Request an auditDeFi Security Alliance · Tool directory
Find tools for code review, fuzzing, formal verification, transaction analysis, wallet protection and security operations. Compare what each tool does, where it fits and what its results cannot establish.
Search the directory
Browse 24 entries at a time, ordered by primary task and name. Search and filters cover all 156 tools. Confirm exact chain and version support at the source.
No tools match these filters. Try a broader term or reset the filters.
Generate a first-pass Solidity findings report for recurring code patterns during audit preparation.
Documentation reviewed
Inspect Solidity source with a Rust-based static analyzer and review findings in the command line or editor.
Documentation reviewed
Apply smart contract Semgrep rules informed by known DeFi exploit patterns to source-code review.
Documentation reviewed
Analyze Solidity contracts against a collection of compliance and violation patterns using static analysis.
Documentation reviewed
Run Solidity and Vyper detectors, inspect contract structure and build custom static analyses before manual review.
Documentation reviewed
Add Pessimistic's detector collection to Slither-based Solidity reviews.
Documentation reviewed
Inspect legacy Solidity code with pattern-based vulnerability and bug detection.
Legacy / unmaintained
Compile Solidity for supported alternative targets, including Solana, and inspect target-specific diagnostics.
Documentation reviewed
Enforce Solidity style, naming and selected security rules in editor and CI workflows.
Documentation reviewed
Use editor annotations, contract navigation, graphs and inline review helpers while reading Solidity.
Documentation reviewed
Compile Vyper contracts and inspect compiler output as part of a reproducible contract review.
Documentation reviewed
Combine Solidity vulnerability detectors with Python-based testing and fuzzing in one development framework.
Documentation reviewed
Reuse property templates for common Ethereum operations when designing a contract fuzzing harness.
Documentation reviewed
Use the Diligence Fuzzing client to prepare and submit contract fuzzing campaigns to its service.
Documentation reviewed
Fuzz sequences of contract calls against developer-written Solidity invariants and retain failing examples.
Documentation reviewed
Study a repository of Echidna fuzzing examples and campaign configurations.
Legacy / unmaintained
Use Forge tests and invariants, Anvil forks and Cast inspection within an EVM development suite.
Documentation reviewed
Turn failing Echidna or Medusa property sequences into Foundry regression-test cases.
Documentation reviewed
Explore smart contract bytecode with hybrid fuzzing to generate vulnerability candidates and execution traces.
Documentation reviewed
Run parallel coverage-guided Solidity fuzzing campaigns with configurable test properties and call sequences.
Documentation reviewed
Fuzz ink! smart contracts with an instrumentation and coverage-oriented workflow for Substrate projects.
Documentation reviewed
Instrument Solidity specifications as runtime checks that tests and fuzzing campaigns can exercise.
Documentation reviewed
Run Solidity properties as symbolic tests to search for counterexamples over symbolic inputs.
Documentation reviewed
Execute EVM code concretely or symbolically to investigate contract behavior and properties.
Documentation reviewed
Apply K-based reasoning to Foundry-style Solidity tests when a property needs symbolic verification.
Documentation reviewed
Script symbolic execution of smart contracts and binaries for research and legacy analysis.
Legacy / unmaintained
Explore EVM bytecode with symbolic execution to find potential contract vulnerabilities.
Documentation reviewed
Write declarative specifications of contract behavior and use them in verification workflows.
Documentation reviewed
Express contract rules in CVL and check them with the Certora verification service.
Documentation reviewed
Write Rust specifications and discharge verification conditions through a deductive verification toolchain.
Documentation reviewed
Check Rust properties with bounded model checking and obtain counterexamples for failing assertions.
Documentation reviewed
Use the K specification of EVM execution to support semantics-based contract analysis and verification.
Documentation reviewed
Verify annotated Rust functions against contracts using the Viper verification infrastructure.
Research / prototype notice
Use Solidity's built-in model checker to evaluate assertions and selected safety properties at compilation.
Documentation reviewed
Translate Solidity verification problems into a formal-analysis workflow for studying contract properties.
Legacy / unmaintained
Annotate Rust programs with specifications and prove properties using deductive verification.
Documentation reviewed
Use Python accounts, providers, compiler plugins and tests to investigate on-chain applications.
Documentation reviewed
Build Python-based deployment scripts and tests for contracts targeting the EVM.
Documentation reviewed
Normalize supported smart contract build systems for analysis tools that need consistent compiler artifacts.
Documentation reviewed
Compare published execution-level specifications of EVM-compatible chains in a structured view.
Research / prototype notice
Compile, test, deploy and debug EVM contracts in a JavaScript and TypeScript development environment.
Documentation reviewed
Build and review token, access-control, governance and utility contracts using a reusable Solidity library.
Documentation reviewed
Validate and manage upgradeable contracts with deployment plugins and storage-layout checks.
Documentation reviewed
Generate a starting contract from OpenZeppelin components and selected features.
Documentation reviewed
Inspect, compile and test Solidity contracts in a browser-based development environment.
Documentation reviewed
Use optimized Solidity components as implementation references or dependencies in a contract project.
Documentation reviewed
Install and switch Solidity compiler versions when reproducing a specific contract build.
Documentation reviewed
Measure which Solidity statements and branches a test suite exercises.
Documentation reviewed
Study compact Solidity building blocks for tokens, authorization and related contract patterns.
Legacy / unmaintained
Build and test Solana programs with account constraints, interfaces and framework tooling.
Documentation reviewed
Run Node.js Solana tests using a program-test-based local execution environment.
Legacy / unmaintained
Execute Solana program tests in a lightweight local SVM environment.
Documentation reviewed
Run focused Solana instruction tests with explicit account inputs and expected output checks.
Documentation reviewed
Develop, compile and test Solana programs through a browser-based workspace.
Documentation reviewed
Embed a machine-readable security contact and disclosure information in a Solana program.
Documentation reviewed
Rebuild a Solana program deterministically and compare its binary with an on-chain program or buffer.
Documentation reviewed
Use an Agave execution target in Solana runtime differential fuzzing research.
Documentation reviewed
Write Rust-based fuzzing campaigns that exercise Solana program instructions and account interactions.
Documentation reviewed
Compile, test and interact with Aptos Move packages through the official command-line interface.
Documentation reviewed
Specify and verify Move module properties using the prover code within the Aptos repository.
Research / prototype notice
Compile and test Move packages and inspect Sui objects and transactions with official command-line tools.
Documentation reviewed
Run static detectors and inspection outputs for Starknet contracts represented in Cairo or Sierra tooling.
Documentation reviewed
Manage Cairo dependencies and builds to make Starknet review artifacts reproducible.
Documentation reviewed
Decompile Sierra files, inspect call graphs and run detectors or symbolic test generation.
Legacy / unmaintained
Test, fuzz and interact with Starknet contracts using the snforge and sncast tool suite.
Documentation reviewed
Inspect Cairo and Starknet artifacts with disassembly, graphs and symbolic-analysis research tools.
Legacy / unmaintained
Use TON's Acton development toolchain for building and testing smart contract projects.
Documentation reviewed
Run static analysis for TON contracts through the Misti analyzer and its supported language tooling.
Documentation reviewed
Compile and inspect Tact contracts when maintaining or auditing existing TON applications.
Legacy / unmaintained
Compile Tolk smart contracts for TON and inspect build output during code review.
Documentation reviewed
Build and test TON contracts using the Blueprint development workflow found in existing projects.
Legacy / unmaintained
Execute TON contract code locally for investigating contract behavior in a test environment.
Legacy / unmaintained
Execute TON contracts in a local sandbox for message-flow and state-transition tests.
Documentation reviewed
Execute CosmWasm contract bytecode through the virtual-machine library for controlled testing and integration.
Documentation reviewed
Check a compiled CosmWasm artifact for compatibility constraints before deployment.
Documentation reviewed
Simulate interactions among CosmWasm contracts and modules in Rust integration tests.
Documentation reviewed
Use ark-r1cs-std constraint gadgets for arithmetic and cryptographic operations inside Rust SNARK circuits.
Research / prototype notice
Compile arithmetic circuits into constraint systems and witness-generation programs for ZK review.
Documentation reviewed
Lint Circom circuits and inspect static-analysis warnings about potentially unsafe circuit constructions.
Documentation reviewed
Write and compile zero-knowledge programs using a DSL and ACIR-compatible proving workflow.
Research / prototype notice
Check uniqueness of circuit signals to investigate under-constrained Circom, R1CS and gnark circuits.
Documentation reviewed
Inspect circuit artifacts, generate and verify proofs and work with supported setup-ceremony formats.
Documentation reviewed
Inspect decoded transaction flows, calls and asset movements while investigating EVM activity.
Documentation reviewed
Index blockchain events and build analytics to investigate application activity and transaction behavior.
Documentation reviewed
Simulate transactions and inspect execution traces or state changes before an on-chain operation.
Documentation reviewed
Reconstruct readable contract logic from an EVM address or raw bytecode using a hosted decompiler.
Documentation reviewed
Look up candidate function and event signatures from Ethereum selectors and hashes.
Documentation reviewed
Recover control-flow information from Ethereum bytecode for static-analysis research.
Documentation reviewed
Look up EVM opcodes, stack effects and gas-related reference information in an interactive interface.
Documentation reviewed
Extract selectors, argument information, mutability and storage-layout clues from EVM bytecode.
Documentation reviewed
Lift EVM bytecode into an analysis representation for decompilation and custom program analyses.
Documentation reviewed
Perform symbolic execution on EVM contract binaries through a research-oriented analysis engine.
Documentation reviewed
Inspect unverified EVM contracts with a bytecode-analysis toolkit for reverse engineering.
Documentation reviewed
Decompile EVM bytecode into a readable representation for investigating contracts without published source.
Documentation reviewed
Assemble and disassemble EVM instructions when inspecting raw bytecode and instruction sequences.
Documentation reviewed
Look up function and event signatures through the OpenChain destination now served by Sourcify.
Provider page only
Disassemble and analyze EVM bytecode with a static-analysis framework and intermediate representation.
Documentation reviewed
Investigate address activity and attributed entities using blockchain intelligence views.
Documentation reviewed
Explore EVM transactions, contract source and chain data with a deployable explorer platform.
Documentation reviewed
Visualize and trace blockchain activity through an investigation-oriented analytics interface.
Provider page only
Compare DeFi protocol metrics and inspect publicly exposed information during security due diligence.
Documentation reviewed
Query indexed blockchain data with SQL to investigate protocol usage and transaction patterns.
Documentation reviewed
Inspect verified contract source, transactions, logs and API data for supported EVM networks.
Documentation reviewed
Inspect Solana clusters, transactions, accounts and programs using the ecosystem's explorer project.
Documentation reviewed
Inspect Solana transactions, program interactions, accounts and token details in an explorer.
Documentation reviewed
Verify and retrieve contract source by matching compiler artifacts to deployed EVM bytecode.
Documentation reviewed
Infer an ABI, resolve supported proxy patterns and collect metadata from Ethereum bytecode.
Documentation reviewed
Configure detection, alerts and response workflows for suspicious on-chain protocol activity.
Documentation reviewed
Consume or develop blockchain detection bots and alerts for monitoring suspicious activity.
Documentation reviewed
Evaluate Chainalysis Hexagate for detecting on-chain threats and organizing protective responses.
Documentation reviewed
Evaluate a hosted platform for blockchain threat detection, monitoring and automated response.
Documentation reviewed
Run configurable blockchain monitors that trigger notifications when selected on-chain conditions match.
Documentation reviewed
Trigger contract maintenance or response functions when configured conditions are met.
Documentation reviewed
Operate a relayer service for controlled transaction submission and signing infrastructure.
Documentation reviewed
Build modular smart-account workflows and configure account capabilities with the Rhinestone stack.
Documentation reviewed
Manage a smart-account treasury with multiple owners, signing thresholds and transaction-review features.
Documentation reviewed
Prepare, review, export and batch contract calls for execution through a Safe account.
Documentation reviewed
Compose DAO and smart-account controls using modular governance and execution tooling.
Documentation reviewed
Integrate transaction, address and dapp threat screening into a wallet or application workflow.
Documentation reviewed
Preview wallet interactions through a browser extension that screens transactions for scam signals.
Documentation reviewed
Review EVM transactions and interact with dapps through a wallet that presents pre-signing risk information.
Documentation reviewed
Inspect token approvals and remove selected allowances on supported networks.
Documentation reviewed
Query token, address, approval and related security signals through the GoPlus API platform.
Documentation reviewed
Simulate token trading and inspect honeypot-related checks through a token-analysis API.
Documentation reviewed
Inspect token contracts and associated risk signals using the Quick Intel analysis tools and APIs.
Documentation reviewed
Inspect Solana token signals such as holder concentration, liquidity and token metadata before interaction.
Provider page only
Inspect automated token scam flags, similarity information and optional holder or liquidity metrics.
Documentation reviewed
Use a hosted Solidity scanner to collect potential findings and structured risk-report outputs.
Documentation reviewed
Generate AI-assisted smart contract review output through the ChainGPT auditor product.
Documentation reviewed
Integrate automated Solidity analysis and testing assistance into a development security workflow.
Documentation reviewed
Evaluate Sherlock Audit Engine, which combines AI analysis with security-researcher review in an engagement workflow.
Documentation reviewed
Submit Solidity projects or deployed contracts to a hosted scanner and review vulnerability reports.
Documentation reviewed
Explore DeFi Security Alliance's workflow for preparing, storing and compiling smart contract audit reports.
Documentation reviewed
Encode Solidity function or constructor parameters into ABI-compatible calldata using a web interface.
Provider page only
Compare forked smart contract code using HashEx's published fork-checking interface.
Provider page only
Build a local Ethereum application and test interface for contract experiments and reproducible demonstrations.
Documentation reviewed
Search a collected corpus of verified smart contract sources for implementation examples and comparison.
Documentation reviewed
Generate Solidity class diagrams and storage visualizations to understand a contract system.
Documentation reviewed
Search Solidity syntax structures to locate relevant declarations and patterns across a review scope.
Documentation reviewed
Measure Solidity code structure and produce scope information for audit preparation.
Documentation reviewed
Search published smart contract findings and mitigations to identify relevant bug patterns during review.
Documentation reviewed
Generate Solidity contract graphs, inheritance views and inspection reports while mapping a codebase.
Documentation reviewed
Analyze HTTP traffic and test dapp frontends, backend APIs and authentication flows.
Documentation reviewed
Check Rust dependency lockfiles against RustSec advisories as part of a smart contract or infrastructure build.
Documentation reviewed
Apply Rust dependency policies for advisories, licenses, duplicate versions and allowed sources.
Documentation reviewed
Create and run fuzz targets for Rust code using the cargo fuzzing workflow.
Documentation reviewed
Query supported source-code databases for vulnerability patterns in off-chain applications and infrastructure.
Documentation reviewed
Sign and verify container or binary artifacts using the Sigstore ecosystem.
Documentation reviewed
Search repositories and files for patterns associated with accidentally committed secrets.
Documentation reviewed
Inspect repository security practices through automated supply-chain checks and supporting observations.
Documentation reviewed
Scan supported dependency manifests and lockfiles for vulnerabilities recorded in OSV.
Documentation reviewed
Apply code-analysis rules across application code and integrate findings into a development workflow.
Documentation reviewed
Generate a software bill of materials for container images and filesystems used in a deployment.
Documentation reviewed
Scan containers, repositories and infrastructure configuration for dependency and deployment risks.
Documentation reviewed
Find potential leaked credentials in supported data sources and verify supported credential types.
Documentation reviewed
Inspect and test the web application and API surfaces around a protocol using a web-security scanner.
Documentation reviewed
From question to evidence
These combinations are editorial starting points. Select the tools that match your artifact and threat model, then record enough context for another reviewer to reproduce the result.
Compare by the question answered
| Comparison | What differs | Selection criterion |
|---|---|---|
| Slither vs Mythril | Slither analyzes source and compiler structures with detectors and inspection outputs. Mythril explores EVM bytecode symbolically to seek vulnerability candidates. | Use source analysis for broad triage. Use symbolic exploration for additional execution evidence. Compare reproducible findings, not raw warning counts. |
| Foundry vs Echidna vs Medusa | Foundry combines development tests, invariant campaigns and fork-based workflows. Echidna and Medusa focus on property-driven fuzzing campaigns and transaction sequences. | Run the same meaningful property and reachable-state setup before comparing campaign results. Preserve seeds, corpus, duration and tool versions. |
| Halmos vs Certora vs Kontrol | Halmos and Kontrol bring symbolic reasoning to Solidity-test-oriented workflows. Certora uses CVL specifications and a verification service. | Choose based on the property, specification language, environment modeling and whether the proof completes within your resource budget. |
| Source verification vs security verification | Sourcify and solana-verify compare a build with a deployed artifact. Formal tools reason about specified properties. Tests exercise selected behaviors. | Record these as separate evidence fields. A matching source build says nothing by itself about access control or economic safety. |
| Token scanner vs approval checker | Token scanners report selected contract, trading, holder and liquidity signals. Approval checkers inspect permissions already granted by a wallet. | Use both for their respective questions. Revoking an allowance does not change a token contract or recover stolen assets. |
| Transaction simulator vs live monitor | A simulator evaluates a proposed transaction against a chosen state. A monitor evaluates observed activity or state against configured detection rules. | Preserve the simulation inputs, then define the conditions that should trigger alerts after deployment. Neither replaces an incident owner. |
Evidence & review scope
DeFiSec reviewed 172 candidate tools and retained 156 entries across 21 categories. The September 5, 2026 source review excluded 16 candidates because of duplicate destinations or insufficient current product evidence. It retained 11 entries with legacy or maintenance notices, 5 with research or prototype notices and five supported only by provider-page evidence.
Tools were not installed or benchmarked. Paid plans and transaction execution were not tested. Entries are not ranked by quality; inclusion is not an audit endorsement. Audit Builder is a DeFi Security Alliance product and is identified in its description.
For the wider review process, consult Ethereum's contract-testing guide, Trail of Bits' secure-contract guidanceand the OWASP Smart Contract Security Verification Standard. Product-specific evidence is linked from every card.
Practical questions
Start with the artifact and question you have: source code for static analysis, a testable invariant for fuzzing, bytecode for reverse engineering or a deployed address for monitoring. Use the workflow table to assemble a small set of complementary tools, then check the source-linked requirements for your chain and build.
The directory includes repositories, developer tools and hosted services. A public repository does not by itself establish license permissions and an accessible product page does not establish a free plan. Pricing and license terms were not audited in this review. Confirm both at the linked source.
A scanner can surface specific patterns or candidate findings. It cannot establish that the system meets every business rule, trust assumption or economic invariant. Require reproducible evidence for findings and review missing scenarios, integrations, privileges and deployment controls.
Use the ecosystem filter and the dedicated categories. Solana account execution, Sui objects, Aptos resources, Starknet account contracts, TON messages and CosmWasm host behavior require different harnesses. A language label is not a promise of support for every chain or compiler version.
It provides evidence about selected checks at a particular time. Trading routes, fees, permissions, liquidity and contract implementation can change. Record the exact chain and address and inspect individual signals instead of treating a score as a guarantee.
They help readers reproduce historical reports, understand older workflows and identify replacements. Legacy and research notices are visible in each affected card and can be selected with the status filter. Inclusion is not a recommendation to deploy a deprecated or experimental implementation.
The review checked primary repository, documentation and provider URLs, recorded response status and redirects and inspected the stated purpose and relevant maintenance notices. Five entries have only provider-page evidence and are labeled accordingly. Tools were not installed or benchmarked, paid access was not tested and detection quality was not measured.
Download the catalog as CSV or JSON and the dated source-review CSV. Each listed tool has a source URL and check date. The source review also records exclusions, response status and a content hash where a response was obtained. These files preserve the review snapshot. They do not promise that a destination remains unchanged.