solidity-security-scanner

CLI tool that scans Solidity smart contracts for common vulnerabilities. Zero external dependencies -- pure regex-based static analysis.

Install & Usage

Scan a single file:

npx solidity-security-scanner ./src/MyContract.sol

Scan a directory (recursively finds all .sol files):

npx sol-scan ./src/

Output as JSON:

npx sol-scan ./src/ --json

What It Scans

15 vulnerability patterns across 5 severity levels:

Critical

1. Reentrancy -- External calls (.call{, .transfer(, .send() before state changes
2. Unchecked call -- .call{ without checking the return value
3. tx.origin -- Use of tx.origin for authorization

High

4. Delegatecall -- Use of delegatecall (dangerous if target is user-controlled)
5. Selfdestruct -- Use of selfdestruct (can be weaponized)
6. Arbitrary send -- .call{value: with potentially user-controlled destination
7. Unprotected function -- Public/external state-changing functions without access control

Medium

8. Floating pragma -- pragma solidity ^ instead of fixed version
9. Missing zero check -- Constructor or setter without address(0) validation
10. Timestamp dependence -- Use of block.timestamp in comparisons
11. Unsafe ERC20 -- Direct .transfer() or .transferFrom() on IERC20 without SafeERC20

Low

12. Missing events -- State-changing functions without emit statements
13. Gas in loop -- External calls inside for/while loops
14. Magic numbers -- Hardcoded numbers that should be named constants

Info

15. Missing NatSpec -- Functions without /// or /** documentation comments

Output

Terminal output with colored severity levels:

Scanning MyContract.sol...

[CRITICAL] Reentrancy vulnerability (line 42)
  External call before state update: .call{value: amount}

[HIGH] Unprotected function (line 78)
  Public function modifyBalance() has no access control

Summary: 1 critical, 1 high, 3 medium, 2 low, 0 info

No External Dependencies

Pure Node.js with regex-based pattern matching. No AST parser needed, no native modules, installs in seconds.

License

MIT

Built by THRYXAGI