sourcetruth

Who can act

Every party the code lets take an action, split into those outside the protocol and those running it. Worked out from the code — never from what things are named.

Press play on any action

Pick an action and watch it happen on the map — what it archives, what it creates, what it calls — in the order the code does them.

Borrowed authority, surfaced

See whose authority an action carries beyond its caller, and which contract ids the caller gets to choose. The rules auditors most often miss, drawn.

Blind spots, never guesses

Every call whose target can’t be named from source is shown in amber. Nothing is dropped, nothing is invented, and the share traced is on screen.

Daml and Solidity

Canton templates, choices and signatories. Solidity contracts, inheritance, libraries — and the public functions you inherit from vendored code.

One file, no server

The map is a single HTML file. Open it offline, attach it to a ticket, and diff it between commits — the same code always draws the same map.

Try it without installing

This is the real output of sourcetruth --demo on the example vault. Pick a step, or click around the map yourself.

Generated with sourcetruth --demo from the examples in the repository. Open this map in its own tab

Three rules it never breaks

Comments are never evidence

Every comment is stripped before a line is read. If a comment says a function is admin-only and the code says otherwise, the map shows the code.

Blind spots are never guessed

A call whose target can’t be named is reported with its source line. An arrow that isn’t there means “unproven”, never “nothing there”.

Access comes from code, not names

Who is inside the protocol is derived from signatories and checks. A function named onlyOwner that doesn’t check the caller is shown as open.

A map on every pull request

The GitHub Action uploads the map as an artifact, writes a summary on the run, and fails the build when tracing drops below your floor — the signal that code arrived the tool can’t follow.

yaml

- uses: actions/checkout@v7
  with:
    submodules: recursive
- uses: prajwalghate/sourcetruth@v0
  with:
    path: ./contracts
    min-resolution: 90

sourcetruthSee what contract code really does