Back to feed
Dev.to
Dev.to
7/21/2026
OpenClaw Audit scanner tested across 10 most-audited Solidity codebases: 14 flags in 608 files

OpenClaw Audit scanner tested across 10 most-audited Solidity codebases: 14 flags in 608 files

Original: I ran my Solidity scanner across the 10 most-audited codebases in web3. Here's every flag.

Short summary

The author ran their open-source Solidity scanner OpenClaw Audit across the ten most-audited web3 codebases to measure false-positive rates. Only 14 candidate flags appeared across 608 source files, with four codebases completely clean. Each flag is manually reviewed, distinguishing genuine design gaps like Solmate's missing ERC-4626 inflation protection from expected false positives on Uniswap and Solady.

  • •14 candidate flags across 608 files in the most-audited Solidity codebases, with 4 codebases completely clean
  • •Flags cluster on genuinely notable spots like Solmate's missing ERC-4626 first-depositor protection
  • •Scanner is MIT-licensed, reproducible in one command, and includes a GitHub Action

Generated with AI, which can make mistakes.

#open-source
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

The original title is "I open-sourced a Solidity security scanner with 0 false positives on all of OpenZeppelin"
Dev.to
The original headline is: "5 false positives that fool naive Solidity scanners (and how to kill them at the root)"
Dev.to
I Tested My Static Analysis Tool Against 4 Real Open-Source Repos. Here's What It Got Wrong.
Dev.to
I Audited 50 Vibe-Coded Apps. Here's What Broke.
Dev.to