Welcome! We are the pessimistic.io team, and in recent months we have been actively developing our own Slither detectors to help with code review and audit process. This repository contains everything you may require to work with them!

We increased the sensitivity of our detectors since they are quite straightforward and not written in the "original style." As a result, they produce FPs (False Positives) more frequently than original ones. So that, our detectors are a kind of automation of the checks implemented in the checklist, their main purpose is to look for issues and assist the code auditor.

Please let us know if you have discovered an issue/bug/vulnerability via our custom Slither detectors. You may contact us via opening a PR/Issue or directly, whichever is more convenient for you. If you have any further questions or suggestions, please join our Discord Server! We hope to see you there, and we intend to support the community and its initiatives!

To install Pessimistic Detectors:

1. Install the original Slither;
2. Clone our repository;
3. Run the following command in our repository folder:

python3 setup.py develop

Keep in mind that you don't have to reinstall the plugin after changes in the repository!

4. Dependencies must be installed in order to test the detectors on our test contracts:

npm install

Please note:

• *Valid - issues included in reports and fixed by developers (January 2023 - March 2023).

• There is one detector that is disabled by default: pess-uni-v2. It is recommended to run it only on projects that integrate Uniswap V2!

Here we indicate our updates, workflows and mark completed tasks and improvements!

You can add your own detector/idea/enhancement by opening the Issue at the following link.

Prior to adding a custom detector, ensure that:

1. In a documentation file, your detector is comprehensively described;
2. The detector test contract is presented and correctly compiles;
3. The detector code is presented and works properly.

Prior to adding an idea, ensure that:

1. Your concept or idea is well articulated;
2. A vulnerability example (or PoC) is provided;

Prior to adding an enhancement, ensure that:

1. Your enhancement does not make the base code worse;
2. Your enhancement is commented.

Articles:

• Slither
• How do we use Slither at Pessimistic.io
• Slither Explained
• Slither: In-Depth
• Slither Review
• Slither - Python
• Reentrancy Attacks on Smart Contracts Distilled

Research Papers:

• Slither: A Static Analysis Framework For Smart Contracts
• Detecting Vulnerable Ethereum Smart Contracts via Abstracted Vulnerability Signatures
• Evaluating Smart Contract Static Analysis Tools Using Bug Injection
• A Framework and DataSet for Bugs in Ethereum Smart Contracts
• A Comprehensive Survey of Upgradeable Smart Contract Patterns