# Secure Cadence Breaking Changes Analyzer

**URL:** https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059
**Category:** 🏄🏻‍♀️ Cadence
**Created:** [April 29, 2022, 2:01am UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059 "2022-04-29T02:01:28Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)
#### Post date: [April 29, 2022, 2:01am UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/1 "2022-04-29T02:01:28Z")

</div>

Hello developers,

The Flow core contributors created a tool which you can use to analyze your Cadence contracts for the recently announced breaking changes which will go into affect with the release of Secure Cadence in the next spork.

You can read more about Secure Cadence and the breaking changes here:  
[Breaking changes coming with Secure Cadence release](http://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052)

> 💡 **NOTE** : The analyzer is only able to identify code that might need to change. To verify your changes, use the Secure Cadence beta release of the CLI linked above, and test your code using the Secure Cadence emulator.

## Installation

- On Linux and macOS:

- On Windows, in PowerShell:

## Usage

### Analyzing contracts of an account

To analyze all contracts of an account, specify the network and address. This requires you have the [Flow CLI](https://docs.onflow.org/flow-cli/) installed and configured properly (run `flow init`).

For example:

```bash
cadence-analyzer -network mainnet -address 0x1654653399040a61

```

### Analyzing a transaction

To analyze a transaction, specify the network and transaction ID.

This requires you have the [Flow CLI](https://docs.onflow.org/flow-cli/) installed and configured (run `flow init`).

For example:

```shell

cadence-analyzer -network mainnet -transaction 44fd8475eeded90d74e7594b10cf456b0866c78221e7f230fcfd4ba1155c542f

```

### Only running some analyzers

By default, all available analyzers are run.

To list all available analyzers, run:

```bash
cadence-analyzer -help

```

For example, to only run the `reference-to-optional` and the `external-mutation` analyzers, run:

```bash
cadence-analyzer -network mainnet -address 0x1654653399040a61 \
    -analyze reference-to-optional \
    -analyze external-mutation

```

### Analyzing contracts in a directory

To analyze all contracts in a directory, specify the path.

For example:

```bash
cadence-analyzer -directory contracts

```

The files must be named with the `.cdc` extension and by their location ID of the program:

- Contracts in accounts have the format `A.<address>.<name>`,  
e.g. `A.e467b9dd11fa00df.FlowStorageFees`, where
  - `address`: Address in hex format, e.g. `e467b9dd11fa00df`
  - `name`: The name of the contract, e.g `FlowStorageFees`

- Transactions have the format `t.<ID>`, where
  - `id`: The ID of the transaction (its hash)

- Scripts have the format `s.<ID>`, where
  - `id`: The ID of the script (its hash)

### Analyzing contracts in a CSV file

To analyze all contracts in a CSV file, specify the path to the file.

For example:

```bash
cadence-analyzer -csv contracts.csv

```

The CSV file must be in the following format:

- Header: `location,code`
- Columns:
  - `location`: The location ID of the program
    - Contracts in accounts have the format `A.<address>.<name>`,  
e.g. `A.e467b9dd11fa00df.FlowStorageFees`, where
      - `address`: Address in hex format, e.g. `e467b9dd11fa00df`
      - `name`: The name of the contract, e.g `FlowStorageFees`

    - Transactions have the format `t.<ID>`, where
      - `id`: The ID of the transaction (its hash)

    - Scripts have the format `s.<ID>`, where
      - `id`: The ID of the script (its hash)

  - `code`: The code of the contract, e.g. `pub contract Test {}`

Full example:

```csv
location,code
t.0000000000000000,"
import 0x1
transaction {
    prepare(signer: AuthAccount) {
        Test.hello()
    }
}
"
A.0000000000000001.Test,"
pub contract Test {
    pub fun hello() {
      log(""Hello, world!"")
    }
}
"

```

---

<div class="post-metadata">

### Author: ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)
#### Post date: [May 5, 2022, 10:21pm UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/2 "2022-05-05T22:21:24Z")

</div>

We have just released a new version of the analyzer, v0.2:

- It supports analyzing on-chain transactions by specifying the `-transaction` flag
- Some analyzers got improved and they detect now more cases of code that needs to get potentially updated
- The CSV file format changed and now supports transactions and scripts

You can update the tool by re-running the installation commands:

- On Linux and macOS:

- On Windows, in PowerShell:

If you have any questions or feedback, please let us know!

---

<div class="post-metadata">

### Author: ![bjartek](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bjartek/32/143_2.png) [@bjartek](https://forum.flow.com/u/bjartek)
#### Post date: [May 5, 2022, 10:33pm UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/3 "2022-05-05T22:33:54Z")

</div>

I ran this on Versus on mainnet and I got the following message

```auto
> error: update required: missing comma between parameters
> --> d796ff17107bbff6.Versus:665:50
> |
> 665 | vaultCap: Capability<&{FungibleToken.Receiver}>
> | ^ insert missing comma here

```

the pointer points to the o in Token.

---

<div class="post-metadata">

### Author: ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)
#### Post date: [May 5, 2022, 10:41pm UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/4 "2022-05-05T22:41:31Z")

</div>

> [@bjartek](#):
>
> I ran this on Versus on mainnet and I got the following message
> 
> ```auto
> > error: update required: missing comma between parameters
> > --> d796ff17107bbff6.Versus:665:50
> > |
> > 665 | vaultCap: Capability<&{FungibleToken.Receiver}>
> > | ^ insert missing comma here
> 
> ```
> 
> the pointer points to the o in Token.

@bjartek The code is indented with tabs, which isn’t handled properly.  
The error points to the end, after the `>`

---

<div class="post-metadata">

### Author: ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)
#### Post date: [May 5, 2022, 11:41pm UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/5 "2022-05-05T23:41:58Z")

</div>

The tool should now handle tabs in code properly, please update to the latest version, v0.2.1.

---

<div class="post-metadata">

### Author: ![f7h62ga](https://avatars.discourse-cdn.com/v4/letter/f/f1d935/32.png) [@f7h62ga](https://forum.flow.com/u/f7h62ga)
#### Post date: [May 13, 2022, 12:04am UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/6 "2022-05-13T00:04:45Z")

</div>

is the source code of the analyzer available?

---

<div class="post-metadata">

### Author: ![bluesign](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bluesign/32/1359_2.png) [@bluesign](https://forum.flow.com/u/bluesign)
#### Post date: [May 15, 2022, 7:41am UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/8 "2022-05-15T07:41:45Z")

</div>

> **[cadence/tools/contract-analyzer at b54aa90d494099fff3450e749842ed26f86b090d ·...](https://github.com/onflow/cadence/tree/b54aa90d494099fff3450e749842ed26f86b090d/tools/contract-analyzer)**
>
> b54aa90d494099fff3450e749842ed26f86b090d/tools/contract-analyzer

---

<div class="post-metadata">

### Author: ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)
#### Post date: [May 16, 2022, 4:50pm UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/9 "2022-05-16T16:50:36Z")

</div>

The code is currently in a PR: [https://github.com/onflow/cadence/pull/1607](https://github.com/onflow/cadence/pull/1607)

---

<div class="post-metadata">

### Author: ![sylv1un](https://avatars.discourse-cdn.com/v4/letter/s/aeb1de/32.png) [@sylv1un](https://forum.flow.com/u/sylv1un)
#### Post date: [June 14, 2022, 10:02am UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/10 "2022-06-14T10:02:07Z")

</div>

Hi,

I have a probleme when I run cadence analyzer with this command :

`cadence-analyzer -network testnet -transaction da1649ea834b1a638dfd4ad3831ae79e854757d3dc0afbaf0a7aa7335a6f97e4`

I have this result :

```
flag provided but not defined: -transaction
Usage of cadence-analyzer:
  -address string
        analyze contracts in the given account
  -analyze value
        enable analyzer
  -csv string
        analyze all contracts in the specified CSV file
  -network string
        name of network

Available analyzers:
  - address-tostring:
      Detects calls to Address.toString(). The next release will zero-pad the result.
  - deprecated-key-functions:
      Detects usages of the deprecated key management API. It will be removed in a future release.
  - external-mutation:
      Detects mutation of container-typed fields outside of the scope of the enclosing composite. This will be invalid in the next release.
  - number-supertype-binary-operations:
      Detects arithmetic, comparison, and bitwise operations on number super-types. These will be invalid in the next release.
  - parameter-list-missing-commas:
      Detects missing commas in parameter lists. Such code will get rejected in the next release.
  - reference-operator:
      Detects invalid operators in reference expressions. These will get rejected in a future release.
  - reference-to-optional:
      Detects references to an optional value. This will result in optional references in the next release.
  - storage-read-operations:
      Detects calls to AuthAccount.load/copy/borrow and Capability.borrow. These functions will perform a force cast in the next release.
  - supertype-inference:
      Detects expressions with different element types. The next release will infer types differently.

```

the flag is not recognized. I don’t understand why ?

thanks for your help.

---

<div class="post-metadata">

### Author: ![sylv1un](https://avatars.discourse-cdn.com/v4/letter/s/aeb1de/32.png) [@sylv1un](https://forum.flow.com/u/sylv1un)
#### Post date: [June 14, 2022, 12:57pm UTC](https://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059/11 "2022-06-14T12:57:35Z")

</div>

Scuse me my cadence analyser was not up to date.  
I have run this command `sh -ci "$(curl -fsSL https://storage.googleapis.com/flow-cli/install-cadence-analyzer.sh)"`  
and now it is ok.
