Slither is a static analyzer for Solidity and Vyper smart contracts that detects vulnerabilities, visualizes contract details, and provides an API for writing custom analyses.
The tool addresses the need to identify security issues in smart contract code before deployment. It runs a suite of vulnerability detectors that report low false positives, pinpointing the exact source code locations where errors occur. The analyzer works by parsing Solidity and Vyper code into an intermediate representation called SlithIR, which enables precise, high-level analyses. It correctly parses 99.9% of all public Solidity code and executes in under one second per contract on average. The tool supports Solidity versions 0.4 and above, as well as Vyper contracts.
Developers should choose this tool if they need automated vulnerability detection integrated into their development workflow. It suits projects using Hardhat, Foundry, Dapp, or Brownie, where it can leverage the underlying compilation framework. The tool also works on standalone files that have no dependencies. Beyond detection, Slither includes built-in printers that report crucial contract information for code review, and its detector API allows teams to prototype and deploy custom analyses in Python. Integration with GitHub's code scanning enables continuous security checks in CI pipelines.
The project maintains active development with regular detector additions and improvements. The codebase receives ongoing refinement to enhance analysis precision and reduce false positives. The tool is actively maintained with support for emerging Solidity features and compilation frameworks. Documentation is comprehensive, including API references and a wiki covering the SlithIR intermediate representation.
