Definition: Smart contract security tools inspect source code, bytecode, tests, or repository context for evidence of vulnerabilities. Slither performs static analysis, Mythril uses symbolic execution, Echidna fuzzes user-defined properties, and Firepan's HOUND combines deterministic repository detectors with AI-assisted verification and deeper hypothesis-driven analysis. They are different tools, not interchangeable guarantees.
Quick Comparison
| Tool | Primary input | Method | Best evidence | Main limitation | |---|---|---|---|---| | Slither | Solidity/Vyper project | Static analysis | Repeatable detector findings and code properties | Compilation and detector coverage constrain results | | Mythril | EVM bytecode/Solidity | Symbolic execution | Reachable EVM states satisfying vulnerability conditions | State explosion, runtime, and false positives | | Echidna | Solidity plus properties | Stateful property fuzzing | A concrete sequence that violates a written invariant | Only tests properties the team defines | | Firepan surface scan | Public GitHub repository | Deterministic patterns, bug-class detectors, optional LLM verification | Structured findings, quality metrics, and scan log | Fast triage; not exhaustive or a certification | | Firepan deep audit | Authenticated repository scope | Code graph, generated/tested hypotheses, curation, best-effort Slither corroboration | Repository-context findings with an evidence trail | Timing and coverage vary with scope, build, and evidence |
Slither: Fast Static Analysis
Slither parses a contract project and runs deterministic detectors for known code properties and vulnerability patterns. It is fast enough for local development and CI, produces machine-readable output, and is extensible with custom checks.
Static analysis does not prove a contract safe. A detector can miss business-logic vulnerabilities outside its model, and a warning can be non-exploitable in the surrounding architecture. Treat Slither output as evidence to investigate, not as a final verdict.
Mythril: Symbolic Execution
Mythril explores EVM execution paths symbolically, asking whether inputs and state can satisfy conditions associated with vulnerabilities. It can investigate behaviors that a syntax-level rule cannot see and can work from EVM bytecode.
The tradeoff is computational complexity. Path explosion and environmental assumptions can limit coverage or produce paths that are theoretically reachable but irrelevant in the deployed system. Reproduce important results against the real build and scope.
Echidna: Property-Based Fuzzing
Echidna generates stateful transaction sequences and looks for a counterexample to properties written by the development or review team. For a vault, useful properties might constrain asset conservation, authorization, solvency, or share accounting.
Its strength is also its constraint: Echidna cannot infer every intended business invariant. Weak or missing properties produce weak assurance. The highest-value work is often defining the right invariants before running the fuzzer.
HOUND AI: Repository Triage and Deep Analysis
Firepan exposes two distinct workflows:
- The free
POST /surface/scanendpoint accepts a public GitHub repository without a bearer token. It finds Solidity, Vyper, or Compact contracts, applies deterministic pattern and bug-class detectors, computes quality metrics, and can use a limited number of LLM calls to verify or summarize signals. - Authenticated deep audits build repository context, generate and test security hypotheses, curate findings, and can run Slither as best-effort corroboration for compatible in-scope files.
HOUND does not currently represent Mythril and Echidna as mandatory stages of every Firepan audit, and Firepan does not claim that the repository auditor performs blanket 24/7 transaction or mempool surveillance. Sentinel is a separate point-in-time EVM token risk scorecard.
Run the Free Firepan Scan
Use the browser form or call the public API directly:
curl -sS https://api.firepan.com/surface/scan \
-H 'Content-Type: application/json' \
-d '{"target":"https://github.com/OpenZeppelin/openzeppelin-contracts"}'
Inspect both the HTTP status and the JSON error field. A successful response includes an execution ID, repository name, risk score, findings, quality metrics, contract count, duration, summary, and scan log. A fast surface scan is useful for triage; material systems still need tests, independent review, and additional assurance appropriate to their value at risk.
Which Tool Should You Use?
- Start with Slither for fast deterministic feedback during Solidity development.
- Use Mythril when EVM path exploration matches the question you are investigating.
- Use Echidna when the team can state high-value invariants and wants concrete counterexamples.
- Use the Firepan surface scan for low-friction repository triage and structured API output.
- Use a Firepan deep audit when repository-scale context and hypothesis investigation are warranted.
- Use multiple independent methods for high-value or novel systems; tool agreement is stronger evidence than any single clean run.
Frequently Asked Questions
Q: Does Firepan run Slither, Mythril, and Echidna on every audit?
A: No. The current implementation includes Firepan's deterministic detectors and HOUND workflows. Compatible deep audits can use Slither as best-effort corroboration. Mythril and Echidna are valuable independent tools but are not represented as mandatory pipeline stages.
Q: Can any of these tools prove a contract is secure?
A: No. Each tool has a defined input and detection envelope. A clean run means the tool did not produce a finding under that configuration; it is not proof that no vulnerability exists.
Q: Is the Firepan surface scan really unauthenticated?
A: Yes for public GitHub repositories. The POST /surface/scan route does not require a bearer token. Private repositories and deeper workflows require authenticated access.
Q: Can I submit a deployed contract address to the free HOUND endpoint?
A: No. The HOUND surface endpoint accepts a repository URL or server-side repository path. Use Sentinel for the separate EVM contract-address token scorecard.