Open main menu
HomeDetectorsBlog
Sign Up

Slither: Static Analyzer for Solidity Smart Contracts

•

Slither: Static Analyzer for Solidity Smart Contracts

Table of Contents

Do not index
Do not index
Are you ready to elevate your Solidity game?
Today's focus is on a tool that's reshaping the way we handle Solidity – Slither. As a Solidity static analysis framework, it's been instrumental in auditing smart contracts.
The blockchain ecosystem continues to evolve, and with it, rigorous security practices are needed. In this realm, static analysis emerges as a crucial tool for vetting the security and quality of smart contracts.
Let’s jump on this journey together and discover how Slither can make our smart contracts smarter and more secure!

Slither, the Smart Contract Static Analyzer

notion image
Slither is a static analysis framework developed for Solidity code. Static analysis examines vulnerable solidity code without executing it, offering a quick way to identify vulnerabilities, bugs, and code style issues.
Developed by Trail of Bits, Slither works by converting Solidity code into a SlithIR representation, which is an intermediate representation tailored for smart contract analysis. This can provide precise insights about potential vulnerabilities in your contracts.

Features of the Slither Static Analysis Framework

Comprehensive Detection: Identifies common Solidity vulnerabilities.
Continuous Integration Support: Easily integrates with CI/CD pipelines.
Extensibility: Developers can create custom detectors to find project-specific code patterns.
Detailed Output: Generates clear feedback with a path to the issue in the code.

How to Install Slither

You can easily install Slither using pip. It is recommended to do so in a python virtual environment:
pip3 install slither-analyzer

How to Check a Smart Contract Using Slither Solidity Analysis

Navigate to your smart contract code directory and run:
slither .
This will execute Slither on all Solidity files in the directory.

Using Git

If you're tracking changes in Git, Slither can analyze only the difference (diff) by:
slither --git-diff origin/master .

How is Slither Better than Other Static Analysis Tools?

While many static analysis tools exist, Slither stands out due to its precision, extensibility, and ability to detect a wide range of issues, including those related to Solidity's unique idiosyncrasies. Given it's prevalence in the industry and highly customizable architecture, Slither is a leading Solidity static analysis framework.
Not only does Slither allow you to analyze Solidity code easily, but you can also easily write custom analyses to further inspect Solidity code.

How to Use Detectors in Slither

Detectors allow Slither to spot vulnerabilities in a smart contract. To see a list of all available detectors:
slither --list-detectors
To run a specific detector:
slither . --detect detector_name

How to Use Printers in Slither

Printers provide insightful overviews and metrics about your contract. To view available printers:
slither --list-printers
To use a specific printer:
slither . --print printer_name

How to Filter Slither Output Results

Slither results can be filtered for better clarity. To only display high-severity issues:
slither . --filter-priority HIGH

In-Depth Review Printers

Printers can provide detailed overviews of various contract aspects:
Contract Summary Printer: Gives an overview of the entire contract.
slither . --print contract-summary
Authorization Printer: Lists the authorization requirements of each function.
slither . --print authorization

Remappings in Slither: A Deep Dive

When working with Solidity projects that utilize multiple files or imported libraries, the concept of path remapping becomes important. Path remapping ensures that static analysis tools, like Slither, correctly interpret the source code's structure and dependencies. Slither accommodates this with its own remapping feature.

What is Remapping?

In the context of Solidity, remapping is the redirection of one base path to another. This is particularly useful when working with external libraries or when reorganizing your project directory. Without remapping, Solidity might not find the imported files, resulting in compilation errors.
For example, let's say a contract imports a file using:
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
The `@openzeppelin` path might not correspond to a real file system path. Instead, it's an alias that needs to be mapped to an actual location in the file system where the OpenZeppelin contracts reside.

How Does Slither Handle Remapping?

Slither understands Solidity's remapping mechanism and integrates it into its analysis process. When Slither encounters a path alias (like `@openzeppelin` in the example above), it needs to know the corresponding real file system path to correctly analyze the entire codebase.

Using Remapping with Slither

To use remapping with Slither, you provide the remapped paths as arguments:
slither . --solc-remappings "alias=path"
For multiple remappings, separate them by a space:
slither . --solc-remappings "alias1=path1 alias2=path2"
Continuing our example with the OpenZeppelin contracts, if they reside in a folder named `oz_contracts`, you'd remap like this:
slither . --solc-remappings "@openzeppelin=./oz_contracts"
Remapping is an essential feature for complex Solidity projects with multiple files, dependencies, or external libraries. It ensures that tools like Slither can provide a holistic and accurate analysis of the codebase. By understanding and utilizing Slither's remapping capabilities, developers can be confident that their entire codebase, including dependencies, undergoes rigorous security scrutiny.

Methods for Installation of Slither

Apart from pip, Slither can also be installed via:

With Git

Clone the repository and install:
git clone https://github.com/crytic/slither.git && cd slither
python3 setup.py install

The Power of Static Analysis: Benefits Unveiled

notion image
In the software development realm, ensuring that code is reliable, efficient, and free from vulnerabilities is of utmost importance. Static analysis is one of the primary methods developers employ to achieve this goal when analyzing a smart contract. Unlike dynamic analysis, which tests code by executing it, static analysis evaluates the source code, bytecode, or application binaries without execution. Below, we'll delve into the manifold benefits of this technique.
Early Bug Detection
  • Before Execution: One of static analysis's main advantages is its ability to detect potential errors and vulnerabilities in the early stages of the development cycle, often even before the code is run for the first time.
  • Cost-Efficient: Finding and fixing bugs early in the development process can be significantly less costly and time-consuming than addressing them post-deployment.
Comprehensive Code Coverage
  • Every Line, Every Time: Static analysis can scan every line of code, ensuring that the entire codebase is reviewed for potential issues, even parts of the application that are rarely executed.
  • Consistency: Each review is as thorough as the last, eliminating the inconsistencies that can arise from manual code reviews.
Enhanced Code Quality
  • Code Standards Adherence: Static analysis tools can check the source code's compliance against established coding standards and best practices.
  • Readability & Maintenance: By enforcing coding standards and highlighting areas of complexity, the resultant codebase becomes more readable and maintainable.
Security Assurance
  • Vulnerability Detection: Many static analysis tools are equipped to detect common vulnerabilities, such as SQL injection, cross-site scripting, or buffer overflows.
  • Risk Reduction: By spotting and addressing security vulnerabilities before deployment, the potential risk and impact of security breaches are substantially reduced.
Documentation & Visualization
  • Code Structure Insight: Static analysis tools can often provide a visual representation of the code structure, helping developers understand the codebase's architecture.
  • Automatic Documentation: Some tools generate documentation based on the code, helping maintain up-to-date documentation with minimal effort.
Continuous Integration (CI) Compatibility
  • Automated Checks: Static analysis tools can seamlessly integrate into CI/CD pipelines, ensuring that every code change or addition is automatically checked for issues.
  • Regularity: With CI integration, static analysis can be run regularly, ensuring consistent code quality checks throughout the development lifecycle.
Educational Value
  • Learning from Mistakes: When static analysis tools flag issues, developers can understand their mistakes and avoid them in future projects.
  • Best Practices: Regular feedback from these tools can help instill best coding practices among development teams.
Scalability
  • Large Codebases: Static analysis is particularly beneficial for large projects or codebases, where manual code review becomes unfeasible due to the sheer volume of code.
  • Consistency Across Projects: For organizations with multiple projects, static analysis ensures consistent quality checks across all of them.

Slither vs. AuditBase

In the ever-evolving landscape of blockchain technology, the security and efficiency of smart contracts are paramount. AuditBase is a smart contract analysis tool with hundreds of vulnerability detectors. Static analysis tools play a pivotal role in ensuring that smart contracts are free from vulnerabilities and bugs.

No Configuration Hassle

One of the standout features of AuditBase is its zero-configuration requirement. Whereas many static analysis tools demand developers to tinker with settings, remappings, and parameters, AuditBase offers a seamless experience. Simply point it to your codebase, and it's ready to go. This feature not only saves time but also reduces the potential for human error that can come with manual configurations.

Enhanced Detection Capabilities

The capability of a static analysis tool is measured by its ability to detect issues—and on this front, AuditBase truly shines. It boasts the capability to detect approximately six times as many issues as other leading tools. Such extensive detection means a significantly reduced risk of vulnerabilities slipping through the cracks. With the growing complexity of smart contracts and the increasing value at stake, this thoroughness is more vital than ever.

High-Quality Reports

Raw data is good, but interpretation is better. AuditBase doesn't just identify vulnerabilities; it provides high-quality, comprehensive reports that detail each issue. These reports:
  • Clarify the Severity: Understand the criticality of each vulnerability, allowing developers to prioritize fixes.
  • Offer Context: Rather than just pointing out issues, AuditBase provides context, helping developers grasp why a particular piece of code poses a risk.
  • Recommend Solutions: Beyond identification, the reports also provide actionable insights on how to rectify the vulnerabilities.
  • Facilitate Communication: For teams or projects where multiple stakeholders need to understand the audit results (including non-developers), these clear and detailed reports act as a bridge, ensuring everyone is on the same page.

Is Slither the Best Smart Contract Analysis Tool?

notion image
In a sector where the difference between success and catastrophe can hinge on a single overlooked vulnerability, having a robust static analysis tool is non-negotiable. AuditBase, with its user-friendly approach, enhanced detection capabilities, and top-tier reporting, represents the future of Solidity static analysis.
As smart contract development continues to surge, tools like AuditBase are set to become indispensable assets in the toolkit of every smart contract developer.

Stay ahead of the Web3 security curve!

Learn tips and tricks from top auditors and stay up-to-date on the latest news.

Subscribe