Repository files navigation

Join the Empire Hacking Slack

_{- Discussions and Support}

Slither is a Solidity & Vyper static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses. Slither enables developers to find vulnerabilities, enhance their code comprehension, and quickly prototype custom analyses.

• Features
• Usage
• How to install
  • Using Pip
  • Using Git
  • Using Docker
  • Integration
• Detectors
• Printers
  • Quick Review Printers
  • In-Depth Review Printers
• Tools
• API Documentation
• Getting Help
• FAQ
• License
• Publications
  • Trail of Bits publication
  • External publications

• Detects vulnerable Solidity code with low false positives (see the list oftrophies)
• Identifies where the error condition occurs in the source code
• Easily integrates into continuous integration and Hardhat/Foundry builds
• Built-in 'printers' quickly report crucial contract information
• Detector API to write custom analyses in Python
• Ability to analyze contracts written with Solidity >= 0.4
• Intermediate representation (SlithIR) enables simple, high-precision analyses
• Correctly parses 99.9% of all public Solidity code
• Average execution time of less than 1 second per contract
• Integrates with Github's code scanning inCI
• Support for Vyper smart contracts

Run Slither on a Hardhat/Foundry/Dapp/Brownie application:

slither .

This is the preferred option if your project has dependencies as Slither relies on the underlying compilation framework to compile source code.

However, you can run Slither on a single file that does not import dependencies:

slither tests/uninitialized.sol

Note
Slither requires Python 3.8+.If you'renot going to use one of thesupported compilation frameworks, you needsolc, the Solidity compiler; we recommend usingsolc-select to conveniently switch between solc versions.

python3 -m pip install slither-analyzer

python3 -m pip install --upgrade slither-analyzer

brew install slither-analyzer

git clone https://github.com/crytic/slither.git&&cd slitherpython3 -m pip install.

We recommend using a Python virtual environment, as detailed in theDeveloper Installation Instructions, if you prefer to install Slither via git.

Use theeth-security-toolbox docker image. It includes all of our security tools and every major version of Solidity in a single image./home/share will be mounted to/share in the container.

docker pull trailofbits/eth-security-toolbox

To share a directory in the container:

docker run -it -v /home/share:/share trailofbits/eth-security-toolbox

• For GitHub action integration, useslither-action.
• For pre-commit integration, use (replace$GIT_TAG with real tag)

  -repo:https://github.com/crytic/slitherrev:$GIT_TAGhooks:    -id:slither

• To generate a Markdown report, useslither [target] --checklist.
• To generate a Markdown with GitHub source code highlighting, useslither [target] --checklist --markdown-root https://github.com/ORG/REPO/blob/COMMIT/ (replaceORG,REPO,COMMIT)

For more information, see

• TheDetector Documentation for details on each detector
• TheDetection Selection to run only selected detectors. By default, all the detectors are run.
• TheTriage Mode to filter individual results

• human-summary:Print a human-readable summary of the contracts
• inheritance-graph:Export the inheritance graph of each contract to a dot file
• contract-summary:Print a summary of the contracts
• loc:Count the total number lines of code (LOC), source lines of code (SLOC), and comment lines of code (CLOC) found in source files (SRC), dependencies (DEP), and test files (TEST).
• entry-points:Print all the state-changing entry point functions of the contracts

• call-graph:Export the call-graph of the contracts to a dot file
• cfg:Export the CFG of each functions
• function-summary:Print a summary of the functions
• vars-and-auth:Print the state variables written and the authorization of the functions
• not-pausable:Print functions that do not usewhenNotPaused modifier.

To run a printer, use--print and a comma-separated list of printers.

See thePrinter documentation for the complete lists.

• slither-check-upgradeability:Reviewdelegatecall-based upgradeability
• slither-prop:Automatic unit test and property generation
• slither-flat:Flatten a codebase
• slither-check-erc:Check the ERC's conformance
• slither-read-storage:Read storage values from contracts
• slither-interface:Generate an interface for a contract

See theTool documentation for additional tools.

Contact us to get help on building custom tools.

Documentation on Slither's internals is availablehere.

Feel free to stop by ourSlack channel (#ethereum) for help using or extending Slither.

• ThePrinter documentation describes the information Slither is capable of visualizing for each contract.

• TheDetector documentation describes how to write a new vulnerability analyses.

• TheAPI documentation describes the methods and objects available for custom analyses.

• TheSlithIR documentation describes the SlithIR intermediate representation.

How do I exclude mocks or tests?

• View our documentation onpath filtering.

How do I fix "unknown file" or compilation issues?

• Because slither requires the solc AST, it must have all dependencies available.If a contract has dependencies,slither contract.sol will fail.Instead, useslither . in the parent directory ofcontracts/ (you should seecontracts/ when you runls).If you have anode_modules/ folder, it must be in the same directory ascontracts/. To verify that this issue is related to slither,run the compilation command for the framework you are using e.gnpx hardhat compile. That must work successfully;otherwise, slither's compilation engine, crytic-compile, cannot generate the AST.

Slither is licensed and distributed under the AGPLv3 license.Contact us if you're looking for an exception to the terms.

• Slither: A Static Analysis Framework For Smart Contracts, Josselin Feist, Gustavo Grieco, Alex Groce - WETSEB '19

If you are using Slither on an academic work, consider applying to theCrytic $10k Research Prize.