Analysis Methodology

What it does: Static analysis of Solidity source. Slither builds an intermediate representation (SlithIR), performs taint analysis and data-flow tracking, and runs ~92 detectors covering reentrancy, access control, arithmetic issues, storage layout bugs, and ERC compliance. It is fast (seconds) and produces high-confidence findings for well-defined vulnerability classes.

Strengths: Best-in-class coverage of reentrancy variants (including ERC777 and cross-function reentrancy). Strong access-control analysis. Reliable arithmetic checks pre-Solidity 0.8. Low false-positive rate on its highest-confidence detectors.

Known false-positive patterns: Low-impact detectors (naming conventions, unused variables) fire frequently on production code. Reentrancy detectors occasionally flag guarded patterns using non-standard mutexes. Import resolution failures on multi-file projects can cause detectors to silently skip contracts.

What it does: Symbolic execution over EVM bytecode using the Z3 SMT solver. Mythril explores all reachable execution paths and checks whether constraint sets satisfying a vulnerability condition (e.g., "attacker controls ether withdrawal") can be constructed. It maps findings to SWC registry categories, covering 37 vulnerability classes including integer overflow, assert violation, unprotected self-destruct, and delegatecall misuse.

Strengths: Finds execution-path vulnerabilities that source-level tools miss entirely. Integer overflows in complex arithmetic chains. Subtle access-control holes where multiple conditions must align. Unprotected state changes reachable only from specific call sequences.

Known false-positive patterns: Complex DeFi contracts often trigger solver timeouts, producing incomplete results. Symbolic execution cannot model real-world economic constraints — it may flag "theoretically reachable" paths that are economically infeasible. Loop-heavy contracts and contracts with large storage structures hit depth limits.

What it does: AST-aware pattern matching using ~201 ContractScan-written rules. Semgrep rules declaratively describe code patterns — e.g., "unchecked ERC20 transfer return value", "tx.origin used as authorization", "AMM spot price used as oracle" — and match them against the parsed AST with metavariable binding. Rules are tuned for precision over recall to minimise noise.

Strengths: Fastest engine. Easily auditable rules (human-readable YAML). Excellent precision on named vulnerability classes. Catches DeFi-specific patterns (spot-price oracle, single-transaction flash-loan surfaces) that static analyzers underserve.

Known false-positive patterns: Pattern rules cannot track data flow — a rule matching balanceOf(address(this)) as a spot-price oracle will fire even when the value is used only for display. Macros or unusual formatting may confuse the AST parser on very old Solidity versions.

What it does: Rust-based Solidity AST analyzer from the Cyfrin team. Aderyn parses contracts into a typed AST and runs detector modules targeting centralization risks (single-owner patterns with no timelock), unsafe type casts, unused return values, unchecked send/transfer results, and storage-layout issues. Rules are actively maintained by Cyfrin Updraft's smart-contract security curriculum team.

Strengths: Specifically tuned for modern Solidity (≥0.8.x) patterns. Strong centralization risk detection. Fast Rust runtime. Complements Slither by targeting a different detector set with lower overlap.

Known false-positive patterns: Centralization detectors may fire on governance contracts that are intentionally owner-controlled with off-chain checks. Unsafe-cast detectors fire on explicit downcasts that are bounds-checked in the surrounding logic.

What it does: Gas optimisation and code-quality analyzer modeled after the automated findings section of Code4rena audit contests. Runs ~100 checks covering: storage reads in loops, packed structs, unchecked arithmetic in loops, missing event emissions, floating pragma, and deprecated Solidity features.

Strengths: Catches gas inefficiencies that reviewers reliably flag in competitive audits. Useful for contracts that will be gas-sensitive (DEX routers, frequently-called vaults). Findings are actionable and low-ambiguity.

Known false-positive patterns: Gas findings are informational — they indicate suboptimal patterns, not exploitable vulnerabilities. Unchecked-arithmetic suggestions do not apply when the surrounding code has explicit overflow guards or uses SafeMath.

What it does: The AI engine sends contract source code to an LLM with a structured audit prompt enriched by real-world exploit context from the threat intelligence database. It reasons about business logic, token flow, access-control sequences, and cross-function state transitions that deterministic tools cannot model. Findings are categorised by type and assigned a confidence label.

Strengths: Only engine that can reason about economic attack surfaces (flash-loan choreography, sandwich MEV, governance vote manipulation), cross-contract trust assumptions, and off-specification ERC deviations. Provides natural-language explanations and fix guidance that static tools cannot.

Known false-positive patterns: LLMs hallucinate. AI-only findings are labelled potential and should be treated as starting points for manual review, not confirmed vulnerabilities. The model may flag oracle patterns as risky even when the contract uses a robust TWAP. Context-window limits mean very large contracts receive less thorough analysis.