Skip to content
THREATWIRE

Slither

Static analyser for Solidity and Vyper

Trail of Bits' static analysis framework for Solidity and Vyper with dozens of vulnerability detectors, printers and an API for custom analyses.

Open sourceAGPL-3.0-only
View repository Docs
Homepage of Slither
Official repository page, captured by ThreatWire.

What Slither does

Slither converts smart contracts to an intermediate representation (SlithIR) and runs detectors for issues such as reentrancy, uninitialised storage, dangerous delegatecall and incorrect ERC conformance. Printers summarise contract structure, inheritance and function permissions for auditors.

It runs in seconds on most codebases, integrates with Foundry, Hardhat and other frameworks, and is a common first step in smart contract audits and CI.

Key features

  • Dozens of built-in vulnerability detectors
  • Printers for inheritance, call graphs and permissions
  • Python API for custom detectors
  • Foundry, Hardhat and other framework support
  • SARIF output and GitHub Action

Licence

AGPL-3.0-only · GNU AGPL v3 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: AGPL-3.0.

Security of Slither itself

No published advisory found for Slither in GitHub repository advisories and OSV.dev. That does not mean the tool has no vulnerabilities.

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Smart contract securityStatic code analysis (SAST)#solidity#vyper#static-analysis#trail-of-bits#ethereum

Related tools

  • Aderyn

    Rust-based Solidity static analyser

    Cyfrin's static analyser for Solidity written in Rust, with detectors, Markdown audit-style reports and editor integration.

    Stars
    797
    Forks
    121
    Last commit
    5 months ago
    GPL-3.0-onlyOpen sourceSmart contract security

  • Foundry

    Fast toolkit for Ethereum development and testing

    Rust toolkit (forge, cast, anvil, chisel) to build, test, fuzz and deploy Solidity contracts, with fuzz and invariant testing built in.

    Stars
    11k
    Forks
    2.7k
    Last commit
    today
    Apache-2.0 OR MITOpen sourceSmart contract security

  • Mythril

    Symbolic execution analyser for EVM bytecode

    Security analysis tool from Consensys Diligence that uses symbolic execution and SMT solving to find vulnerabilities in EVM bytecode.

    Stars
    4.3k
    Forks
    821
    Last commit
    1 year ago
    MITOpen sourceSmart contract security

  • Echidna

    Property-based fuzzer for Ethereum smart contracts

    Trail of Bits' fuzzer that generates transaction sequences to break user-defined invariants and assertions in Solidity contracts.

    Stars
    3.2k
    Forks
    437
    Last commit
    5 days ago
    AGPL-3.0-onlyOpen sourceSmart contract security

  • Halmos

    Symbolic testing for EVM smart contracts

    a16z's symbolic testing tool that runs Foundry-style tests with symbolic inputs to prove properties or find counterexamples.

    Stars
    1k
    Forks
    113
    Last commit
    1 year ago
    AGPL-3.0-onlyOpen sourceSmart contract security

  • Semgrep

    Lightweight, pattern-based static analysis

    Fast static analysis engine where rules look like the code they match, supporting many languages; the open-source Community Edition runs locally and in CI.

    Stars
    17k
    Forks
    1.1k
    Last commit
    5 days ago
    LGPL-2.1-onlyOpen sourceStatic code analysis (SAST)
    Alternative toVeracodeCheckmarx One+1

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/slither