The first Hardhat plugin that burns GG to auto-fix your code — make your code cheaper, make GG scarcer. Free gas + vulnerability scanning after every compile; every paid auto-fix burns exactly 1 GG on-chain. No account, no signup, everything runs locally.
This is real output — the scanner run against a deliberately flawed Vault.sol. You get this after every npx hardhat compile:
=====================================================
GG-CHAIN OPTIMIZER · gas + security
=====================================================▸ contracts/Vault.sol● [HIGH] GG-SEC-01 tx.origin used for authorization(x1)tx.origin can be phished by a malicious intermediate contract. · lines: 7fix: Use msg.sender for access control, never tx.origin.
● [HIGH] GG-SEC-02 Unchecked low-level call return value(x1)A .call whose success bool is ignored can silently fail. · lines: 8fix: Capture and check: (bool ok, ) = target.call{...}(...); require(ok);
● [HIGH] GG-SEC-09 Possible reentrancy (state write after external call)(x1)Value call followed by a state change — the classic reentrancy pattern. · lines: 8fix: Checks-effects-interactions: update state BEFORE the call, or add nonReentrant.
● [MEDIUM] GG-SEC-08 State-changing external function with no access control(x1)fix: If it should be restricted, add onlyOwner / a role check.
● [LOW] GG-SEC-06 Floating pragma(x1)fix: Pin the version: pragma solidity 0.8.20;
◆ GG-GAS-01 require() with string message(x1)save: ~50 gas/call + ~10k deploy · lines: 7◆ GG-GAS-03 post-increment counter in for-loop(x1)save: ~30-40 gas/iteration · lines: 12◆ GG-GAS-04 .length read directly in loop condition(x1)save: ~100 gas/iteration (SLOAD each pass) · lines: 12◆ GG-GAS-08 state variable set once (immutable/constant candidate)(x1)save: ~2100 gas/read · lines: 5-----------------------------------------------------
Summary:6 gas optimizations · 3 high-severity · 5 security findings
Runnpx hardhat gg-fixto auto-apply safe gas fixes.
What you get
9 gas rules
String requires, memory vs calldata, loop increments, cached .length, redundant init, immutable/constant candidates, storage packing hints and more.
Applies only behavior-safe transforms, then recompiles to prove nothing broke. Dry-run mode previews everything. First 3 runs free, then exactly 1 GG per run — never charged without explicit --yes.
CI report mode
gg-scan --json / --markdown / --fail-on-high for pull-request automation. Post findings as a PR comment and gate merges on high-severity issues.
Encrypted wallet keystore
The optional GG wallet's private key is password-encrypted at rest (scrypt + AES-256-GCM). A stolen wallet.json alone cannot spend GG. On-chain mode refuses unencrypted keys.
Official RPC lock
On-chain mode only ever talks to the official rpc.gghyper.net endpoint — any other RPC is rejected, protecting your wallet from RPC spoofing.
README badge
Show your scan status right in your repo. Run npx hardhat gg-scan --badge and paste the snippet — the badge reflects your latest scan:
Scanning is free forever and runs 100% locally — no code ever leaves your machine. gg-fix gives 3 free runs, then costs exactly 1 GG per run, fixed in code. Nothing is charged without an explicit --yes, and the exact cost, wallet and balance are printed first.
These are heuristic, source-level hints to speed up your review — not a substitute for a professional audit. Actual savings depend on compiler version and settings. Review every auto-fix diff with git before committing.
Disclosure: first-party ecosystem coverage — this tool is built by the team behind the GGCHAIN ecosystem covered on this site. Install only the official package hardhat-gg-optimizer; beware of look-alike names.
