SolidityScan is a relatively new AI-driven static analysis tool designed to identify security vulnerabilities in Solidity smart contracts. What stands out about SolidityScan is its use of machine learning models trained on extensive smart contract codebases and known vulnerabilities. This enables it to flag patterns that traditional rule-based static analyzers sometimes miss.
In my experience, AI-powered analyzers like SolidityScan act as a valuable complementary check alongside classical tools such as Slither and Aderyn. But it’s essential to understand the type of vulnerabilities SolidityScan focuses on and how its API facilitates seamless integration into modern development workflows.
This article covers everything from getting started with SolidityScan to integrating its API for automated CI auditing, plus a detailed comparison with other Solidity analysis tools.
SolidityScan offers both a standalone CLI and a RESTful API. Installing the CLI is straightforward and requires Node.js 18+.
npm install -g solidityscan-cli
# Verify installation
solidityscan --version
Once installed, you can run a basic scan on single Solidity files or directories:
solidityscan analyze ./contracts/MyContract.sol
Expected output includes a JSON report highlighting detected vulnerabilities by severity, name, and line number.
The API requires an API key obtained by registering on the SolidityScan platform (check current docs for key generation). The API base URL is https://api.solidityscan.example/v1/. Interacting with the API typically involves a POST request sending your Solidity source code or artifacts.
Here’s a minimal cURL example:
curl -X POST https://api.solidityscan.example/v1/analyze \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{"source": "pragma solidity ^0.8.0; contract Test { ... }"}'
The response is a structured JSON with vulnerability findings.
SolidityScan leverages a hybrid detection engine combining:
Unlike Slither, which is purely rule-based static analysis implemented in Python, SolidityScan’s AI layer can infer contextual risk patterns. However, this also means false positives or false negatives can occur especially on novel or obfuscated code.
Examples of vulnerable patterns it targets include:
Internally, the tool parses the Solidity AST and control flow graphs, then applies its models to the extracted features. This layering yields vulnerability scores to prioritize critical risks.
One of SolidityScan’s strongest features is its API integration tailored for continuous integration environments. For developers automating smart contract audits alongside deployment tests, this API unlocks efficient and repeatable security checks.
Here’s a simple GitHub Actions example snippet integrating SolidityScan API into a smart contract CI workflow:
name: solidityscan-audit
on: [push, pull_request]
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Install Node.js
uses: actions/setup-node@v3
with:
node-version: '18'
- name: Run SolidityScan API audit
env:
API_KEY: ${{ secrets.SCAN_API_KEY }}
run: |
echo 'Submitting contract for audit ...'
RESPONSE=$(curl -s -X POST https://api.solidityscan.example/v1/analyze \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d @contracts/MyContract.sol)
echo "$RESPONSE" | jq .
# Optionally fail build on critical vulnerabilities
CRITICAL=$(echo "$RESPONSE" | jq '.vulnerabilities | map(select(.severity == "critical")) | length')
if [ "$CRITICAL" -gt 0 ]; then
echo "Critical vulnerabilities found - failing build"
exit 1
fi
In production, I switched to uploading artifact bundles instead of raw source, improving analysis speed. The API supports multi-file projects and can parse solc JSON output formats.
This integration enables automatic gating based on security audit status — a must-have for DeFi protocol releases where exploit risk is a constant concern.
For further info on setting up SolidityScan within CI, see our smart-contract-ci-cd-pipeline guide.
Choosing a Solidity analysis tool depends on your project needs, team fluency, and risk appetite. Here is a pragmatic comparison focusing on SolidityScan versus the established Slither and Aderyn:
| Feature | SolidityScan | Slither | Aderyn |
|---|---|---|---|
| Language | Node.js CLI + REST API | Python CLI | Go CLI |
| Underlying Analysis | AI-powered + heuristics | Rule-based static analysis | Symbolic execution + static |
| Chains Supported | EVM-compatible mainly | EVM + partial L2 | EVM |
| API Integration | Yes (REST API with auth) | No official API; CLI scripts | No API; CLI only |
| False Positives | Moderate (requires tuning) | Low; deterministic rules | Medium; symbolic can overflag |
| Vulnerabilities Covered | Common + emerging patterns | Broad (reentrancy, gas, etc.) | Deep property checks |
| License | Open Core (freemium tiers) | MIT License | Apache 2.0 |
| Maturity | Early-stage; evolving features | Mature, widely used | Growing, niche use |
I’ve found Slither hard to beat for deterministic checks and CI speed, but it can miss subtle logic flaws that AI can pick up. Aderyn’s symbolic execution helps explore edge states but falls short on multi-file projects due to scalability limits.
SolidityScan fills a middle ground—its AI approaches catch non-trivial issues but expect rough edges and evolving detection accuracy. Use it in combination rather than alone.
Check our aderyn-vs-slither-comparison page for a deeper dive into those two tools.
When using SolidityScan or any AI-based vulnerability detection tool, several safeguards improve overall audit reliability:
The gotcha I hit running SolidityScan locally was occasional timeouts on large projects due to model complexity—using the API with batch uploads mitigated that effectively.
Some typical issues developers face with SolidityScan AI vulnerability detection and integration:
min_confidence flag). Don’t accept all results blindly.If you receive errors like 401 Unauthorized, double-check your API key scope and expiration.
For a broader security audit workflow that includes formal verification, see our certora-formal-verification-tutorial.
SolidityScan AI offers a promising addition to the Solidity security audit toolbox, especially if you want an integrated API that fits into CI/CD pipelines easily. Its AI-driven detection brings complementary perspectives to time-tested static analyzers like Slither and symbolic tools like Aderyn.
That said, I believe no single tool catches everything yet. Combining SolidityScan’s insights with classical rule-based checks and manual review remains best practice. And don’t shy away from putting session keys and spending limits in place when connecting AI-powered audits with agent wallets or MCP payment endpoints.
Ready to try it out? Start small with the CLI, then hook up the API for a simple GitHub Action audit job. Dive deeper into the scanning data to understand what the AI flags and tune thresholds accordingly.
Explore related topics here:
Security is never done, but tooling like SolidityScan helps developers move faster with more confidence.