slither

Slither

The aim of this tutorial is to show how to use Slither to automatically find bugs in smart contracts.

• Installation
• Command line usage
• Introduction to static analysis: Brief introduction to static analysis
• API: Python API description

Once you feel you understand the material in this README, proceed to the exercises:

• Exercise 1: Function override protection
• Exercise 2: Check for access controls

Watch Slither's code walkthrough to learn about its code structure.

Installation

Slither requires Python >= 3.8. It can be installed through pip or using docker.

Slither through pip:

pip3 install --user slither-analyzer

Docker

Slither through docker:

docker pull trailofbits/eth-security-toolbox
docker run -it -v "$PWD":/home/trufflecon trailofbits/eth-security-toolbox

The last command runs eth-security-toolbox in a docker that has access to your current directory. You can change the files from your host, and run the tools on the files from the docker

Inside docker, run:

solc-select 0.5.11
cd /home/trufflecon/

Command line

Command line versus user-defined scripts. Slither comes with a set of predefined detectors that find many common bugs. Calling Slither from the command line will run all the detectors, no detailed knowledge of static analysis needed:

slither project_paths

In addition to detectors, Slither has code review capabilities through its printers and tools.