analysis Means for Starknet Contracts
Static analysis means examining source or compiled code without executing it. For smart contracts, this matters because a deployed contract handles real assets, and mistakes are often expensive to fix after launch. A static analyzer reads the program's structure and checks it against known patterns of risk.
Starknet contracts are written in Cairo and pass through Sierra, an intermediate representation that sits between Cairo source and the final bytecode. Analyzing at this level lets a tool work with a more regular form of the code than raw source text alone.
Static tools do not prove a contract is correct. They produce findings, some of which will be false positives, and some real problems will go unreported. Their value comes from speed and consistency: they check every file the same way each time the code changes, which is hard to do by hand at scale.
Who Caracal Is For
Caracal fits best with teams that already build on Starknet in Cairo. Smart contract developers can run it during development to catch problems before code reaches a testnet. Security reviewers who want a repeatable first pass before a manual audit will also find it useful.
Solo developers working on small Starknet projects may find it helpful as a learning tool, since each finding points to a specific code pattern worth understanding. Teams maintaining larger codebases can use the printers to get oriented in unfamiliar modules.
If your work centers on Solidity, Caracal is not the right starting point, because it targets Starknet and Cairo. Readers in that group should look at tools like Slither in our catalog. Newcomers to Cairo should learn the language basics first, since analyzer output is easier to act on when you can read the code it refers to.
Practical Scenarios for Starknet Code Reviews
Consider a team preparing a contract upgrade. Before merging the changes, a developer runs the analyzer on the affected Scarb project and reviews any new findings. Problems that appear only after the change are easy to trace, because the diff is small.
Another scenario is inheriting an older codebase. A reviewer who has never seen the project can use the analysis output to decide where to read first, rather than opening every file. This does not replace understanding the business logic, but it narrows the search.
A third use is training. Junior developers can run the analyzer on sample contracts and read each finding alongside the flagged code, building a habit of checking inputs and state changes. Each finding still needs human judgment, since a flag is a question to answer rather than a verdict.
Key features
Vulnerability detectors
Information printers
Taint analysis
Data flow analysis framework
Runs inside Scarb projects
Supported coins
Caracal is focused on Starknet smart contracts written in Cairo. It is not aimed at Solidity contracts on Ethereum-style chains, which are covered by other tools in this catalog such as Slither.
How to install Caracal on Windows
- 1
Get the release from the official source
Download only from the official website or the project's GitHub Releases page at github.com/crytic/caracal. Look for the latest tagged release, v0.2.3, and check whether it includes a Windows build. The Windows files are listed on the releases page, so confirm them there before you plan your setup.
- 2
Verify the file
Compare the file's SHA-256 checksum with the value published alongside the release, or check its signature if one is provided. A mismatch means the file should not be run. Delete it and download it again from the same official page.
- 3
Install the program
Extract the archive or run the installer for the Windows build, following the instructions in the release notes or the project README. Place the executable in a folder you control and keep it separate from your project files.
-
Connect it to a Scarb project
Open a Cairo project that uses Scarb, the package manager for Cairo. Make sure the project builds with Scarb first, then run the analyzer against it. This order helps you tell whether an error comes from your code or from the tool setup.
How to use Caracal
Caracal works best as part of a routine rather than a one-off scan. The steps below assume you have already installed it and have a Cairo project managed by Scarb.
- Build the project with Scarb first, so you know the code compiles before analysis.
- Run Caracal against the project root and save the full output to a file.
- Sort findings by file and by detector, then open each flagged location in your editor.
- For each finding, decide whether it is a real issue, a false positive, or a design choice you need to document.
- Fix confirmed issues, then rerun the analysis to confirm the finding is gone and no new ones appeared.
- Keep the output with your review notes so teammates can see what was checked.
Save the baseline output from the first run. Comparing later runs against it makes regressions easy to spot, especially when several people change the same contract.
Pros & cons
- Free and open source, so you can read the code behind the detectors
- Written in Rust and focused on one job: analyzing Starknet contracts
- Includes detectors aimed at vulnerable Cairo code
- Printers help you get oriented in unfamiliar codebases
- Taint and data flow analysis go beyond simple pattern matching
- Designed to run inside Scarb projects
- The last code update is dated January 2024, so recent Cairo or Starknet changes may not be covered
- Windows builds should be confirmed on the releases page before you plan around them
- Limited to Starknet and Cairo, with no use for Solidity or other chains
- Static findings include false positives and can miss some real bugs
Is Caracal safe?
Caracal is a static analyzer. It reads code and does not manage keys, funds or accounts, so the main risk is running a tampered copy of the program. Download only from the official website or the project's GitHub Releases page, and verify the SHA-256 checksum or signature before running anything. Treat copies from forums, chat channels or unofficial mirrors as suspect.
The project's last code update is dated January 25, 2024. Older tools can contain unpatched issues, so check the latest version on the official website and review recent repository activity before using it on production code. Never enter a seed phrase or private key into any website or tool that claims to help with analysis, and avoid sharing reports that contain secrets from your project.
- Official source only. Download from github.com/crytic/caracal. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
Caracal sits in a narrower niche than many tools in this catalog. Slither is a static analyzer for Solidity, and Aderyn is another Rust-based static analyzer for smart contracts. Caracal focuses on Starknet contracts written in Cairo and analyzed at the Sierra level. If your project is on Starknet, Caracal is the direct fit; if it is on another chain, the comparison starts with other tools.
Fuzzers such as Echidna and Medusa take a different approach. They run contracts with generated inputs to check whether required properties hold, which is dynamic testing. Halmos uses symbolic testing to reason about contract behavior. Caracal does not execute contracts; it inspects them for patterns. Many teams combine a static pass with fuzzing for broader coverage.
Specifications
- Price
- Free
- Type
- Open source
- License
- —
- Latest version
- v0.2.3
- Last update
- 25 Jan 2024
- Windows support
- Likely (builds for Windows; check releases)
- Source code
- github.com/crytic/caracal
Frequently asked questions
Yes. Caracal is free and open source, so you can use it without paying for a license and read the code to see how the detectors work. Check the license terms in the project repository before using it in a commercial setting. The current release is v0.2.3, available on the project's GitHub Releases page.
Yes, the project builds for Windows, so a Windows option is expected. Check the releases page to confirm that the version you want includes a Windows build before you plan your setup. Once installed, it is meant to run inside Cairo projects managed with Scarb.
Caracal reads code rather than handling wallets or funds, so the main risk is installing a modified copy. Verify the file's checksum or signature before running it. Keep the project's age in mind, since its last code update is dated January 2024, and review the safety section of this page for details.
Caracal analyzes Starknet smart contracts written in Cairo. It works over the Sierra representation, the intermediate form the code takes before final compilation. The analyzer runs detectors for vulnerable patterns, produces information through printers, and performs taint and data flow analysis. It is not designed for Solidity or Ethereum contracts.
The last code update in the repository is dated January 25, 2024. That is more than two years before this page was written, so there may be newer Cairo or Starknet changes it does not handle. Check the commit history and issue tracker to see current activity before depending on it for critical work.
A fuzzer runs contracts with many generated inputs and checks whether required properties hold, so it observes behavior during execution. Caracal is a static analyzer, meaning it inspects code without executing it and reports suspicious patterns. Static analysis is quick to run on every change, while fuzzing can reveal issues that only appear during execution. Many teams use both.
No. Caracal can flag known risky patterns and help map a codebase, but it cannot judge whether your business logic is correct or whether the design matches your intent. Its findings still need review by someone who understands the protocol. Use the tool to speed up the process and reduce routine mistakes, then do the deeper review by hand.
Verdict
Caracal is a useful, free option for developers working with Cairo and Starknet who want a static analysis step inside their Scarb workflow. Its detectors, printers, and taint and data flow analysis cover practical review needs. The main caveats are the project's age, since the last update is from January 2024, and its narrow focus on Starknet. Teams with recent Starknet code should test it carefully and pair it with fuzzing or manual review. Anyone who needs Solidity coverage should look elsewhere.