A static analysis framework for Solidity and Vyper smart contracts that detects vulnerabilities, enhances code comprehension, and enables custom analyses.
Slither is a static analysis framework for Solidity and Vyper smart contracts. It automatically detects security vulnerabilities, provides tools for understanding contract structure, and offers an API for building custom analysis tools. It helps developers write safer smart contracts by identifying issues before deployment.
Smart contract developers, security auditors, and blockchain security researchers who need to analyze, audit, or improve the security of Solidity or Vyper codebases.
Developers choose Slither for its comprehensive vulnerability detection with low false positives, fast performance, and extensible API that allows for both out-of-the-box security checks and custom, in-depth analysis tailored to specific projects.
Static Analyzer for Solidity and Vyper
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Runs over 100 detectors covering common issues like reentrancy and uninitialized storage, with a focus on low false positives as evidenced by the detailed detector list in the README.
Averages less than one second per contract and correctly parses 99.9% of public Solidity code, ensuring fast and accurate analysis for large codebases.
Provides a Python API and SlithIR intermediate representation, allowing developers to build custom tools and detectors, as documented in the API and SlithIR sections.
Easily integrates into CI/CD pipelines, Hardhat/Foundry builds, and GitHub code scanning with actions like slither-action, supporting automated security checks.
Requires a proper compilation environment and can fail on contracts with dependencies, as noted in the FAQ for 'unknown file' issues, adding setup complexity.
Cannot detect runtime vulnerabilities that depend on transaction sequences or dynamic state changes, limiting its scope compared to dynamic testing tools.
Licensed under AGPLv3, which may require exceptions for commercial or proprietary use, as mentioned in the license section, potentially hindering adoption.