Free, fast heuristic security scanner for Solidity — point it at a repo, get a professional report in seconds. Runs clean on OpenZeppelin (0 findings, 247 files) so you get signal, not noise. Add it to CI in two lines.
Part of OpenClaw, an autonomous multi-agent system that runs a Web3 security workflow 24/7. This is the open-source scanning core.
🛡️ Shipping to mainnet? Want a human on it? The scanner flags candidates — a hand-verified review adds real findings (zero false-positive spam) + a plain-English report in 48h. Start with a Quick Scan from $49 (pay in USDC or card). → Pricing & services →
python scan.py https://github.com/org/protocol --name "Protocol" --out ./report
# → ./report/report.md + ./report/report.html
No dependencies beyond Python 3.9+ and git. It clones (shallow), runs the detectors, writes the report, and cleans up after itself.
One command, no clone (via pipx):
pipx run --spec git+https://github.com/juan23z/openclaw-audit openclaw-audit <repo-or-path> --out ./report
Or install it: pipx install git+https://github.com/juan23z/openclaw-audit → then just openclaw-audit <repo>.
⚡ Use it in CI (GitHub Action)
Get a security scan on every push and PR — a summary lands as a comment on your PR, the full report in the job summary + an artifact. Two lines:
# .github/workflows/security.yml
name: security
on: [push, pull_request]
permissions:
contents: read
pull-requests: write # lets the scan post its summary as a PR comment
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: juan23z/openclaw-audit@v1
with:
path: contracts # optional, default '.'
# fail-on-candidates: true # optional, default false (heuristics are advisory)
# comment-on-pr: false # optional, default true
That's it — no API keys, no cost. Want verified findings + continuous monitoring (re-audited on every change)? Get a human audit → order on Fiverr · sample report & service
🔦 Findings in your Security tab (SARIF)
OpenClaw writes a report.sarif (SARIF 2.1.0) to ${{ runner.temp }}/openclaw-report/report.sarif. Upload it with
GitHub's own upload-sarif action and candidates show up inline on the diff and in the repo's Security → Code
scanning tab — same place CodeQL results land. Add the security-events: write permission and one step:
permissions:
contents: read
pull-requests: write
security-events: write # lets the SARIF upload write to the Security tab
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: juan23z/openclaw-audit@v1
- uses: github/codeql-action/upload-sarif@v3 # pin to a commit SHA if your policy requires it
if: always()
with:
sarif_file: ${{ runner.temp }}/openclaw-report/report.sarif
category: openclaw-audit
📤 Output formats
Every run writes four files to the output dir (--out, default ./report), so you get a report to read and
machine-readable output to pipe anywhere:
| File | Use |
|---|---|
report.md |
Human-readable report (job summary, PRs) |
report.html |
Standalone styled report (share / print to PDF) |
report.json |
Programmatic use — findings in a stable shape |
report.sarif |
SARIF 2.1.0 — GitHub code scanning, other SARIF viewers |
🏷️ Show it off — add the badge
Scanning your contracts with OpenClaw Audit? Add the badge to your README:
[](https://github.com/juan23z/openclaw-audit)
What it checks (12 detectors)
| # | Detector | Looks for |
|---|---|---|
| 1 | First-depositor inflation | ERC-4626 empty-vault share inflation |
| 2 | ERC-4626 rounding | Rounding that favors the withdrawer |
| 3 | Donation attack | balanceOf(address(this)) used for accounting |
| 4 | Oracle staleness | Price reads without freshness checks |
| 5 | Cross-function reentrancy | External call before state update |
| 6 | Access control | Unprotected privileged / init / sweep functions |
| 7 | Fee-on-transfer | Unhandled fee/rebasing token assumptions |
| 8 | Precision loss | Division before multiplication |
| 9 | ERC compliance | ERC-20 / 4626 conformance gaps |
| 10 | NatSpec | Missing docs on critical functions |
| 11 | Unchecked low-level call | call/send/delegatecall return value ignored |
| 12 | tx.origin auth | tx.origin used for authorization (phishing vector) |
Detectors skip dependencies and tests (node_modules, lib, out, test, mock, …) so you only get
findings in your code.
✅ Calibrated, not noisy
Runs clean on clean code: 0 findings across the entire OpenZeppelin contracts library (the most-audited codebase in web3). Detectors skip comments, tests and dependencies — so you get signal, not a wall of false positives.
Don't take our word for it — see the full Calibration Report: OpenClaw run across 10 of the most-audited codebases in the ecosystem (OpenZeppelin, Solady, Uniswap v2/v3/v4, Morpho Blue, Permit2, PRBMath…), with every flag verified by hand. 14 candidates across 608 source files; 4 codebases perfectly clean. Every number is reproducible in one command.
⚠️ Honest by design
These are heuristic candidates, not confirmed vulnerabilities. Static heuristics produce false positives — verify each finding by hand before acting. The report labels every item as "candidate · verify".
Want a human review with verified findings and a plain-English report? Start with a Quick Scan ($49, pay in USDC or card) or a full core review → pricing & services
🔗 On-chain attestation (optional)
contracts/AuditAttestation.sol lets an auditor publish a keccak256 hash of a delivered report + a verdict
on-chain, so anyone can verify a report's authenticity and date (tamper-evidence + provenance). Two-step
ownership, access-controlled attesters, no external calls. Compiles with Solc 0.8.24 and ships with a Foundry
test suite (8 passing tests):
cd contracts && forge install foundry-rs/forge-std && forge test
Deploy on any EVM testnet.
