slither-analyzer

What it is and what it does

Slither is a Python-based static analysis framework designed to scan Solidity and Vyper smart contracts for security vulnerabilities and code quality issues. It runs a suite of built-in detectors that identify common patterns like uninitialized state variables, arbitrary fund transfers, and storage array misuse, then reports findings with source code locations. The framework also includes 'printers' that generate visual summaries of contract structure and behavior, and exposes an API for developers to write custom analyses in Python.

The tool integrates into development workflows through CI/CD systems, pre-commit hooks, and build frameworks like Hardhat and Foundry. It depends on crytic-compile to handle contract compilation, web3 and eth-utils for blockchain interaction, and pycryptodome for cryptographic operations. Installation is straightforward via pip, though you need Python 3.10+ and a Solidity compiler (solc) if analyzing standalone files outside a supported build framework.

Use it for:

• Scan a Solidity codebase during development to catch high-impact vulnerabilities before deployment
• Integrate Slither into a GitHub Actions workflow to flag security issues on every pull request
• Analyze a Vyper contract for state variable shadowing, uninitialized storage, and other common mistakes
• Write a custom detector in Python to enforce project-specific contract coding rules or patterns
• Generate a markdown checklist report of contract findings for security review or audit documentation

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Slither is a static analysis framework for Solidity and Vyper smart contracts that detects vulnerabilities, generates contract information reports, and provides an API for writing custom analyses.

Yes, with conditions. Slither is actively maintained, has low install friction, and is widely used in the Ethereum ecosystem for contract security analysis. However, the AGPL-3.0 license requires that any modifications or derivative works be released under the same license—ensure this aligns with your project's licensing model before integrating it into proprietary software. For open-source projects or internal security tooling, it is a solid choice.

Install

slither-analyzer on PyPI

pip install slither-analyzer

uv add slither-analyzer

poetry add slither-analyzer

Installing slither-analyzer

Before you install

Low friction: pure Python wheel with 8 runtime dependencies including crytic-compile, web3, and eth-utils. Actively maintained with a release 17 days ago and 6343 repository stars. Requires Python 3.10+.

License in practice

Licensed under AGPL-3.0, which requires that any modifications or derivative works distributed must also be released under AGPL-3.0. This is a copyleft license; using it in proprietary software requires careful consideration of how the code is deployed.

Quickstart

pip install slither-analyzer
slither .
# or on a single file:
slither tests/uninitialized.sol

Requires Python 3.10+. If not using a supported compilation framework (Hardhat, Foundry, Dapp, Brownie), you must have solc (Solidity compiler) installed; solc-select is recommended for version management.

Verify before relying

• Whether the false-positive rate and detector accuracy claims in the description are independently validated
• Current coverage of Vyper detector rules relative to Solidity detectors
• Performance characteristics on large or complex contract suites beyond the stated 'less than 1 second per contract'

Package facts

Evidence: slither_analyzer-0.11.6-py3-none-any.whl

Keywords: ethereum, security, smart-contracts, solidity, static-analysis, vyper

Tags

More Quality Assurance packages