Package: slither-analyzer
Slither, the smart contract static analyzerJoin the Empire Hacking Slack- Discussions and SupportSlitheris a Solidity & Vyper static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses.FeaturesUsageHow to installUsing PipUsing GitUsing DockerIntegrationDetectorsPrintersQuick Review PrintersIn-Depth Review PrintersToolsAPI DocumentationGetting HelpFAQLicensePublicationsTrail of Bits publicationExternal publicationsFeaturesDetects vulnerable Solidity code with low false positives (see the list oftrophies)Identifies where the error condition occurs in the source codeEasily integrates into continuous integration and Hardhat/Foundry buildsBuilt-in 'printers' quickly report crucial contract informationDetector API to write custom analyses in PythonAbility to analyze contracts written with Solidity >= 0.4Intermediate representation (SlithIR) enables simple, high-precision analysesCorrectly parses 99.9% of all public Solidity codeAverage execution time of less than 1 second per contractIntegrates with Github's code scanning inCISupport for VyperUsageRun Slither on a Hardhat/Foundry/Dapp/Brownie application:slither .This is the preferred option if your project has dependencies as Slither relies on the underlying compilation framework to compile source code.However, you can run Slither on a single file that does not import dependencies:slither tests/uninitialized.solHow to installNoteSlither requires Python 3.8+.
If you'renotgoing to use one of thesupported compilation frameworks, you needsolc, the Solidity compiler; we recommend usingsolc-selectto conveniently switch between solc versions.Using Pippip3 install slither-analyzerUsing Gitgitclonehttps://github.com/crytic/slither.git&&cdslither
python3setup.pyinstallWe recommend using a Python virtual environment, as detailed in theDeveloper Installation Instructions, if you prefer to install Slither via git.Using DockerUse theeth-security-toolboxdocker image. It includes all of our security tools and every major version of Solidity in a single image./home/sharewill be mounted to/sharein the container.dockerpulltrailofbits/eth-security-toolboxTo share a directory in the container:dockerrun-it-v/home/share:/sharetrailofbits/eth-security-toolboxIntegrationFor GitHub action integration, useslither-action.To generate a Markdown report, useslither [target] --checklist.To generate a Markdown with GitHub source code highlighting, useslither [target] --checklist --markdown-root https://github.com/ORG/REPO/blob/COMMIT/(replaceORG,REPO,COMMIT)DetectorsNumDetectorWhat it DetectsImpactConfidence1abiencoderv2-arrayStorage abiencoderv2 arrayHighHigh2arbitrary-send-erc20transferFrom uses arbitraryfromHighHigh3array-by-referenceModifying storage array by valueHighHigh4encode-packed-collisionABI encodePacked CollisionHighHigh5incorrect-shiftThe order of parameters in a shift instruction is incorrect.HighHigh6multiple-constructorsMultiple constructor schemesHighHigh7name-reusedContract's name reusedHighHigh8protected-varsDetected unprotected variablesHighHigh9public-mappings-nestedPublic mappings with nested variablesHighHigh10rtloRight-To-Left-Override control character is usedHighHigh11shadowing-stateState variables shadowingHighHigh12suicidalFunctions allowing anyone to destruct the contractHighHigh13uninitialized-stateUninitialized state variablesHighHigh14uninitialized-storageUninitialized storage variablesHighHigh15unprotected-upgradeUnprotected upgradeable contractHighHigh16codexUse Codex to find vulnerabilities.HighLow17arbitrary-send-erc20-permittransferFrom uses arbitrary from with permitHighMedium18arbitrary-send-ethFunctions that send Ether to arbitrary destinationsHighMedium19controlled-array-lengthTainted array length assignmentHighMedium20controlled-delegatecallControlled delegatecall destinationHighMedium21delegatecall-loopPayable functions usingdelegatecallinside a loopHighMedium22incorrect-expIncorrect exponentiationHighMedium23incorrect-returnIf areturnis incorrectly used in assembly mode.HighMedium24msg-value-loopmsg.value inside a loopHighMedium25reentrancy-ethReentrancy vulnerabilities (theft of ethers)HighMedium26return-leaveIf areturnis used instead of aleave.HighMedium27storage-arraySigned storage integer array compiler bugHighMedium28unchecked-transferUnchecked tokens transferHighMedium29weak-prngWeak PRNGHighMedium30domain-separator-collisionDetects ERC20 tokens that have a function whose signature collides with EIP-2612's DOMAIN_SEPARATOR()MediumHigh31enum-conversionDetect dangerous enum conversionMediumHigh32erc20-interfaceIncorrect ERC20 interfacesMediumHigh33erc721-interfaceIncorrect ERC721 interfacesMediumHigh34incorrect-equalityDangerous strict equalitiesMediumHigh35locked-etherContracts that lock etherMediumHigh36mapping-deletionDeletion on mapping containing a structureMediumHigh37shadowing-abstractState variables shadowing from abstract contractsMediumHigh38tautological-compareComparing a variable to itself always returns true or false, depending on comparisonMediumHigh39tautologyTautology or contradictionMediumHigh40write-after-writeUnused writeMediumHigh41boolean-cstMisuse of Boolean constantMediumMedium42constant-function-asmConstant functions using assembly codeMediumMedium43constant-function-stateConstant functions changing the stateMediumMedium44divide-before-multiplyImprecise arithmetic operations orderMediumMedium45reentrancy-no-ethReentrancy vulnerabilities (no theft of ethers)MediumMedium46reused-constructorReused base constructorMediumMedium47tx-originDangerous usage oftx.originMediumMedium48unchecked-lowlevelUnchecked low-level callsMediumMedium49unchecked-sendUnchecked sendMediumMedium50uninitialized-localUninitialized local variablesMediumMedium51unused-returnUnused return valuesMediumMedium52incorrect-modifierModifiers that can return the default valueLowHigh53shadowing-builtinBuilt-in symbol shadowingLowHigh54shadowing-localLocal variables shadowingLowHigh55uninitialized-fptr-cstUninitialized function pointer calls in constructorsLowHigh56variable-scopeLocal variables used prior their declarationLowHigh57void-cstConstructor called not implementedLowHigh58calls-loopMultiple calls in a loopLowMedium59events-accessMissing Events Access ControlLowMedium60events-mathsMissing Events ArithmeticLowMedium61incorrect-unaryDangerous unary expressionsLowMedium62missing-zero-checkMissing Zero Address ValidationLowMedium63reentrancy-benignBenign reentrancy vulnerabilitiesLowMedium64reentrancy-eventsReentrancy vulnerabilities leading to out-of-order EventsLowMedium65return-bombA low level callee may consume all callers gas unexpectedly.LowMedium66timestampDangerous usage ofblock.timestampLowMedium67assemblyAssembly usageInformationalHigh68assert-state-changeAssert state changeInformationalHigh69boolean-equalComparison to boolean constantInformationalHigh70cyclomatic-complexityDetects functions with high (> 11) cyclomatic complexityInformationalHigh71deprecated-standardsDeprecated Solidity StandardsInformationalHigh72erc20-indexedUn-indexed ERC20 event parametersInformationalHigh73function-init-stateFunction initializing state variablesInformationalHigh74incorrect-using-forDetects using-for statement usage when no function from a given library matches a given typeInformationalHigh75low-level-callsLow level callsInformationalHigh76missing-inheritanceMissing inheritanceInformationalHigh77naming-conventionConformity to Solidity naming conventionsInformationalHigh78pragmaIf different pragma directives are usedInformationalHigh79redundant-statementsRedundant statementsInformationalHigh80solc-versionIncorrect Solidity versionInformationalHigh81unimplemented-functionsUnimplemented functionsInformationalHigh82unused-stateUnused state variablesInformationalHigh83costly-loopCostly operations in a loopInformationalMedium84dead-codeFunctions that are not usedInformationalMedium85reentrancy-unlimited-gasReentrancy vulnerabilities through send and transferInformationalMedium86similar-namesVariable names are too similarInformationalMedium87too-many-digitsConformance to numeric notation best practicesInformationalMedium88cache-array-lengthDetectsforloops that uselengthmember of some storage array in their loop condition and don't modify it.OptimizationHigh89constable-statesState variables that could be declared constantOptimizationHigh90external-functionPublic function that could be declared externalOptimizationHigh91immutable-statesState variables that could be declared immutableOptimizationHigh92var-read-using-thisContract reads its own variable usingthisOptimizationHighFor more information, seeTheDetector Documentationfor details on each detectorTheDetection Selectionto run only selected detectors. By default, all the detectors are run.TheTriage Modeto filter individual resultsPrintersQuick Review Printershuman-summary:Print a human-readable summary of the contractsinheritance-graph:Export the inheritance graph of each contract to a dot filecontract-summary:Print a summary of the contractsloc:Count the total number lines of code (LOC), source lines of code (SLOC), and comment lines of code (CLOC) found in source files (SRC), dependencies (DEP), and test files (TEST).In-Depth Review Printerscall-graph:Export the call-graph of the contracts to a dot filecfg:Export the CFG of each functionsfunction-summary:Print a summary of the functionsvars-and-auth:Print the state variables written and the authorization of the functionsnot-pausable:Print functions that do not usewhenNotPausedmodifier.To run a printer, use--printand a comma-separated list of printers.See thePrinter documentationfor the complete lists.Toolsslither-check-upgradeability:Reviewdelegatecall-based upgradeabilityslither-prop:Automatic unit test and property generationslither-flat:Flatten a codebaseslither-check-erc:Check the ERC's conformanceslither-format:Automatic patch generationslither-read-storage:Read storage values from contractsslither-interface:Generate an interface for a contractSee theTool documentationfor additional tools.Contact usto get help on building custom tools.API DocumentationDocumentation on Slither's internals is availablehere.Getting HelpFeel free to stop by ourSlack channel(#ethereum) for help using or extending Slither.ThePrinter documentationdescribes the information Slither is capable of visualizing for each contract.TheDetector documentationdescribes how to write a new vulnerability analyses.TheAPI documentationdescribes the methods and objects available for custom analyses.TheSlithIR documentationdescribes the SlithIR intermediate representation.FAQHow do I exclude mocks or tests?View our documentation onpath filtering.How do I fix "unknown file" or compilation issues?Because slither requires the solc AST, it must have all dependencies available.
If a contract has dependencies,slither contract.solwill fail.
Instead, useslither .in the parent directory ofcontracts/(you should seecontracts/when you runls).
If you have anode_modules/folder, it must be in the same directory ascontracts/. To verify that this issue is related to slither,
run the compilation command for the framework you are using e.gnpx hardhat compile. That must work successfully;
otherwise, slither's compilation engine, crytic-compile, cannot generate the AST.LicenseSlither is licensed and distributed under the AGPLv3 license.Contact usif you're looking for an exception to the terms.PublicationsTrail of Bits publicationSlither: A Static Analysis Framework For Smart Contracts, Josselin Feist, Gustavo Grieco, Alex Groce - WETSEB '19External publicationsTitleUsageAuthorsVenueCodeReJection: A AST-Based Reentrancy Vulnerability Detection MethodAST-based analysis built on top of SlitherRui Ma, Zefeng Jian, Guangyuan Chen, Ke Ma, Yujia ChenCTCIS 19MPro: Combining Static and Symbolic Analysis forScalable Testing of Smart ContractLeverage data dependency through SlitherWilliam Zhang, Sebastian Banescu, Leodardo Pasos, Steven Stewart, Vijay GaneshISSRE 2019MProETHPLOIT: From Fuzzing to Efficient Exploit Generation against Smart ContractsLeverage data dependency through SlitherQingzhao Zhang, Yizhuo Wang, Juanru Li, Siqi MaSANER 20Verification of Ethereum Smart Contracts: A Model Checking ApproachSymbolic execution built on top of Slither’s CFGTam Bang, Hoang H Nguyen, Dung Nguyen, Toan Trieu, Tho QuanIJMLC 20Smart Contract RepairRely on Slither’s vulnerabilities detectorsXiao Liang Yu, Omar Al-Bataineh, David Lo, Abhik RoychoudhuryTOSEM 20SCRepairDemystifying Loops in Smart ContractsLeverage data dependency through SlitherBen Mariano, Yanju Chen, Yu Feng, Shuvendu Lahiri, Isil DilligASE 20Trace-Based Dynamic Gas Estimation of Loops in Smart ContractsUse Slither’s CFG to detect loopsChunmiao Li, Shijie Nie, Yang Cao, Yijun Yu, Zhenjiang HuIEEE Open J. Comput. Soc. 1 (2020)SAILFISH: Vetting Smart Contract State-Inconsistency Bugs in SecondsRely on SlithIR to build astorage dependency graphPriyanka Bose, Dipanjan Das, Yanju Chen, Yu Feng, Christopher Kruegel, and Giovanni VignaS&P 22SailfishSolType: Refinement Types for Arithmetic Overflow in SolidityUse Slither as frontend to build refinement type systemBryan Tan, Benjamin Mariano, Shuvendu K. Lahiri, Isil Dillig, Yu FengPOPL 22Do Not Rug on Me: Leveraging Machine Learning Techniques for Automated Scam DetectionUse Slither to extract tokens' features (mintable, pausable, ..)Mazorra, Bruno, Victor Adan, and Vanesa DazaMathematics 10.6 (2022)MANDO: Multi-Level Heterogeneous Graph Embeddings for Fine-Grained Detection of Smart Contract VulnerabilitiesUse Slither to extract the CFG and call graphHoang Nguyen, Nhat-Minh Nguyen, Chunyao Xie, Zahra Ahmadi, Daniel Kudendo, Thanh-Nam Doan and Lingxiao JiangIEEE 9th International Conference on Data Science and Advanced Analytics (DSAA, 2022)ge-scAutomated Auditing of Price Gouging TOD Vulnerabilities in Smart ContractsUse Slither to extract the CFG and data dependenciesSidi Mohamed Beillahi, Eric Keilty, Keerthi Nelaturu, Andreas Veneris, and Fan Long2022 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)Smart-Contract-RepairIf you are using Slither on an academic work, consider applying to theCrytic $10k Research Prize.