Slither

Slither is an open-source static analysis framework for Solidity, maintained by Trail of Bits. It parses contracts into an intermediate representation and runs a library of detectors that flag common vulnerability patterns and code-quality issues — typically in seconds.

What It Detects

Slither ships with dozens of detectors, including reentrancy, unchecked return values, uninitialized storage, dangerous delegatecall, and tx.origin authentication, among others. It also prints useful code information (inheritance graphs, function summaries) for reviewers.

Where It Fits

Because Slither is fast and deterministic, it is well suited to running on every change in CI as a first line of defense. It produces false positives and cannot confirm exploitability, so it complements dynamic techniques like fuzzing and symbolic execution, plus expert review. Firepan uses Slither as best-effort corroboration alongside its HOUND AI analysis.

Frequently Asked Questions

Q: Is Slither free?

A: Yes. Slither is open source and free to use, which is why it is a de facto standard first-pass tool for Solidity projects.

---

Q: Can Slither find every vulnerability?

A: No. It detects known patterns quickly but produces false positives and misses logic-specific bugs. Use it alongside fuzzing, symbolic execution, and manual audit.