Slither

What it is

Slither, from Trail of Bits, ships more than the detector suite the summary names: a set of standalone sub-tools and printers, plus specific installation paths and a well-known compilation gotcha. This document carries the operational detail an engineer needs before running it.

What to do

Requires Python 3.10+. Install via any of:

uv tool install slither-analyzer

python3 -m pip install slither-analyzer

brew install slither-analyzer

Or run without installing: uvx --from slither-analyzer slither <target>. For the full toolchain plus every major solc version, use the Docker image trailofbits/eth-security-toolbox.

Run on a project (preferred — Slither reuses the framework's compiler):

slither .

Single file without dependencies: slither tests/uninitialized.sol. Generate a Markdown report: slither [target] --checklist .; add GitHub source links with --checklist --markdown-root https://github.com/ORG/REPO/blob/COMMIT/.

Beyond the core detectors, these standalone tools ship with Slither:

• slither-check-upgradeability — reviews delegatecall-based upgradeability
• slither-prop — automatic unit test and property generation
• slither-flat — flattens a codebase
• slither-check-erc — ERC conformance
• slither-read-storage — reads contract storage values
• slither-interface — generates an interface for a contract

Printers (via --print, comma-separated) include human-summary, inheritance-graph, call-graph, cfg, function-summary, vars-and-auth, and not-pausable (functions lacking whenNotPaused).

CI integrations: slither-action for GitHub Actions, and a pre-commit hook (repo: https://github.com/crytic/slither, id: slither).

Preconditions / Affected

Slither needs the solc AST, so all dependencies must be resolvable. slither contract.sol fails on a contract with imports. Instead run slither . from the directory above contracts/ (you should see contracts/ when you ls), with node_modules/ alongside contracts/. Supports Solidity ≥ 0.4 and Vyper. If not using a supported framework (Hardhat/Foundry/Dapp/Brownie), install solc — the page recommends solc-select to switch versions.

Caveats

The compilation failure mode is the most common friction point: "unknown file" errors mean the underlying framework itself cannot compile. Verify with the native command (e.g. npx hardhat compile) first — if that fails, so will Slither's engine. The page cites "correctly parses 99.9% of all public Solidity code," so parsing gaps, though rare, exist.