Smart Contract Vulnerability Scanners: What Free Tools Miss

Video transcript

Can a free scanner replace a smart contract audit? No. Scanners flag known code patterns, not the logic flaws behind most of Guardian's critical findings.

Scanners catch code shapes that are wrong anywhere: reentrancy, unchecked calls, tx dot origin authorization, unprotected upgrades and weak randomness.

In a peer-reviewed study, five tools faced 127 DeFi attacks that cost 2.3 billion dollars. They could have prevented just 8 percent.

Another study put only about 20 percent of exploitable bugs within any tool's reach. Both used pre-2024 tool versions, but the gap is structural: no scanner knows your protocol's rules.

Across Guardian's 320 public reports, about 60 percent of 343 Criticals fall in logic and accounting, in our grouping. No general detector covers that class. Reentrancy accounts for two.

For investors, a scan report shows hygiene, not safety. Ask how findings were triaged, which audit covers the deployed commit, and whether invariants run in CI.

Run scanners on every change. Bring in humans before mainnet, when a protocol keeps its own accounting or uses oracles, and after logic upgrades.

Guardian's audits run three passes: design review, an invariant suite and manual review by senior researchers. Vanguard adds a second team driven by Helix, Guardian's AI auditor.

Read the full guide for the scanner comparison, or talk to Guardian about finding the logic bugs scanners miss.

Free scanners are fast: Slither's README cites an average under one second per contract. ethereum.org recommends running Aderyn, Mythril and Slither before each pull request is merged.

The question founders and investors ask is whether a clean scan is enough. Two peer-reviewed studies and Guardian's own reports suggest it is not.

This guide compares the main scanners from their own docs and repositories, then maps Guardian's Critical findings against what they detect.

What Scanners Do

A scanner checks code against known bad patterns. It does not know what your protocol is supposed to do.

• Static analyzers read the source: Slither and Aderyn.
• Symbolic execution explores bytecode paths: Mythril.
• Pattern rules and linters match code shapes: Semgrep rules and Solhint.
• Hosted scanners run detectors from a web app: SolidityScan.
• AI scanners read code with a language model.

AI scanners are a separate field, covered in our AI auditing tools guide. One maker, Nethermind, reports its AuditAgent found 30% of its auditors' findings across 29 audits.

The Scanners Compared

The docs carry three caveats.

• Mythril labels findings with SWC IDs, but the SWC Registry says its content "has not been thoroughly updated since 2020."
• The Semgrep rule set notes that open-source taint mode stays within a single function.
• None of these pages publishes a false-positive rate. Slither claims "low false positives" without a figure.

What Scanners Catch

Scanners are good at code shapes that are wrong wherever they appear.

• Reentrancy: state changed after an external call.
• Unchecked calls: ignored return values from calls, sends and token transfers.
• tx.origin used for authorization.
• Unprotected upgrades, initializers and selfdestruct.
• Weak randomness drawn from block values.
• Delegatecall to an address a user controls.
• Arithmetic shapes: divide before multiply, unsafe casts, integer overflow.
• Calls inside loops that one failure can block.

Semgrep's rules add patterns from specific past exploits, such as Compound-style borrow reentrancy and an OlympusDAO staking call order.

Reentrancy is where the research credits them. In one study of 127 DeFi attacks, every attack the tools caught was a reentrancy bug.

What Scanners Miss

Two peer-reviewed studies measured the gap on real bugs.

• Zhang et al. (ICSE 2023) studied 516 bugs from 2021 and 2022. Of the 385 they judged exploitable, only 79 (about 20%) were within any existing tool's reach, even assuming perfect tools.
• They also ran Slither and Oyente on the dataset. Neither detected any of the bugs outside that 20%.
• Chaliasos et al. (ICSE 2024) ran five tools against 127 attacks that cost $2.3 billion. The tools could have prevented 8%, or $149 million.
• 75% of those attacks were outside the tools' scope. The top two causes, missing logic or sanity checks and onchain oracle manipulation, were undetectable by the tools.

Both studies tested tool versions from before 2024, and detectors have been added since.

The gap is structural: no detector knows your protocol's rules. More in our guide to business logic vulnerabilities.

What Guardian's Criticals show

We grouped the auditors' own category labels on all 343 Critical and 845 High findings in Guardian's 320 public reports. Then we matched each group to the detectors the tools above document.

"Partial" means detectors exist for some shapes of the class. A call inside a loop gets flagged; a withdrawal blocked by a wrong state check does not.

How to read the table:

• The labels are the auditors' own, and not fully consistent.
• The grouping and the coverage column are our judgment.
• Logic and accounting: 200 Logical Error or Logic Error labels, plus 6 Double Counting or Rewards.
• Data as of November 5, 2026.

Guardian runs static analysis too: 153 of the 320 reports list it in their methodology, each alongside manual review.

Scanner Output in Diligence

For investors and acquirers, a scan report is evidence of hygiene, not of safety. Ask the team:

• Which scanners run in CI, at which versions, on every pull request?
• How was each finding triaged: fixed, or dismissed with a reason?
• What is suppressed in the config, and why?
• Which audit covers the deployed commit, and who reviewed the logic?
• Are the protocol's rules written as invariants that run in CI?

Triage matters because the noise is real. A 2020 study ran nine tools on more than 47,000 Ethereum contracts: 97% were tagged as vulnerable, which the authors read as many false positives.

A hosted scanner's security score rates the patterns it checks. It cannot speak to logic and accounting, where 60.1% of Guardian's Criticals sit in our grouping.

When You Need Humans

Run scanners on every change. Bring in human reviewers when the code will hold value:

• Before mainnet, and before raising any deposit cap.
• When the protocol keeps its own accounting: shares, debt, fees or rewards.
• When it prices assets from oracles or integrates other protocols.
• After any upgrade to that logic.

Chaliasos et al. estimate that property-based fuzzing, formal verification and model checking could have prevented 37% of the attacks they studied. The scanners managed 8%.

So write the rules down as invariants, fuzz them, and have reviewers read the code against the spec. Hiring? Use our auditor scorecard.

How Guardian Audits

Guardian's smart contract audit runs three passes over the same code:

1. A design review, before implementation locks in the costliest risks.
2. An invariant suite around solvency, accounting, rounding and edge states.
3. A manual audit by senior researchers, with proof-of-concept depth.

Vanguard adds a second, independent team driven by Helix, Guardian's AI auditor. Only human-verified findings reach the report.

Guardian's audits and pentests also cover the offchain systems around the code: web apps, APIs, infrastructure and automation.

Frequently Asked Questions

Can a free smart contract scanner replace an audit?

No. Scanners flag known code patterns such as reentrancy and unchecked calls. In a peer-reviewed test, five tools could have prevented 8% of 127 DeFi attacks. Logic and economic flaws need human review and invariant testing.

What is the best free smart contract vulnerability scanner?

We found no current independent ranking. Chaliasos et al. describe Slither as the most popular static analyzer; it detected the most in their study, with many false positives. Aderyn is a Rust alternative that also writes SARIF reports.

Should investors trust a smart contract scan report?

Treat it as evidence of hygiene. Ask which tools ran on which commit, how findings were triaged, and which audit covers the deployed code. A clean scan says nothing about logic flaws.

What vulnerabilities do scanners miss?

Mostly logic and accounting errors and economic or oracle manipulation. In Guardian's 320 public reports, 60.1% of Critical findings fall in our logic and accounting group, a class no general detector covers.

Sources

• GitHub: crytic/slither, README and detector list (accessed Nov 5, 2026)
• GitHub: Slither releases, 0.11.6 (Jul 28, 2026)
• GitHub: Cyfrin/aderyn (v0.6.8, Jan 22, 2026)
• GitHub: Consensys/mythril (last release v0.24.8, Mar 27, 2024)
• GitHub: Decurity/semgrep-smart-contracts (accessed Nov 5, 2026)
• Semgrep: Supported languages (accessed Nov 5, 2026)
• GitHub: protofire/solhint, rules (v6.2.5, Oct 8, 2026)
• SolidityScan: Homepage (accessed Nov 5, 2026)
• SolidityScan: Documentation, introduction (accessed Nov 5, 2026)
• SWC Registry: Smart Contract Weakness Classification (accessed Nov 5, 2026)
• ethereum.org: Smart contract security (updated Oct 22, 2026)
• Zhang, Zhang, Xu and Lin: Demystifying Exploitable Bugs in Smart Contracts (ICSE 2023), paper and data
• Chaliasos et al.: Smart Contract and DeFi Security Tools, Do They Meet the Needs of Practitioners? (ICSE 2024)
• Durieux et al.: Empirical Review of Automated Analysis Tools on 47,587 Ethereum Smart Contracts (2020)
• Nethermind: How Nethermind Security Uses AuditAgent Alongside Manual Audits
• Guardian: Public audit portfolio, 320 reports (as of Nov 5, 2026)
• Guardian: Smart Contract Audit
• Guardian: Vanguard