The original headline is: "5 false positives that fool naive Solidity scanners (and how to kill them at the root)"

Short summary

Five common false positive patterns in naive Solidity static analysis scanners waste auditor time and damage credibility. Issues include misidentifying fee-on-transfer-safe balance checks as donation bugs, loose regex matching on variable names, flagging permissionless keeper patterns as access control flaws, confusing local variables with storage writes in reentrancy detection, and misparsing interface declarations in flattened files. Each fix requires teaching the scanner structural context rather than simple pattern matching.

• •Fee-on-transfer-safe balanceBefore/balanceAfter delta pattern is a mitigation, not a bug
• •Word-boundary regex and write-target classification eliminate common false criticals
• •Keeper patterns with fixed transfer destinations are safe by construction, not access control violations

Generated with AI, which can make mistakes.