npm install -g solidityscan-cli
## Verify installation
solidityscan --version
Once installed, you can run a basic scan on single Solidity files or directories:
solidityscan analyze ./contracts/MyContract.sol
Expected output includes a JSON report highlighting detected vulnerabilities by severity, name, and line number.
The API requires an API key obtained by registering on the SolidityScan platform (check current docs for key generation). The API base URL is https://api.solidityscan.example/v1/. Interacting with the API typically involves a POST request sending your Solidity source code or artifacts.
Here’s a minimal cURL example:
curl -X POST https://api.solidityscan.example/v1/analyze \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{"source": "pragma solidity ^0.8.0; contract Test { ... }"}'
The response is a structured JSON with vulnerability findings.
How SolidityScan Detects Vulnerabilities
SolidityScan leverages a hybrid detection engine combining:
- Machine learning classifiers trained on vulnerability-labeled code sets
- Pattern matching and heuristics for common Solidity issues
- Flow analysis for reentrancy, unchecked calls, and access control flaws
Unlike Slither, which is purely rule-based static analysis implemented in Python, SolidityScan’s AI layer can infer contextual risk patterns. However, this also means false positives or false negatives can occur especially on novel or obfuscated code.
Examples of vulnerable patterns it targets include:
- Reentrancy attacks, highlighting external calls followed by state updates
- Unchecked low-level calls that can silently fail
- Improper access control checks, flagging modifiers that don’t adequately restrict
- Overflow/underflow scenarios where SafeMath or built-ins are not employed
Internally, the tool parses the Solidity AST and control flow graphs, then applies its models to the extracted features. This layering yields vulnerability scores to prioritize critical risks.
Integrating SolidityScan API into CI/CD Pipelines
One of SolidityScan’s strongest features is its API integration tailored for continuous integration environments. For developers automating smart contract audits alongside deployment tests, this API unlocks efficient and repeatable security checks.
Here’s a simple GitHub Actions example snippet integrating SolidityScan API into a smart contract CI workflow:
name: solidityscan-audit
on: [push, pull_request]
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Install Node.js
uses: actions/setup-node@v3
with:
node-version: '18'
- name: Run SolidityScan API audit
env:
API_KEY: ${{ secrets.SCAN_API_KEY }}
run: |
echo 'Submitting contract for audit ...'
RESPONSE=$(curl -s -X POST https://api.solidityscan.example/v1/analyze \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d @contracts/MyContract.sol)
echo "$RESPONSE" | jq .
## Optionally fail build on critical vulnerabilities
CRITICAL=$(echo "$RESPONSE" | jq '.vulnerabilities | map(select(.severity == "critical")) | length')
if [ "$CRITICAL" -gt 0 ]; then
echo "Critical vulnerabilities found - failing build"
exit 1
fi
In production, I switched to uploading artifact bundles instead of raw source, improving analysis speed. The API supports multi-file projects and can parse solc JSON output formats.
This integration enables automatic gating based on security audit status — a must-have for DeFi protocol releases where exploit risk is a constant concern.
For further info on setting up SolidityScan within CI, see our smart-contract-ci-cd-pipeline guide.
Comparison: SolidityScan vs. Slither vs. Aderyn
Choosing a Solidity analysis tool depends on your project needs, team fluency, and risk appetite. Here is a pragmatic comparison focusing on SolidityScan versus the established Slither and Aderyn:
| Feature |
SolidityScan |
Slither |
Aderyn |
| Language |
Node.js CLI + REST API |
Python CLI |
Go CLI |
| Underlying Analysis |
AI-powered + heuristics |
Rule-based static analysis |
Symbolic execution + static |
| Chains Supported |
EVM-compatible mainly |
EVM + partial L2 |
EVM |
| API Integration |
Yes (REST API with auth) |
No official API; CLI scripts |
No API; CLI only |
| False Positives |
Moderate (requires tuning) |
Low; deterministic rules |
Medium; symbolic can overflag |
| Vulnerabilities Covered |
Common + emerging patterns |
Broad (reentrancy, gas, etc.) |
Deep property checks |
| License |
Open Core (freemium tiers) |
MIT License |
Apache 2.0 |
| Maturity |
Early-stage; evolving features |
Mature, widely used |
Growing, niche use |
I’ve found Slither hard to beat for deterministic checks and CI speed, but it can miss subtle logic flaws that AI can pick up. Aderyn’s symbolic execution helps explore edge states but falls short on multi-file projects due to scalability limits.
SolidityScan fills a middle ground—its AI approaches catch non-trivial issues but expect rough edges and evolving detection accuracy. Use it in combination rather than alone.
Check our aderyn-vs-slither-comparison page for a deeper dive into those two tools.
Best Practices for Secure AI-powered Audits
When using SolidityScan or any AI-based vulnerability detection tool, several safeguards improve overall audit reliability:
- Session keys and controlled API tokens: Never embed long-lived API keys in public repos. Use ephemeral tokens scoped to audit jobs.
- Spending limits on smart agent wallets: When wiring audit approval flows or paid endpoints (e.g., x402-based), restrict session keys to least privilege.
- Cross-validate findings: Always confirm AI-driven vulnerability flags against rule-based analysis (Slither, MythX, etc.)
- Test on a representative code subset: AI models perform best on patterns similar to training data. For unconventional contracts, manual review remains vital.
- Beware of untrusted MCP servers: If feeding sensitive contract code to hosted MCP or AI oracle services, evaluate data privacy and risk of leaking intellectual property.
The gotcha I hit running SolidityScan locally was occasional timeouts on large projects due to model complexity—using the API with batch uploads mitigated that effectively.
Common Pitfalls and Troubleshooting
Some typical issues developers face with SolidityScan AI vulnerability detection and integration:
- High false positive rates: Adjust confidence thresholds in the API request (check docs for
min_confidence flag). Don’t accept all results blindly.
- API rate limits exceeded during CI runs: Manage concurrency or cache scan results locally to prevent throttling.
- Invalid source code errors: Ensure contracts compile cleanly with compatible solc versions; SolidityScan uses solc 0.8.x internally.
- Unexpected scan coverage gaps: Multi-file projects require uploading all dependencies simultaneously. Single-file scans can miss external call chains.
If you receive errors like 401 Unauthorized, double-check your API key scope and expiration.
For a broader security audit workflow that includes formal verification, see our certora-formal-verification-tutorial.
Conclusion and Next Steps
SolidityScan AI offers a promising addition to the Solidity security audit toolbox, especially if you want an integrated API that fits into CI/CD pipelines easily. Its AI-driven detection brings complementary perspectives to time-tested static analyzers like Slither and symbolic tools like Aderyn.
That said, I believe no single tool catches everything yet. Combining SolidityScan’s insights with classical rule-based checks and manual review remains best practice. And don’t shy away from putting session keys and spending limits in place when connecting AI-powered audits with agent wallets or MCP payment endpoints.
Ready to try it out? Start small with the CLI, then hook up the API for a simple GitHub Action audit job. Dive deeper into the scanning data to understand what the AI flags and tune thresholds accordingly.
Explore related topics here:
Security is never done, but tooling like SolidityScan helps developers move faster with more confidence.
