An opinionated security and code quality checklist for auditing Solidity smart contracts.
Solcurity is an opinionated security and code quality standard for Solidity smart contracts. It provides a comprehensive checklist that developers and auditors can use to systematically review smart contracts for vulnerabilities, gas inefficiencies, and code quality issues. The standard consolidates best practices from multiple security experts and covers everything from variable declarations to DeFi-specific considerations.
Solidity developers writing production smart contracts, security auditors reviewing DeFi protocols, and teams implementing internal security review processes for blockchain projects.
Developers choose Solcurity because it provides a structured, actionable framework for security reviews that goes beyond generic advice. Its opinionated nature and specific check items help ensure consistent, thorough audits while referencing real SWC vulnerabilities and industry expert recommendations.
Opinionated security and code quality standard for Solidity smart contracts.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Categorizes checks into variables, functions, modifiers, code patterns, external calls, events, contracts, and project levels, ensuring no aspect is overlooked, as detailed in the README's structured sections.
Consolidates best practices from sources like BoringCrypto, Mudit Gupta, and ConsenSys Diligence, providing a trusted, aggregated standard that references real SWC vulnerabilities.
Includes a dedicated DeFi section with checks on oracles, token types (e.g., rebasing, ERC-777), and accounting pitfalls, addressing common pitfalls in decentralized finance projects.
Uses specific item codes (e.g., V1, F1, C1) for systematic review, making it easy to track progress and ensure thorough audits, as outlined in the README's categories.
Provides practical tips like using unchecked blocks, packing variables, and avoiding gas griefing, with explicit checks such as C44 and V6 for efficiency improvements.
Requires extensive manual line-by-line review as per the general approach, which can be slow and prone to human error compared to automated audit tools.
Lacks integration with development environments or automated enforcement; users must manually apply checks and rely on external tools like Slither, increasing setup complexity.
The standard's opinionated nature, such as favoring specific patterns or naming conventions, might clash with team preferences or evolving best practices, limiting flexibility.
As a GitHub repository, it may not quickly adapt to new Solidity versions or emerging vulnerabilities, unlike actively maintained commercial security services.