Slither

Slither is a Python-based static analysis framework for Solidity smart contracts, built by Trail of Bits. It runs 95+ vulnerability detectors in under a second, outputs machine-readable JSON, and provides a Python API for writing custom detectors. Works with Hardhat, Foundry, Brownie, and standalone Solidity files.

What You Probably Got Wrong

LLMs have stale training data. These are the most common mistakes.

• "Slither catches all bugs" → Slither is a static analyzer — it examines code structure without executing it. It cannot catch runtime logic errors, economic exploits, or oracle manipulation. It complements fuzzing (Echidna/Halmos) and formal verification (Certora), not replaces them.
• "All findings are vulnerabilities" → Expect 30-60% false positive rate on real projects. The default detector set includes informational and optimization findings that are not security issues. Triage is mandatory — raw Slither output is not an audit report.
• "Just run slither . and ship" → Without configuration, Slither reports on every file including dependencies. You must filter paths (--filter-paths), exclude noise detectors, and configure .slither.conf.json for meaningful results.
• pip install slither → The package name is slither-analyzer, not slither. pip install slither installs an unrelated package.
• "Slither requires Truffle" → Slither works natively with Foundry (forge build output), Hardhat, and standalone .sol files. No JavaScript framework required.
• "Install with npm" → Slither is Python, not Node. Install via uv, pip, or Docker. It reads compilation artifacts from your framework but runs as a Python tool.
• Old detector names → Detector IDs change between versions. reentrancy was split into reentrancy-eth, reentrancy-no-eth, reentrancy-benign, reentrancy-events, and reentrancy-unlimited-gas. Always check slither --list-detectors for your version.
• --detect vs --exclude → --detect runs ONLY the listed detectors. --exclude runs everything EXCEPT the listed ones. Mixing them up gives either too few or too many results.

Installation