Vulnerability Database
Our scanner currently detects the following common smart contract vulnerabilities using an AST-first analysis pass with regex fallback.
Reentrancy Pattern
High SeverityA value-transferring external call appears before a later state mutation in the same function, which is a common reentrancy risk pattern.
Remediation
Apply Checks-Effects-Interactions by moving state updates before the external call, or protect the function with a reentrancy guard.
Phishing with tx.origin
High SeverityUsing tx.origin for authorization is insecure because malicious contracts can trick users into forwarding calls.
Remediation
Use msg.sender instead of tx.origin for authorization checks.
Unchecked Low-Level Call
Medium SeverityA low-level call executes without an obvious success check.
Remediation
Capture the boolean return value and handle failures explicitly.
Floating Pragma
Low SeverityVersion ranges can compile under a different compiler than the one originally reviewed.
Remediation
Pin Solidity to an exact compiler version such as pragma solidity 0.8.24;.
Weak Randomness
Medium SeverityBlock properties are predictable or miner-influenced and should not be used as entropy sources.
Remediation
Use a verifiable randomness source such as Chainlink VRF.
Unsafe delegatecall
High Severitydelegatecall executes code in the caller context and can corrupt storage or break trust boundaries.
Remediation
Avoid delegatecall to untrusted targets and tightly constrain upgrade or proxy execution paths.
Selfdestruct Usage
High Severityselfdestruct can permanently change contract behavior and is dangerous in most production systems.
Remediation
Remove selfdestruct or gate it behind strong governance and a carefully reviewed shutdown flow.