{ "reviewDate": "2026-09-05", "scope": "Documentation and provider-page review; no runtime, detection-quality, license or pricing benchmark. A listed ecosystem is a broad classification, not exhaustive chain support.", "tools": [ { "id": "4naly3er", "name": "4naly3er", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Generate a first-pass Solidity findings report for recurring code patterns during audit preparation.", "limitation": "Treat generated findings as review leads, with duplicates and false positives possible.", "sourceUrl": "https://github.com/Picodes/4naly3er", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "act", "name": "Act", "category": "formal", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Write declarative specifications of contract behavior and use them in verification workflows.", "limitation": "A specification must capture intended behavior. Omitted properties remain unchecked.", "sourceUrl": "https://github.com/argotorg/act", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "acton", "name": "Acton", "category": "ton", "ecosystems": [ "TON" ], "format": "developer-tool", "status": "documented", "description": "Use TON's Acton development toolchain for building and testing smart contract projects.", "limitation": "Match the target language and network settings and add security-specific message-flow scenarios.", "sourceUrl": "https://ton-blockchain.github.io/acton/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Tact", "Tolk", "FunC", "TVM" ] }, { "id": "aderyn", "name": "Aderyn", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Inspect Solidity source with a Rust-based static analyzer and review findings in the command line or editor.", "limitation": "Confirm compiler and project support before making it a CI gate.", "sourceUrl": "https://github.com/Cyfrin/aderyn", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "anchor", "name": "Anchor", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Build and test Solana programs with account constraints, interfaces and framework tooling.", "limitation": "Review each account constraint and CPI trust assumption. The framework cannot infer missing authorization rules.", "sourceUrl": "https://github.com/otter-sec/anchor", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "ape-framework", "name": "Ape Framework", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Use Python accounts, providers, compiler plugins and tests to investigate on-chain applications.", "limitation": "Plugin and provider support determine the available networks and execution environment.", "sourceUrl": "https://github.com/ApeWorX/ape", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "aptos-cli", "name": "Aptos CLI", "category": "move", "ecosystems": [ "Move" ], "format": "developer-tool", "status": "documented", "description": "Compile, test and interact with Aptos Move packages through the official command-line interface.", "limitation": "Deployment and test success do not replace a review of capabilities and module invariants.", "sourceUrl": "https://aptos.dev/build/cli", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Aptos", "capabilities" ] }, { "id": "arkworks", "name": "ark-r1cs-std (Arkworks)", "category": "zk", "ecosystems": [ "Rust" ], "format": "repository", "status": "research", "description": "Use ark-r1cs-std constraint gadgets for arithmetic and cryptographic operations inside Rust SNARK circuits.", "limitation": "The reviewed README labels this implementation an academic prototype not ready for production.", "sourceUrl": "https://github.com/arkworks-rs/r1cs-std", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "arkham", "name": "Arkham", "category": "explorers", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Investigate address activity and attributed entities using blockchain intelligence views.", "limitation": "Entity attribution is analytical evidence and should be corroborated before drawing conclusions.", "sourceUrl": "https://info.arkm.com/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "audit-builder", "name": "Audit Builder", "category": "workflow", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Explore DeFi Security Alliance's workflow for preparing, storing and compiling smart contract audit reports.", "limitation": "Confirm current product access and plan terms. Report generation does not validate the underlying findings.", "sourceUrl": "https://defisec.info/audit_builder", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "auditbase", "name": "AuditBase", "category": "ai-audit", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Use a hosted Solidity scanner to collect potential findings and structured risk-report outputs.", "limitation": "Review evidence behind each finding. Generated risk and compliance labels need separate validation.", "sourceUrl": "https://www.auditbase.com/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "bankrun", "name": "Bankrun", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "legacy", "description": "Run Node.js Solana tests using a program-test-based local execution environment.", "limitation": "Deprecated. The repository directs users to LiteSVM.", "sourceUrl": "https://github.com/kevinheavey/solana-bankrun", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "blockaid", "name": "Blockaid", "category": "wallet", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Integrate transaction, address and dapp threat screening into a wallet or application workflow.", "limitation": "Detection results depend on integration coverage and provider data. Review false positives and missed threats.", "sourceUrl": "https://blockaid.io/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "blockscout", "name": "Blockscout", "category": "explorers", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Explore EVM transactions, contract source and chain data with a deployable explorer platform.", "limitation": "Features and indexing completeness vary between hosted chain instances.", "sourceUrl": "https://docs.blockscout.com/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "blocksec-phalcon", "name": "BlockSec Phalcon", "category": "monitoring", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Configure detection, alerts and response workflows for suspicious on-chain protocol activity.", "limitation": "Response effectiveness depends on chain support, rule configuration, latency and granted permissions.", "sourceUrl": "https://blocksec.com/phalcon/security", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "breadcrumbs", "name": "Breadcrumbs", "category": "explorers", "ecosystems": [ "Multichain" ], "format": "service", "status": "page-only", "description": "Visualize and trace blockchain activity through an investigation-oriented analytics interface.", "limitation": "Trace availability and community labels do not prove who controls an address.", "sourceUrl": "https://www.breadcrumbs.app/", "checkedAt": "2026-09-05", "sourceKind": "provider-page", "keywords": [] }, { "id": "brownie", "name": "Brownie", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Build Python-based deployment scripts and tests for contracts targeting the EVM.", "limitation": "Pin compiler and dependency versions so another reviewer can reproduce results.", "sourceUrl": "https://github.com/eth-brownie/brownie", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "burp-suite", "name": "Burp Suite", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "developer-tool", "status": "documented", "description": "Analyze HTTP traffic and test dapp frontends, backend APIs and authentication flows.", "limitation": "Available automation depends on the edition and HTTP testing does not analyze on-chain execution.", "sourceUrl": "https://portswigger.net/burp/documentation", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "caracal", "name": "Caracal", "category": "cairo", "ecosystems": [ "Cairo" ], "format": "repository", "status": "documented", "description": "Run static detectors and inspection outputs for Starknet contracts represented in Cairo or Sierra tooling.", "limitation": "Use the release compatible with the project's Cairo representation and compiler artifacts.", "sourceUrl": "https://github.com/crytic/caracal", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Starknet", "Sierra" ] }, { "id": "cargo-audit", "name": "cargo-audit", "category": "supply-chain", "ecosystems": [ "Rust" ], "format": "repository", "status": "documented", "description": "Check Rust dependency lockfiles against RustSec advisories as part of a smart contract or infrastructure build.", "limitation": "Only known advisory coverage is checked. Application logic and unpublished vulnerabilities remain outside scope.", "sourceUrl": "https://github.com/rustsec/rustsec", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "cargo-deny", "name": "cargo-deny", "category": "supply-chain", "ecosystems": [ "Rust" ], "format": "repository", "status": "documented", "description": "Apply Rust dependency policies for advisories, licenses, duplicate versions and allowed sources.", "limitation": "Policy configuration determines what is rejected. Passing policy is not a code-security proof.", "sourceUrl": "https://github.com/EmbarkStudios/cargo-deny", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "cargo-fuzz", "name": "cargo-fuzz", "category": "supply-chain", "ecosystems": [ "Rust" ], "format": "repository", "status": "documented", "description": "Create and run fuzz targets for Rust code using the cargo fuzzing workflow.", "limitation": "A target must expose relevant inputs and assert meaningful behavior to detect a security flaw.", "sourceUrl": "https://github.com/rust-fuzz/cargo-fuzz", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "certora-prover", "name": "Certora Prover", "category": "formal", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Express contract rules in CVL and check them with the Certora verification service.", "limitation": "Specifications, summaries and environmental assumptions define what a successful proof establishes.", "sourceUrl": "https://docs.certora.com/en/latest/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "chaingpt-smart-contract-auditor", "name": "ChainGPT Smart Contract Auditor", "category": "ai-audit", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Generate AI-assisted smart contract review output through the ChainGPT auditor product.", "limitation": "Reproduce findings and inspect missed logic. Model-generated output is not proof of correctness.", "sourceUrl": "https://www.chaingpt.org/smart-contract-auditor", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "chainlink-automation", "name": "Chainlink Automation", "category": "operations", "ecosystems": [ "EVM" ], "format": "developer-tool", "status": "documented", "description": "Trigger contract maintenance or response functions when configured conditions are met.", "limitation": "Automation executes defined logic. A faulty condition or unsafe target can automate the wrong action.", "sourceUrl": "https://docs.chain.link/chainlink-automation", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "circom", "name": "Circom", "category": "zk", "ecosystems": [ "Circom" ], "format": "repository", "status": "documented", "description": "Compile arithmetic circuits into constraint systems and witness-generation programs for ZK review.", "limitation": "Witness generation success does not establish that every security-relevant relation is constrained.", "sourceUrl": "https://github.com/iden3/circom", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "ZK", "zero knowledge", "circuits", "R1CS" ] }, { "id": "circomspect", "name": "Circomspect", "category": "zk", "ecosystems": [ "Circom" ], "format": "repository", "status": "documented", "description": "Lint Circom circuits and inspect static-analysis warnings about potentially unsafe circuit constructions.", "limitation": "Static checks do not establish that the full circuit expresses the intended statement.", "sourceUrl": "https://github.com/trailofbits/circomspect", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "ZK", "zero knowledge", "circuits", "R1CS" ] }, { "id": "codeql", "name": "CodeQL", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "developer-tool", "status": "documented", "description": "Query supported source-code databases for vulnerability patterns in off-chain applications and infrastructure.", "limitation": "Language support is explicit. Do not assume that general CodeQL coverage includes Solidity contracts.", "sourceUrl": "https://codeql.github.com/docs/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "cosign", "name": "Cosign", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "repository", "status": "documented", "description": "Sign and verify container or binary artifacts using the Sigstore ecosystem.", "limitation": "A valid signature identifies an artifact and signing identity, not the correctness of its contents.", "sourceUrl": "https://github.com/sigstore/cosign", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "cosmwasm-vm", "name": "CosmWasm VM", "category": "cosmwasm", "ecosystems": [ "CosmWasm" ], "format": "developer-tool", "status": "documented", "description": "Execute CosmWasm contract bytecode through the virtual-machine library for controlled testing and integration.", "limitation": "VM execution requires a correctly modeled host environment and external dependencies.", "sourceUrl": "https://github.com/CosmWasm/cosmwasm/tree/main/packages/vm", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Cosmos", "Wasm", "Rust" ] }, { "id": "cosmwasm-check", "name": "cosmwasm-check", "category": "cosmwasm", "ecosystems": [ "CosmWasm" ], "format": "developer-tool", "status": "documented", "description": "Check a compiled CosmWasm artifact for compatibility constraints before deployment.", "limitation": "Artifact validation is a technical compatibility check, not a review of contract authorization or economics.", "sourceUrl": "https://github.com/CosmWasm/cosmwasm/tree/main/packages/check", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Cosmos", "Wasm", "Rust" ] }, { "id": "creusot", "name": "Creusot", "category": "formal", "ecosystems": [ "Rust" ], "format": "repository", "status": "documented", "description": "Write Rust specifications and discharge verification conditions through a deductive verification toolchain.", "limitation": "Unmodeled dependencies and incomplete proofs limit the guarantee for the full application.", "sourceUrl": "https://github.com/creusot-rs/creusot", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "crytic-compile", "name": "crytic-compile", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Normalize supported smart contract build systems for analysis tools that need consistent compiler artifacts.", "limitation": "An incorrect build selection can produce analysis of a different contract configuration.", "sourceUrl": "https://github.com/crytic/crytic-compile", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "crytic-properties", "name": "crytic/properties", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Reuse property templates for common Ethereum operations when designing a contract fuzzing harness.", "limitation": "Adapt properties to the token or protocol specification before interpreting failures.", "sourceUrl": "https://github.com/crytic/properties", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "cw-multi-test", "name": "cw-multi-test", "category": "cosmwasm", "ecosystems": [ "CosmWasm" ], "format": "repository", "status": "documented", "description": "Simulate interactions among CosmWasm contracts and modules in Rust integration tests.", "limitation": "Simulation does not reproduce every chain-specific module or production execution detail.", "sourceUrl": "https://github.com/CosmWasm/cw-multi-test", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Cosmos", "Wasm", "Rust" ] }, { "id": "decurity-semgrep-rules", "name": "Decurity Semgrep Rules", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Apply smart contract Semgrep rules informed by known DeFi exploit patterns to source-code review.", "limitation": "Rules cover defined patterns. Manually review matches and unsupported syntax.", "sourceUrl": "https://github.com/Decurity/semgrep-smart-contracts", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "dedaub-decompiler", "name": "Dedaub Decompiler", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Reconstruct readable contract logic from an EVM address or raw bytecode using a hosted decompiler.", "limitation": "The output is an approximation of source code and must be checked against bytecode and traces.", "sourceUrl": "https://docs.dedaub.com/docs/decompiler/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "defillama", "name": "DeFiLlama", "category": "explorers", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Compare DeFi protocol metrics and inspect publicly exposed information during security due diligence.", "limitation": "Financial metrics provide context and do not measure code security or investment safety.", "sourceUrl": "https://defillama.com/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "diligence-fuzzing", "name": "Diligence Fuzzing", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Use the Diligence Fuzzing client to prepare and submit contract fuzzing campaigns to its service.", "limitation": "A public client repository does not establish current hosted-service availability or plan access.", "sourceUrl": "https://github.com/ConsenSysDiligence/diligence-fuzzing", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "dune", "name": "Dune", "category": "explorers", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Query indexed blockchain data with SQL to investigate protocol usage and transaction patterns.", "limitation": "Dataset freshness, labels and query logic can affect the conclusion.", "sourceUrl": "https://docs.dune.com/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "echidna", "name": "Echidna", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Fuzz sequences of contract calls against developer-written Solidity invariants and retain failing examples.", "limitation": "Reachable states depend on the harness, caller setup, corpus and campaign budget.", "sourceUrl": "https://github.com/crytic/echidna", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "echidna-parade", "name": "Echidna Parade", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "legacy", "description": "Study a repository of Echidna fuzzing examples and campaign configurations.", "limitation": "The repository is archived. Examples need review against current tool versions.", "sourceUrl": "https://github.com/crytic/echidna-parade", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "ethereum-signature-database", "name": "Ethereum Signature Database", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Look up candidate function and event signatures from Ethereum selectors and hashes.", "limitation": "Selector collisions and untrusted submissions make a lookup result a hypothesis.", "sourceUrl": "https://www.4byte.directory/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "etherscan", "name": "Etherscan", "category": "explorers", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Inspect verified contract source, transactions, logs and API data for supported EVM networks.", "limitation": "Source verification establishes a build match. It is not a security audit or endorsement.", "sourceUrl": "https://docs.etherscan.io/introduction", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "ethersolve", "name": "EtherSolve", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Recover control-flow information from Ethereum bytecode for static-analysis research.", "limitation": "Recovered edges require scrutiny when jump destinations depend on runtime data.", "sourceUrl": "https://github.com/SeUniVr/EtherSolve", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "evm-diff", "name": "EVM Diff", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "research", "description": "Compare published execution-level specifications of EVM-compatible chains in a structured view.", "limitation": "The reviewed README describes early development and says the project should not yet be relied on.", "sourceUrl": "https://github.com/mds1/evm-diff", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "evm-codes", "name": "evm.codes", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Look up EVM opcodes, stack effects and gas-related reference information in an interactive interface.", "limitation": "Use the applicable fork rules. Gas and opcode behavior can vary with the EVM revision.", "sourceUrl": "https://www.evm.codes/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "evmole", "name": "EVMole", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Extract selectors, argument information, mutability and storage-layout clues from EVM bytecode.", "limitation": "Inferred interfaces need validation, especially around proxies and unusual dispatch code.", "sourceUrl": "https://github.com/cdump/evmole", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "forta", "name": "Forta", "category": "monitoring", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Consume or develop blockchain detection bots and alerts for monitoring suspicious activity.", "limitation": "Bot coverage and alert quality vary. Connect alerts to an owned response procedure.", "sourceUrl": "https://docs.forta.network/en/latest/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "foundry", "name": "Foundry", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Use Forge tests and invariants, Anvil forks and Cast inspection within an EVM development suite.", "limitation": "Fork tests inherit the selected block, RPC state and assumptions in the test harness.", "sourceUrl": "https://github.com/foundry-rs/foundry", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "fuzzutils", "name": "FuzzUtils", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Turn failing Echidna or Medusa property sequences into Foundry regression-test cases.", "limitation": "Validate the generated test against the original state, dependencies and failure conditions.", "sourceUrl": "https://github.com/crytic/fuzz-utils", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "gigahorse", "name": "Gigahorse", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Lift EVM bytecode into an analysis representation for decompilation and custom program analyses.", "limitation": "Analysis quality depends on correct lifting and handling of dynamic control flow.", "sourceUrl": "https://github.com/nevillegrech/gigahorse-toolchain", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "gitleaks", "name": "Gitleaks", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "repository", "status": "documented", "description": "Search repositories and files for patterns associated with accidentally committed secrets.", "limitation": "Review matches and rotate exposed credentials. Deleting a finding does not invalidate the secret.", "sourceUrl": "https://github.com/gitleaks/gitleaks", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "goplus-security", "name": "GoPlus Security", "category": "token", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Query token, address, approval and related security signals through the GoPlus API platform.", "limitation": "Field availability varies by endpoint and chain. Unknown results need explicit handling.", "sourceUrl": "https://docs.gopluslabs.io/docs/getting-started", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "greed", "name": "Greed", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Perform symbolic execution on EVM contract binaries through a research-oriented analysis engine.", "limitation": "Configure execution bounds and environment models before interpreting reachable paths.", "sourceUrl": "https://github.com/ucsb-seclab/greed", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "halmos", "name": "Halmos", "category": "symbolic", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Run Solidity properties as symbolic tests to search for counterexamples over symbolic inputs.", "limitation": "Loop bounds, external-call models and solver limits constrain conclusions.", "sourceUrl": "https://github.com/a16z/halmos", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "hardhat", "name": "Hardhat", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Compile, test, deploy and debug EVM contracts in a JavaScript and TypeScript development environment.", "limitation": "Testing validates the scenarios and assertions you write, not every possible execution.", "sourceUrl": "https://github.com/NomicFoundation/hardhat", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "hashex-abi-encoder", "name": "HashEx ABI Encoder", "category": "workflow", "ecosystems": [ "EVM" ], "format": "service", "status": "page-only", "description": "Encode Solidity function or constructor parameters into ABI-compatible calldata using a web interface.", "limitation": "Check types and parameter order. Encoding correctness does not establish transaction safety.", "sourceUrl": "https://abi.hashex.org/", "checkedAt": "2026-09-05", "sourceKind": "provider-page", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "hashex-fork-checker", "name": "HashEx Fork Checker", "category": "workflow", "ecosystems": [ "EVM" ], "format": "service", "status": "page-only", "description": "Compare forked smart contract code using HashEx's published fork-checking interface.", "limitation": "Code similarity does not establish equivalent permissions, deployment state or security.", "sourceUrl": "https://forkchecker.hashex.org/", "checkedAt": "2026-09-05", "sourceKind": "provider-page", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "heimdall-rs", "name": "Heimdall-rs", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Inspect unverified EVM contracts with a bytecode-analysis toolkit for reverse engineering.", "limitation": "Recovered structures are analytical guesses rather than authenticated original source.", "sourceUrl": "https://github.com/Jon-Becker/heimdall-rs", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "hevm", "name": "hevm", "category": "symbolic", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Execute EVM code concretely or symbolically to investigate contract behavior and properties.", "limitation": "Choose compatible EVM semantics and explicitly model the surrounding environment.", "sourceUrl": "https://github.com/argotorg/hevm", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "hexagate", "name": "Hexagate", "category": "monitoring", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Evaluate Chainalysis Hexagate for detecting on-chain threats and organizing protective responses.", "limitation": "Provider claims and alert coverage need validation against your protocol's threat model.", "sourceUrl": "https://www.chainalysis.com/product/hexagate/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "honeypot-is", "name": "Honeypot.is", "category": "token", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Simulate token trading and inspect honeypot-related checks through a token-analysis API.", "limitation": "Results depend on supported routes and current state. Sellability can change after the check.", "sourceUrl": "https://docs.honeypot.is/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "hypernative", "name": "Hypernative", "category": "monitoring", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Evaluate a hosted platform for blockchain threat detection, monitoring and automated response.", "limitation": "Confirm supported assets, integration requirements and response controls for your environment.", "sourceUrl": "https://www.hypernative.io/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "ityfuzz", "name": "ItyFuzz", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Explore smart contract bytecode with hybrid fuzzing to generate vulnerability candidates and execution traces.", "limitation": "Investigate findings and reproduce them in a controlled environment with the same state.", "sourceUrl": "https://github.com/fuzzland/ityfuzz", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "kani", "name": "Kani", "category": "formal", "ecosystems": [ "Rust" ], "format": "repository", "status": "documented", "description": "Check Rust properties with bounded model checking and obtain counterexamples for failing assertions.", "limitation": "Bounds and modeled Rust behavior limit coverage. Chain-specific account rules need separate properties.", "sourceUrl": "https://github.com/model-checking/kani", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "kevm", "name": "KEVM", "category": "formal", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Use the K specification of EVM execution to support semantics-based contract analysis and verification.", "limitation": "Requires familiarity with K and careful alignment with the relevant EVM revision.", "sourceUrl": "https://github.com/runtimeverification/evm-semantics", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "kontrol", "name": "Kontrol", "category": "symbolic", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Apply K-based reasoning to Foundry-style Solidity tests when a property needs symbolic verification.", "limitation": "Proof claims depend on harness assumptions, supported features and completed proof obligations.", "sourceUrl": "https://github.com/runtimeverification/kontrol", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "litesvm", "name": "LiteSVM", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Execute Solana program tests in a lightweight local SVM environment.", "limitation": "Local execution does not reproduce every validator, networking or live-state condition.", "sourceUrl": "https://github.com/LiteSVM/litesvm", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "manticore", "name": "Manticore", "category": "symbolic", "ecosystems": [ "EVM" ], "format": "repository", "status": "legacy", "description": "Script symbolic execution of smart contracts and binaries for research and legacy analysis.", "limitation": "The repository is archived and the owner no longer maintains the project.", "sourceUrl": "https://github.com/trailofbits/manticore", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "medusa", "name": "Medusa", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Run parallel coverage-guided Solidity fuzzing campaigns with configurable test properties and call sequences.", "limitation": "Coverage growth alone does not establish that the chosen invariants express the intended rules.", "sourceUrl": "https://github.com/crytic/medusa", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "misti", "name": "Misti", "category": "ton", "ecosystems": [ "TON" ], "format": "repository", "status": "documented", "description": "Run static analysis for TON contracts through the Misti analyzer and its supported language tooling.", "limitation": "Check language and compiler support. Asynchronous protocol behavior also needs execution tests.", "sourceUrl": "https://github.com/nowarp/misti", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Tact", "Tolk", "FunC", "TVM" ] }, { "id": "mollusk", "name": "Mollusk", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Run focused Solana instruction tests with explicit account inputs and expected output checks.", "limitation": "Compose additional scenarios for interactions across instructions and programs.", "sourceUrl": "https://github.com/anza-xyz/mollusk", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "move-prover", "name": "Move Prover", "category": "move", "ecosystems": [ "Move" ], "format": "developer-tool", "status": "research", "description": "Specify and verify Move module properties using the prover code within the Aptos repository.", "limitation": "The reviewed subtree retains an experimental-code notice. Aptos Move tooling does not automatically cover Sui execution semantics.", "sourceUrl": "https://github.com/aptos-labs/aptos-core/tree/main/third_party/move/move-prover", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Aptos", "capabilities" ] }, { "id": "mythril", "name": "Mythril", "category": "symbolic", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Explore EVM bytecode with symbolic execution to find potential contract vulnerabilities.", "limitation": "Path exploration and time bounds can leave relevant execution sequences unexplored.", "sourceUrl": "https://github.com/ConsenSysDiligence/mythril", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "noir", "name": "Noir", "category": "zk", "ecosystems": [ "Noir" ], "format": "repository", "status": "research", "description": "Write and compile zero-knowledge programs using a DSL and ACIR-compatible proving workflow.", "limitation": "The reviewed README describes early development and warns against production use of that implementation.", "sourceUrl": "https://github.com/noir-lang/noir", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "olympix", "name": "Olympix", "category": "ai-audit", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Integrate automated Solidity analysis and testing assistance into a development security workflow.", "limitation": "Evaluate actual findings on representative code before relying on provider performance claims.", "sourceUrl": "https://olympix.security/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "openssf-scorecard", "name": "OpenSSF Scorecard", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "repository", "status": "documented", "description": "Inspect repository security practices through automated supply-chain checks and supporting observations.", "limitation": "A repository score is a process signal and does not establish the absence of vulnerabilities.", "sourceUrl": "https://github.com/ossf/scorecard", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "openzeppelin-contracts", "name": "OpenZeppelin Contracts", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Build and review token, access-control, governance and utility contracts using a reusable Solidity library.", "limitation": "Custom extensions and configuration still need review, even when the underlying component is audited.", "sourceUrl": "https://github.com/OpenZeppelin/openzeppelin-contracts", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "openzeppelin-monitor", "name": "OpenZeppelin Monitor", "category": "monitoring", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Run configurable blockchain monitors that trigger notifications when selected on-chain conditions match.", "limitation": "A monitor needs suitable RPC access, tested rules and a maintained notification path.", "sourceUrl": "https://github.com/OpenZeppelin/openzeppelin-monitor", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "openzeppelin-relayer", "name": "OpenZeppelin Relayer", "category": "operations", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Operate a relayer service for controlled transaction submission and signing infrastructure.", "limitation": "Key storage, authorization, retries and operating procedures remain part of the security boundary.", "sourceUrl": "https://github.com/OpenZeppelin/openzeppelin-relayer", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "openzeppelin-upgrades", "name": "OpenZeppelin Upgrades", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Validate and manage upgradeable contracts with deployment plugins and storage-layout checks.", "limitation": "Storage compatibility checks do not prove an upgrade preserves application behavior.", "sourceUrl": "https://github.com/OpenZeppelin/openzeppelin-upgrades", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "openzeppelin-wizard", "name": "OpenZeppelin Wizard", "category": "testing", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Generate a starting contract from OpenZeppelin components and selected features.", "limitation": "Review generated permissions, upgrade choices and subsequent modifications before deployment.", "sourceUrl": "https://wizard.openzeppelin.com/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "osv-scanner", "name": "OSV-Scanner", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "repository", "status": "documented", "description": "Scan supported dependency manifests and lockfiles for vulnerabilities recorded in OSV.", "limitation": "Package matching and advisory freshness limit coverage of the dependency graph.", "sourceUrl": "https://github.com/google/osv-scanner", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "panoramix", "name": "Panoramix", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Decompile EVM bytecode into a readable representation for investigating contracts without published source.", "limitation": "Decompiler output can misrepresent complex control flow and compiler-specific patterns.", "sourceUrl": "https://github.com/palkeo/panoramix", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "phalcon-explorer", "name": "Phalcon Explorer", "category": "simulation", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Inspect decoded transaction flows, calls and asset movements while investigating EVM activity.", "limitation": "Decoded labels and traces need interpretation against the underlying transaction and contract state.", "sourceUrl": "https://blocksec.com/phalcon/explorer", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "phink", "name": "Phink", "category": "fuzzing", "ecosystems": [ "Substrate" ], "format": "repository", "status": "documented", "description": "Fuzz ink! smart contracts with an instrumentation and coverage-oriented workflow for Substrate projects.", "limitation": "Requires a supported contract build and meaningful entry-point and invariant configuration.", "sourceUrl": "https://github.com/srlabs/phink", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "picus", "name": "Picus", "category": "zk", "ecosystems": [ "Circom" ], "format": "repository", "status": "documented", "description": "Check uniqueness of circuit signals to investigate under-constrained Circom, R1CS and gnark circuits.", "limitation": "Uniqueness is one property. It does not prove all intended application constraints.", "sourceUrl": "https://github.com/Veridise/Picus", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "ZK", "zero knowledge", "circuits", "R1CS" ] }, { "id": "pocket-universe", "name": "Pocket Universe", "category": "wallet", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Preview wallet interactions through a browser extension that screens transactions for scam signals.", "limitation": "Check current chain and wallet support. Simulation cannot predict every future contract-state change.", "sourceUrl": "https://www.pocketuniverse.app/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "prusti", "name": "Prusti", "category": "formal", "ecosystems": [ "Rust" ], "format": "repository", "status": "research", "description": "Verify annotated Rust functions against contracts using the Viper verification infrastructure.", "limitation": "Prototype constraints and supported language features may exclude parts of a production project.", "sourceUrl": "https://github.com/viperproject/prusti-dev", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "pyevmasm", "name": "pyevmasm", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Assemble and disassemble EVM instructions when inspecting raw bytecode and instruction sequences.", "limitation": "Instruction decoding alone does not reveal contract intent or prove exploitability.", "sourceUrl": "https://github.com/crytic/pyevmasm", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "quick-intel", "name": "Quick Intel", "category": "token", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Inspect token contracts and associated risk signals using the Quick Intel analysis tools and APIs.", "limitation": "Confirm supported chains and the meaning of individual flags before using them as a decision rule.", "sourceUrl": "https://docs.quickintel.io/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "rabby-wallet", "name": "Rabby Wallet", "category": "wallet", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Review EVM transactions and interact with dapps through a wallet that presents pre-signing risk information.", "limitation": "Simulation and warnings cannot guarantee the safety of a transaction or protect a disclosed seed phrase.", "sourceUrl": "https://github.com/RabbyHub/Rabby", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "remix-ide", "name": "Remix IDE", "category": "testing", "ecosystems": [ "EVM" ], "format": "developer-tool", "status": "documented", "description": "Inspect, compile and test Solidity contracts in a browser-based development environment.", "limitation": "Use the intended compiler and execution environment when reproducing an audit finding.", "sourceUrl": "https://remix-ide.readthedocs.io/en/latest/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "revoke-cash", "name": "Revoke.cash", "category": "wallet", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Inspect token approvals and remove selected allowances on supported networks.", "limitation": "Revocation requires an on-chain transaction and does not recover assets already transferred.", "sourceUrl": "https://revoke.cash/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "rhinestone", "name": "Rhinestone", "category": "operations", "ecosystems": [ "EVM" ], "format": "developer-tool", "status": "documented", "description": "Build modular smart-account workflows and configure account capabilities with the Rhinestone stack.", "limitation": "Each module and permission expands the account's trust and authorization model.", "sourceUrl": "https://docs.rhinestone.dev/home/introduction/welcome-to-rhinestone", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "rugcheck", "name": "Rugcheck", "category": "token", "ecosystems": [ "Solana" ], "format": "service", "status": "page-only", "description": "Inspect Solana token signals such as holder concentration, liquidity and token metadata before interaction.", "limitation": "A token-risk report is a snapshot and cannot establish future liquidity or issuer behavior.", "sourceUrl": "https://rugcheck.xyz/", "checkedAt": "2026-09-05", "sourceKind": "provider-page", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "safe", "name": "Safe", "category": "operations", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Manage a smart-account treasury with multiple owners, signing thresholds and transaction-review features.", "limitation": "Owner independence, modules, signing interfaces and transaction review determine the operational protection.", "sourceUrl": "https://www.safe.global/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "safe-transaction-builder", "name": "Safe Transaction Builder", "category": "operations", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Prepare, review, export and batch contract calls for execution through a Safe account.", "limitation": "Review each target, value, operation and calldata item. Batching can conceal an unwanted permission change.", "sourceUrl": "https://help.safe.global/articles/4180673514-transaction-builder", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "scaffold-eth-2", "name": "Scaffold-ETH 2", "category": "workflow", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Build a local Ethereum application and test interface for contract experiments and reproducible demonstrations.", "limitation": "A development scaffold is supporting infrastructure. Production integrations need their own review.", "sourceUrl": "https://github.com/scaffold-eth/scaffold-eth-2", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "scarb", "name": "Scarb", "category": "cairo", "ecosystems": [ "Cairo" ], "format": "repository", "status": "documented", "description": "Manage Cairo dependencies and builds to make Starknet review artifacts reproducible.", "limitation": "Package resolution and successful compilation do not assess contract security.", "sourceUrl": "https://github.com/software-mansion/scarb", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Starknet", "Sierra" ] }, { "id": "scribble", "name": "Scribble", "category": "fuzzing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Instrument Solidity specifications as runtime checks that tests and fuzzing campaigns can exercise.", "limitation": "Annotations must encode the correct property. Instrumentation changes the analyzed build.", "sourceUrl": "https://github.com/ConsenSysDiligence/scribble", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "securify-2", "name": "Securify 2", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Analyze Solidity contracts against a collection of compliance and violation patterns using static analysis.", "limitation": "Check the repository's compiler requirements before using it on a modern codebase.", "sourceUrl": "https://github.com/eth-sri/securify2", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "semgrep", "name": "Semgrep", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "developer-tool", "status": "documented", "description": "Apply code-analysis rules across application code and integrate findings into a development workflow.", "limitation": "Language support, rules and analysis mode determine coverage. Contract-specific rules may need configuration.", "sourceUrl": "https://docs.semgrep.dev/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "sentio", "name": "Sentio", "category": "simulation", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Index blockchain events and build analytics to investigate application activity and transaction behavior.", "limitation": "An indexer's coverage and processor logic determine which events reach the analysis.", "sourceUrl": "https://docs.sentio.xyz/docs/readme", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "sherlock-ai", "name": "Sherlock Audit Engine", "category": "ai-audit", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Evaluate Sherlock Audit Engine, which combines AI analysis with security-researcher review in an engagement workflow.", "limitation": "This is a review service workflow. Confirm scope and researcher involvement for the specific engagement.", "sourceUrl": "https://sherlock.xyz/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "sierra-analyzer", "name": "Sierra Analyzer", "category": "cairo", "ecosystems": [ "Cairo" ], "format": "repository", "status": "legacy", "description": "Decompile Sierra files, inspect call graphs and run detectors or symbolic test generation.", "limitation": "The README states that the project is no longer maintained.", "sourceUrl": "https://github.com/FuzzingLabs/sierra-analyzer", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Starknet", "Sierra" ] }, { "id": "slither", "name": "Slither", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Run Solidity and Vyper detectors, inspect contract structure and build custom static analyses before manual review.", "limitation": "Requires a reproducible build. Detector findings need contextual triage.", "sourceUrl": "https://github.com/crytic/slither", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Vyper", "Solidity", "detectors", "reentrancy", "static analysis", "Ethereum", "Solidity" ] }, { "id": "slitherin", "name": "Slitherin", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Add Pessimistic's detector collection to Slither-based Solidity reviews.", "limitation": "Requires a compatible Slither environment and detector-specific triage.", "sourceUrl": "https://github.com/pessimistic-io/slitherin", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "smart-contract-sanctuary", "name": "Smart Contract Sanctuary", "category": "workflow", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Search a collected corpus of verified smart contract sources for implementation examples and comparison.", "limitation": "A collected source file is neither an audit endorsement nor a guarantee of current deployed behavior.", "sourceUrl": "https://github.com/tintinweb/smart-contract-sanctuary", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "smartcheck", "name": "SmartCheck", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "legacy", "description": "Inspect legacy Solidity code with pattern-based vulnerability and bug detection.", "limitation": "Deprecated since 2020. Its README warns about incorrect analysis from Solidity 0.6 onward.", "sourceUrl": "https://github.com/smartdec/smartcheck", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "snarkjs", "name": "snarkjs", "category": "zk", "ecosystems": [ "Circom" ], "format": "repository", "status": "documented", "description": "Inspect circuit artifacts, generate and verify proofs and work with supported setup-ceremony formats.", "limitation": "Proof verification checks the encoded circuit, which may omit the intended application constraint.", "sourceUrl": "https://github.com/iden3/snarkjs", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "ZK", "zero knowledge", "circuits", "R1CS" ] }, { "id": "sol2uml", "name": "sol2uml", "category": "workflow", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Generate Solidity class diagrams and storage visualizations to understand a contract system.", "limitation": "Diagrams can simplify relationships. Validate storage and inheritance details against compiler artifacts.", "sourceUrl": "https://github.com/naddison36/sol2uml", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solady", "name": "Solady", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Use optimized Solidity components as implementation references or dependencies in a contract project.", "limitation": "Low-level optimizations require careful review of assumptions and integration behavior.", "sourceUrl": "https://github.com/Vectorized/solady", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solana-explorer", "name": "Solana Explorer", "category": "explorers", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Inspect Solana clusters, transactions, accounts and programs using the ecosystem's explorer project.", "limitation": "A successful transaction or verified label is not evidence that a program is secure.", "sourceUrl": "https://github.com/solana-foundation/explorer", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "solana-playground", "name": "Solana Playground", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Develop, compile and test Solana programs through a browser-based workspace.", "limitation": "Reproduce critical findings in a pinned environment with controlled keys and dependencies.", "sourceUrl": "https://github.com/solana-playground/solana-playground", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "solana-security-txt", "name": "solana-security-txt", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Embed a machine-readable security contact and disclosure information in a Solana program.", "limitation": "Contact metadata helps reporting but does not validate the deployed program's logic.", "sourceUrl": "https://github.com/neodyme-labs/solana-security-txt", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "solana-verify", "name": "solana-verify", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Rebuild a Solana program deterministically and compare its binary with an on-chain program or buffer.", "limitation": "A matching binary establishes source correspondence, not the absence of vulnerabilities.", "sourceUrl": "https://github.com/solana-foundation/solana-verifiable-build", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "solang", "name": "Solang", "category": "static", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Compile Solidity for supported alternative targets, including Solana, and inspect target-specific diagnostics.", "limitation": "Solidity syntax compatibility does not imply Ethereum execution semantics on another target.", "sourceUrl": "https://github.com/hyperledger-solang/solang", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "solc-select", "name": "solc-select", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Install and switch Solidity compiler versions when reproducing a specific contract build.", "limitation": "Match the full build settings as well as the compiler version.", "sourceUrl": "https://github.com/crytic/solc-select", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solfuzz-agave", "name": "solfuzz-agave", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Use an Agave execution target in Solana runtime differential fuzzing research.", "limitation": "This is runtime test infrastructure, not a turnkey detector for application-level program bugs.", "sourceUrl": "https://github.com/firedancer-io/solfuzz-agave", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "solgrep", "name": "solgrep", "category": "workflow", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Search Solidity syntax structures to locate relevant declarations and patterns across a review scope.", "limitation": "Structural matches are navigation aids and need manual analysis of their context.", "sourceUrl": "https://github.com/tintinweb/solgrep", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solhint", "name": "Solhint", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Enforce Solidity style, naming and selected security rules in editor and CI workflows.", "limitation": "A clean lint result does not establish correctness of protocol logic.", "sourceUrl": "https://github.com/protofire/solhint", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solidity-metrics", "name": "Solidity Metrics", "category": "workflow", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Measure Solidity code structure and produce scope information for audit preparation.", "limitation": "Line counts and complexity indicators help scope work but do not measure security quality.", "sourceUrl": "https://github.com/ConsenSysDiligence/solidity-metrics", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solidity-smtchecker", "name": "Solidity SMTChecker", "category": "formal", "ecosystems": [ "EVM" ], "format": "developer-tool", "status": "documented", "description": "Use Solidity's built-in model checker to evaluate assertions and selected safety properties at compilation.", "limitation": "Review unsupported features and solver results. An inconclusive result is not a proof.", "sourceUrl": "https://docs.soliditylang.org/en/latest/smtchecker.html", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solidity-visual-developer", "name": "Solidity Visual Developer", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Use editor annotations, contract navigation, graphs and inline review helpers while reading Solidity.", "limitation": "Visual cues assist the reviewer. They do not independently validate security properties.", "sourceUrl": "https://github.com/ConsenSysDiligence/vscode-solidity-auditor", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solidity-coverage", "name": "solidity-coverage", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Measure which Solidity statements and branches a test suite exercises.", "limitation": "High coverage can coexist with missing assertions and untested economic failure modes.", "sourceUrl": "https://github.com/sc-forks/solidity-coverage", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solidityscan", "name": "SolidityScan", "category": "ai-audit", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Submit Solidity projects or deployed contracts to a hosted scanner and review vulnerability reports.", "limitation": "An automated report and score require independent triage and do not constitute a complete manual audit.", "sourceUrl": "https://docs.solidityscan.com/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solmate", "name": "Solmate", "category": "testing", "ecosystems": [ "EVM" ], "format": "repository", "status": "legacy", "description": "Study compact Solidity building blocks for tokens, authorization and related contract patterns.", "limitation": "Review the project's maintenance notice and individual component assumptions before adoption.", "sourceUrl": "https://github.com/transmissions11/solmate", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "solodit", "name": "Solodit", "category": "workflow", "ecosystems": [ "Multichain" ], "format": "service", "status": "documented", "description": "Search published smart contract findings and mitigations to identify relevant bug patterns during review.", "limitation": "A historical finding is context. Confirm whether its assumptions apply to the target code.", "sourceUrl": "https://solodit.cyfrin.io/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "solscan", "name": "Solscan", "category": "explorers", "ecosystems": [ "Solana" ], "format": "service", "status": "documented", "description": "Inspect Solana transactions, program interactions, accounts and token details in an explorer.", "limitation": "Explorer labels and parsed views should be checked against raw account and transaction data.", "sourceUrl": "https://solscan.io/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "sourcify", "name": "Sourcify", "category": "explorers", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Verify and retrieve contract source by matching compiler artifacts to deployed EVM bytecode.", "limitation": "A source match does not validate contract permissions, business logic or upgrade governance.", "sourceUrl": "https://docs.sourcify.dev/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "openchain-signature-database", "name": "Sourcify Signature Database (OpenChain)", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "service", "status": "page-only", "description": "Look up function and event signatures through the OpenChain destination now served by Sourcify.", "limitation": "A matching hash does not authenticate an ABI or establish a contract's implementation.", "sourceUrl": "https://4byte.sourcify.dev/signatures/index.html", "checkedAt": "2026-09-05", "sourceKind": "provider-page", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "starknet-foundry", "name": "Starknet Foundry", "category": "cairo", "ecosystems": [ "Cairo" ], "format": "repository", "status": "documented", "description": "Test, fuzz and interact with Starknet contracts using the snforge and sncast tool suite.", "limitation": "Match Cairo and network versions and test account-contract interactions explicitly.", "sourceUrl": "https://github.com/foundry-rs/starknet-foundry", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Starknet", "Sierra" ] }, { "id": "sui-cli", "name": "Sui CLI", "category": "move", "ecosystems": [ "Move" ], "format": "developer-tool", "status": "documented", "description": "Compile and test Move packages and inspect Sui objects and transactions with official command-line tools.", "limitation": "Add adversarial object-ownership and capability scenarios beyond the standard unit tests.", "sourceUrl": "https://docs.sui.io/references/cli", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Sui", "capabilities" ] }, { "id": "surya", "name": "Surya", "category": "workflow", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Generate Solidity contract graphs, inheritance views and inspection reports while mapping a codebase.", "limitation": "Graph output needs manual interpretation and may not represent every dynamic interaction.", "sourceUrl": "https://github.com/ConsenSysDiligence/surya", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "syft", "name": "Syft", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "repository", "status": "documented", "description": "Generate a software bill of materials for container images and filesystems used in a deployment.", "limitation": "An SBOM is an inventory. Pair it with advisory analysis and artifact-integrity checks.", "sourceUrl": "https://github.com/anchore/syft", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "tact", "name": "Tact", "category": "ton", "ecosystems": [ "TON" ], "format": "repository", "status": "legacy", "description": "Compile and inspect Tact contracts when maintaining or auditing existing TON applications.", "limitation": "The reviewed README marks Tact deprecated and directs new language users to Tolk.", "sourceUrl": "https://github.com/tact-lang/tact", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Tact", "Tolk", "FunC", "TVM" ] }, { "id": "tenderly", "name": "Tenderly", "category": "simulation", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Simulate transactions and inspect execution traces or state changes before an on-chain operation.", "limitation": "Results depend on the chosen block, transaction inputs and simulation environment.", "sourceUrl": "https://docs.tenderly.co/introduction", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "thoth", "name": "Thoth", "category": "cairo", "ecosystems": [ "Cairo" ], "format": "repository", "status": "legacy", "description": "Inspect Cairo and Starknet artifacts with disassembly, graphs and symbolic-analysis research tools.", "limitation": "The repository is archived and states it is no longer maintained.", "sourceUrl": "https://github.com/FuzzingLabs/thoth", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Starknet", "Sierra" ] }, { "id": "tokensniffer", "name": "TokenSniffer", "category": "token", "ecosystems": [ "EVM" ], "format": "service", "status": "documented", "description": "Inspect automated token scam flags, similarity information and optional holder or liquidity metrics.", "limitation": "A score summarizes selected signals. It does not guarantee that a token will remain safe to trade.", "sourceUrl": "https://tokensniffer.readme.io/reference/introduction", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "tolk", "name": "Tolk", "category": "ton", "ecosystems": [ "TON" ], "format": "developer-tool", "status": "documented", "description": "Compile Tolk smart contracts for TON and inspect build output during code review.", "limitation": "Language tooling does not prove that asynchronous message and authorization logic is correct.", "sourceUrl": "https://docs.ton.org/tolk/overview", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Tact", "Tolk", "FunC", "TVM" ] }, { "id": "ton-blueprint", "name": "TON Blueprint", "category": "ton", "ecosystems": [ "TON" ], "format": "repository", "status": "legacy", "description": "Build and test TON contracts using the Blueprint development workflow found in existing projects.", "limitation": "The reviewed README marks Blueprint deprecated and points users to Acton.", "sourceUrl": "https://github.com/ton-org/blueprint", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Tact", "Tolk", "FunC", "TVM" ] }, { "id": "ton-contract-executor", "name": "TON Contract Executor", "category": "ton", "ecosystems": [ "TON" ], "format": "repository", "status": "legacy", "description": "Execute TON contract code locally for investigating contract behavior in a test environment.", "limitation": "The repository is archived. Verify compatibility before reproducing historical tests.", "sourceUrl": "https://github.com/ton-community/ton-contract-executor", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Tact", "Tolk", "FunC", "TVM" ] }, { "id": "ton-sandbox", "name": "TON Sandbox", "category": "ton", "ecosystems": [ "TON" ], "format": "repository", "status": "documented", "description": "Execute TON contracts in a local sandbox for message-flow and state-transition tests.", "limitation": "Add asynchronous message ordering, bounce and failure scenarios beyond successful transfers.", "sourceUrl": "https://github.com/ton-blockchain/sandbox", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Tact", "Tolk", "FunC", "TVM" ] }, { "id": "trident", "name": "Trident", "category": "solana", "ecosystems": [ "Solana" ], "format": "repository", "status": "documented", "description": "Write Rust-based fuzzing campaigns that exercise Solana program instructions and account interactions.", "limitation": "Meaningful account-state generation and invariants are required to find authorization bugs.", "sourceUrl": "https://github.com/Ackee-Blockchain/trident", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "SVM", "Rust", "accounts" ] }, { "id": "trivy", "name": "Trivy", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "repository", "status": "documented", "description": "Scan containers, repositories and infrastructure configuration for dependency and deployment risks.", "limitation": "Findings depend on supported scanners and databases, with contract economics outside scope.", "sourceUrl": "https://github.com/aquasecurity/trivy", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "trufflehog", "name": "TruffleHog", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "repository", "status": "documented", "description": "Find potential leaked credentials in supported data sources and verify supported credential types.", "limitation": "Live verification can contact providers. Use authorized sources and handle findings as sensitive data.", "sourceUrl": "https://github.com/trufflesecurity/trufflehog", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "vandal", "name": "Vandal", "category": "bytecode", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Disassemble and analyze EVM bytecode with a static-analysis framework and intermediate representation.", "limitation": "Check opcode and compiler compatibility for current deployments before using results.", "sourceUrl": "https://github.com/usyd-blockchain/vandal", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "verisol", "name": "VeriSol", "category": "formal", "ecosystems": [ "EVM" ], "format": "repository", "status": "legacy", "description": "Translate Solidity verification problems into a formal-analysis workflow for studying contract properties.", "limitation": "The repository is archived. Retain it for compatible historical and research cases.", "sourceUrl": "https://github.com/microsoft/VeriSol", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "verus", "name": "Verus", "category": "formal", "ecosystems": [ "Rust" ], "format": "repository", "status": "documented", "description": "Annotate Rust programs with specifications and prove properties using deductive verification.", "limitation": "Proof annotations and supported Rust features require engineering effort.", "sourceUrl": "https://github.com/verus-lang/verus", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "vyper", "name": "Vyper", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Compile Vyper contracts and inspect compiler output as part of a reproducible contract review.", "limitation": "A successful compilation does not verify the application's economic assumptions.", "sourceUrl": "https://github.com/vyperlang/vyper", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "wake", "name": "Wake", "category": "static", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Combine Solidity vulnerability detectors with Python-based testing and fuzzing in one development framework.", "limitation": "The build configuration and test harness determine which behavior is exercised.", "sourceUrl": "https://github.com/Ackee-Blockchain/wake", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "whatsabi", "name": "WhatsABI", "category": "explorers", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Infer an ABI, resolve supported proxy patterns and collect metadata from Ethereum bytecode.", "limitation": "Inferred types and proxy resolution can be incomplete for custom dispatch patterns.", "sourceUrl": "https://github.com/shazow/whatsabi", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] }, { "id": "zap", "name": "ZAP", "category": "supply-chain", "ecosystems": [ "Multichain" ], "format": "developer-tool", "status": "documented", "description": "Inspect and test the web application and API surfaces around a protocol using a web-security scanner.", "limitation": "Web scanning covers the interface layer. Smart contract logic requires separate analysis.", "sourceUrl": "https://www.zaproxy.org/docs/", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [] }, { "id": "zodiac", "name": "Zodiac", "category": "operations", "ecosystems": [ "EVM" ], "format": "repository", "status": "documented", "description": "Compose DAO and smart-account controls using modular governance and execution tooling.", "limitation": "Module permissions and interaction paths need review as a complete authorization system.", "sourceUrl": "https://github.com/gnosisguild/zodiac", "checkedAt": "2026-09-05", "sourceKind": "documentation", "keywords": [ "Ethereum", "Solidity" ] } ] }