Slitherin: Our Very Own Slither detectors

Greetings, dear readers!

We are the pessimistic.io team, and in recent months we have been actively developing our own Slither detectors to help with code review and audit process.

This is merely a release article that largely repeats what is stated in our readme; however, this article will serve as the start of a series of articles in which we will explain the development, new detectors, and improvements!

This repository contains everything you may require to work with them!

Stay tuned for more updates!

Our aim was to increase the sensitivity of the detectors to assist our auditors, so they are quite straightforward and not written in the “original style.” As a result, they produce FPs (False Positives) more frequently than original ones.

As such, our detectors are a kind of automation of the checks implemented in the checklist, their main purpose is to look for issues and assist the code auditor.

Please let us know if you have discovered an issue/bug/vulnerability via our custom Slither detectors. You may contact us via opening a PR/Issue or directly, whichever is more convenient for you.

By the way, here are some vacant slots in the second quarter of 2023 now so if your project needs an audit — feel free to write to us, visit our public reports page!

What’s a Slither?

In short, Slither is a Python-based contract security framework first proposed in a 2019 paper by Josselin Feist, Gustavo Grieco, and Alex Groce. The Slither Framework offers automated detection of vulnerabilities and optimizations, as well as codebase summaries to aid developer comprehension.

Born from Crytic, the blockchain security division of Trail of Bits, Slither is compatible with Hardhat and Truffle and supports Solidity code written beginning with V0.4.

Besides its excellent analysis capabilities, it also includes a bunch of printers that summarize different aspects of the contract in a digestible form. One can even use them to quickly build a mental contract model before diving deeply into the code!

However, multiple printers lose their value for more complex projects since their output becomes unmanageable… We tend to think that plugins are actually one of the most important aspects of properly setting up and running Slither because they significantly increase functionality!

Also, keep in mind that it is the most convenient way to add your own detectors. Check out our recent article about the Slither, if you haven’t already:

This article also has a second purpose: being a systematization of knowledge for the Slither tools usage, in which I will rely on authors that I myself trust in this matter and, of course, our pessimistic.io auditors.

With all said, here are some mentions of Slither in the following research papers:

• Slither: A Static Analysis Framework For Smart Contracts
• Detecting Vulnerable Ethereum Smart Contracts via Abstracted Vulnerability Signatures
• Evaluating Smart Contract Static Analysis Tools Using Bug Injection
• We would also like to invite you to visit our blog and read our article about the Slither!

Slither: In-Depth

The list of resources you’ll see thereafter will help you learn more about Slither and our version of detectors, Slitherin, and we think you’ll find them to be very helpful:

• Accessing Private Data in Smart Contracts
• Simplest way to run Slither for your Smart Contract project
• Dataset Card for Slither Audited Smart Contracts
• Slither & Echidna + Remappings
• Static Analysis of Smart Contracts with Slither & GitHub Actions

We have meticulously studied all of the above, performed multiple backtests, and are proud to present our own detectors!

It would be fantastic if you could bookmark, share, star, or fork the following repository. Any attention will help us achieve our common goal of making Web3 a little bit safer than it was before: therefore, we require your support!

For our part, we’ll do everything in our power to ensure that this project continues to grow successfully in terms of both code and technology as well as community and professional interaction!

The following links and resources may be useful to you in your work; please carefully check them out:

• Slither
• Slitherin
• How do we use Slither at Pessimistic.io
• Slither Explained
• Slither: In-Depth
• Slither Review
• Slither — Python
• Reentrancy Attacks on Smart Contracts Distilled
• Be sure to check out our blog as well!

If you have any further questions or suggestions, please join our Discord Server or Telegram chat! We hope to see you there, and we intend to support the community and its initiatives!

We sincerely hope you find our work useful and appreciate any feedback, so please do not hesitate to contact us!

Also published here.