Do we have any standardized security scanning tool to go for security code review for solidity language? If not, what all opensource tools are there on which we can relay? Need response urgently.

  • Please note that running a linting tool is not a security review, because automated tools do not understand pitfalls in logic and purpose. I would suggest you edit this questions so that the title does not say a security review as it won't be one and you are just fooling yourself and your potential clients. Feb 7, 2018 at 13:16

9 Answers 9


SmartCheck [1] is a static code analyzer developed by SmartDec Security Team. It runs analysis in Solidity source code and automatically checks smart contracts for security vulnerabilities and bad practices. The full list of them can be found in the SmartCheck Knowledge Base [2]. It is totally free and doesn’t need installation.

[1] https://tool.smartdec.net

[2] https://consensys.github.io/smart-contract-best-practices/security_tools/


Copied from here https://consensys.github.io/smart-contract-best-practices/security_tools/

Static Analysis

  • Manticore - Dynamic binary analysis tool with EVM support
  • Mythril - Reversing and bug hunting framework for the Ethereum blockchain
  • Oyente - Analyze Ethereum code to find common vulnerabilities, based on this paper.
  • Solgraph - Generates a DOT graph that visualizes function control flow of a Solidity contract and highlights potential security vulnerabilities.
  • SmartCheck - Static analysis of Solidity source code for security vulnerabilities and best practices.
  • Securify - an automated formal verifier for Ethereum smart contracts.

Test Coverage


Linters improve code quality by enforcing rules for style and composition, making code easier to read and review.

  • Solcheck - A linter for Solidity code written in JS and heavily inspired by eslint.
  • Solint - Solidity linting that helps you enforce consistent conventions and avoid errors in your Solidity smart-contracts.
  • Solium - Yet another Solidity linting.
  • Solhint - A linter for Solidity that provides both Security and Style Guide validations.

This is a great list of all available security tools for Solidity based smart contracts https://consensys.github.io/smart-contract-best-practices/security_tools/

I tried a few of them, and here are my observations.

Mythx - Very slow and still there are false positives.

Slither - Open source and good results but gives false positives. It is quicker than mythx

SolidityScan - Very fast and more vulnerability detection than slither and mythx. Does give false positives but it is manageable.

Overall I prefered SolidityScan


Securify [1] is an automated formal verifier for Ethereum smart contracts. It can detect various security issues such as missing input validation, reentrancy, and others. You can directly ping the team for access to the latest version which features more security patterns (e.g., for detecting bugs like the parity multisig bug [2]).

[1]: Securify system: https://securify.ch

[2]: An In-Depth Look at the Parity Multisig Bug: http://hackingdistributed.com/2017/07/22/deep-dive-parity-bug/

  • I'm confused about this issue missing input validation, do you have any ideas?
    – Ender
    Apr 8, 2019 at 6:46

The best option for devs is MythX smart contract security analysis service with support Truffle, Embark, Github, VS Code and many other environments. It was developed by the Mythril team. Try the MythX awesome list.


I have been testing a lot of these tools and being a smart contract auditor myself, I often feel the need to automate scanning solidity codes.

I came across this tool called SolidityScan and unlike other tools, I noticed it produced a lot more quality results on the smart contracts that I scanned. The scanner did produce some false positives but it was minimal and could be ignored.

It did a much better job than other open source or proprietary tools such as Slither, Mythx, etc when I compared the results.


I suppose there is not any standardized tool, however there is a pretty good static analysis tool to test contracts for having certain vulnerabilities. It is called Oyente and it is able to check 4 bugs in contracts:

  1. Reentrancy bugs (just like the one exploited in the DAO v1.0)
  2. Mishandled Exceptions (see KingOfTheEtherThrone)
  3. Transaction-Ordering Dependence
  4. Timestamp dependence

Github link; Oyente paper link


There is also a SonarQube static analyzer for Solidity.

SonarSolidity has rules that support Solidity’s best practices and track security vulnerabilities and code smell issues.

I have already analyzed some open source projects and very interesting issues were found.

So, I would like to invite anyone interested to take advantage of SonarSolidity’s value.

Feedback is very much appreciated.



Security researchers are coming up with new and better tools all the time, so your best bet is to check the tools mentioned by ConsenSys in their Smart Contract Best Practices:


There are answers in this thread that mention tools that are no longer relevant (i.e. not supporting the latest version of Solidity) or are completely abandoned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.