Run Slither First: Automated Bug Scanning

Why this matters

Slither is Trail of Bits' static analyser for Solidity — ~80 detectors covering everything from reentrancy to weak randomness to incorrect ERC-20 returns. It's not a fuzzer; it's pattern-matching on the AST. False-positive heavy, but fast and free. Every audit starts with a Slither run before any manual review.

Demo

Workflow: slither <repo> produces JSON + console output. Filter by severity (--exclude informational). Triage the High/Critical hits manually. Most are false positives; the few real ones are bugs you'd find in manual review eventually, faster here.

Try it yourself

1. REPRODUCE — pip install slither-analyzer. Run on a known-vulnerable contract (DamnVulnerableDeFi's UnstoppableVault). Read every High/Critical finding.
2. PATCH — for each true positive, apply the canonical fix. Re-run; verify the warning disappears.
3. VERIFY — write a custom Slither detector for a pattern your team cares about (e.g. 'no SafeERC20 on transferFrom').

References

• Slither
• Slither Detectors