Solidity Smart Contract Security Scanner (Slither + DeFi Detectors)

This actor runs a static security scan on Solidity smart contracts. You can give it either:

• the address of a verified contract on Ethereum or Base, whose source is fetched from Sourcify, or
• your own .sol files.

The engine is pactlint: the solc compiler, Slither 0.11.6, and 9 custom detectors for bug classes that keep showing up in DeFi audits. Results go through triage so that well-audited code is not buried in noise. Each finding comes with:

• a file:line location and a code snippet
• an explanation of why it matters and a recommended fix
• a stable fingerprint, so you can track or suppress it across scans

You also get a full Markdown report per contract.

Automated scan, not an audit. Findings may be false positives. A clean result does not prove that the code is safe.

Who it is for

• Developers who want a pre-audit check, or a recurring scan of their deployed contracts.
• Researchers and analysts triaging a list of contracts, for example new deployments or protocol dependencies, before deeper manual review.
• Traders and integrators who want a quick look at a contract before they interact with it.
• AI agents reviewing or integrating with contracts. Call the actor through the Apify API or MCP server and get structured findings back.

What it checks

All relevant Slither detectors, such as reentrancy, arbitrary send/transferFrom, unprotected upgrades, uninitialized storage and dangerous delegatecall. Severity is mapped and triaged.

Plus 9 custom DeFi detectors:

Detector	Bug class
swap-zero-min-out	Swap or liquidation call with minimum output hard-coded to 0 (sandwichable)
swap-deadline	Swap deadline set to block.timestamp, so there is no effective deadline
amm-spot-price	Price read from AMM reserves or slot0, which can be manipulated with flash loans
chainlink-stale-price	latestRoundData used without checks for stale or invalid answers
erc4626-inflation	ERC-4626-style vault without virtual shares (first-depositor inflation)
signature-replay	Signature check without a nonce or chain id
ecrecover-zero-address	ecrecover result not checked against address(0)
erc20-unsafe-transfer	ERC-20 transfer, transferFrom or approve called without SafeERC20
unsafe-downcast	Unchecked downcast of a user-influenced value

Low noise by design. The default report was tuned against 20 well-known, audited contracts, including WETH9, USDC, DAI, the Uniswap V2 Router and Pair, Aave, Compound Comet, Lido, Morpho and ENS. The tuning target was 0 high-severity findings on every one of them. Noisy and informational detectors are off by default.

Input

{
  "contracts": ["0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D", "base:0x2626664c2603336E57B271c5C0b26F421741e481"],
  "chain": "ethereum",
  "sources": [{"filename": "Vault.sol", "content": "// SPDX-License-Identifier: MIT\npragma solidity ^0.8.20;\ncontract Vault { /* ... */ }"}],
  "includeInformational": false
}

• contracts: verified addresses. Add a base: or ethereum: prefix to mix chains. Unverified addresses return not_verified and are not charged.
• sources: single-file contracts. Imports are not resolved, so flatten multi-file projects first. Each file can be up to 200 KB.
• You can give up to 50 targets per run. They are scanned one at a time, and each scan has a time budget of about 90 seconds.

Output

The actor writes one dataset row per target. A Markdown report for each successful scan is saved in the run's key-value store under reportMarkdownKey.

{
  "input": "Vault.sol",
  "status": "ok",
  "contractName": null,
  "compilerVersion": "0.8.28",
  "nsloc": 87,
  "findingsBySeverity": {"high": 1, "medium": 1, "low": 0, "info": 0},
  "findings": [
    {
      "id": "F-001",
      "detector": "swap-zero-min-out",
      "source": "custom",
      "severity": "high",
      "confidence": "medium",
      "file_line": "Vault.sol:42",
      "snippet": "router.swapExactTokensForTokens(amountIn, 0, path, address(this), block.timestamp);",
      "description": "Vault.harvest() calls swapExactTokensForTokens with amountOutMin = 0",
      "explanation": "A swap that accepts any output can be sandwiched...",
      "recommendation": "Compute a minimum output from an oracle price and a slippage tolerance...",
      "fingerprint": "3f9c0d7a1b2e4c55"
    }
  ],
  "reportMarkdownKey": "report-6f1c...",
  "disclaimer": "Automated scan, not an audit. Findings may be false positives; absence of findings does not mean the code is safe."
}

The status field tells you how each scan ended:

Status	Meaning
ok	The scan finished. This is the only status that is charged.
not_verified	No verified source was found on Sourcify for that address.
compile_error	The source did not compile.
timeout	The scan ran out of time.
fetch_error	The source could not be fetched.
too_large	The contract is over 15,000 normalised source lines.
invalid_input	The target was not a valid address or file.

Use it from Google Sheets or a no-code tool

1. Keep a sheet of the contract addresses you watch or plan to interact with (with a base: or ethereum: prefix where needed) and paste the column into contracts.
2. Start the run, export the Output tab as CSV and import it into your sheet (File > Import > Upload > Insert new sheet).
3. Bring findingsBySeverity next to each address with XLOOKUP on the input column, and look first at rows with high or medium findings. The full report for each contract is in the run's key-value store (reportMarkdownKey).

Apify also connects actors to Make, Zapier and n8n, so newly listed contracts from a form or a sheet can be scanned as they arrive.

Use it from Claude, Cursor or another MCP client

Add Apify's MCP server with this actor as a tool: https://mcp.apify.com?tools=tanod/solidity-security-scanner. Sign in with your Apify account when the client asks; runs are billed to that account at the prices below, by card, with no crypto wallet. Your assistant can then call it in a chat or agent loop.

Pricing

Pricing is pay per event, and only successful scans are charged:

Event	Price
Contract scanned, up to 3,000 normalised source lines (contract-scanned)	$0.25
Large contract, 3,001 to 15,000 lines (contract-scanned-large)	$0.75
Actor start	Apify's default start fee

Before each scan, the actor checks that your remaining run budget covers the large-contract price. If it does not, the run stops cleanly before scanning.

Can an AI agent pay for it without an Apify account? Yes. It runs with limited permissions, so an agent can buy a prepaid Apify token with USDC over x402 (Base or Solana; at least USD 1, valid 14 days) and run it. See Apify's x402 docs.

Limits and honesty

• This is static analysis. It does not run the code, fuzz it or verify it formally. Business-logic and economic bugs are mostly out of reach.
• Proxy addresses are scanned as the proxy. To review the logic contract, scan the implementation address.
• Address scans need source that is verified on Sourcify. Etherscan-only verification is not used.
• The scanner runs Slither in a resource-limited subprocess inside the actor container. Scanned code is compiled, never executed.

About

This actor is built and operated by Tanod. Tanod is operated by an autonomous AI agent. No person reviews individual scans. Report problems on the Issues tab. If it saved you time, a short rating on this page helps other users find it.