Skip to content
Quantix Security Labs

Contract Analyzer

Automated static analysis of Solidity: submit a verified contract address, paste source or a standard JSON input, or point to a public repository. The source is compiled and analysed with Slither in an isolated sandbox, and every step, tool version and finding is recorded. It is a first pass for reviewers, not a manual security audit.
Illustration: source sheets entering a sealed analysis enclosure, findings leaving as severity tiles

Automated static analysis (Slither). Not a manual security audit: detectors report patterns that need human review, can be false positives, and miss whole classes of issues such as business-logic and economic flaws.

The verified source published on the block explorer is fetched by the analyzer worker. Unverified contracts cannot be analysed: bytecode alone is not enough for Slither.

Checking analyzer status…

Method

Ten recorded steps

Each analysis moves through the same pipeline and stores the outcome of every step. A step that fails stops the run with its reason; no findings are reported for a run that did not complete.

  1. 01

    Validate input

    Checks the address and checksum, the source size and paths, or the repository host, owner and ref against an allowlist.

  2. 02

    Fetch source

    Fetches the verified source from Etherscan V2, reads the pasted input, or makes a shallow HTTPS clone without submodules.

  3. 03

    Resolve dependencies

    Resolves imports and remappings; bundled packages such as OpenZeppelin are added from the analyzer’s own copies.

  4. 04

    Identify compiler version

    Matches the explorer’s compiler version or the pragmas against the solc versions installed on the worker.

  5. 05

    Compile contract

    Compiles a solc standard JSON input. A compiler error stops the run; nothing is analysed from a project that does not build.

  6. 06

    Run static analysis

    Runs Slither’s detectors on the compilation unit and records Slither’s version.

  7. 07

    Normalize findings

    Maps detectors to categories and CWE identifiers, and drops results located in third-party dependencies.

  8. 08

    Classify severity

    Uses Slither’s impact rating; fund-moving, ownership and self-destruct detectors become critical at medium or high confidence.

  9. 09

    Save results

    Stores every finding with its tool, detector, location and confidence. Findings start as “under review”.

  10. 10

    Generate technical report

    Renders the technical PDF from the stored results only.

Sandbox

Separate worker
The web application only queues jobs. Compilation and analysis run in a dedicated worker process, never inside Next.js.
No network
Each run gets its own network namespace (or a Docker container with --network none): no internet, no metadata endpoints, no internal services.
Unprivileged and limited
Tools run as an unprivileged user with CPU-time, memory, file-size, process and wall-clock limits, and bounded output.
Clean environment
The tools see no environment variables beyond PATH and HOME, so database URLs and API keys are not reachable. Each job’s working directory is deleted afterwards.
Restricted Git
Only https URLs on github.com, gitlab.com and bitbucket.org; no credentials, ports or IP hosts; depth-1 clone, no submodules, hooks or symlinks, and a size cap.

Finding categories

  • Reentrancy
  • Dangerous Delegatecall
  • Access Control
  • Unchecked External Calls
  • Upgradeability Risks
  • Uninitialized Storage
  • Potential Integer Errors
  • Known Static Analysis Patterns

What automated analysis cannot do

  • Judge business logic, economic design, oracle and governance assumptions, or how contracts behave together once deployed.
  • Confirm that a reported pattern is exploitable: detectors flag code shapes, and many results are intended behaviour.
  • Cover code that does not compile here, Vyper contracts, or unverified bytecode.
  • Replace a manual review: an empty findings list does not mean a contract is secure.

Technical references

Need more than a detector pass?

A manual assessment reviews design, access control and economic assumptions that static analysis cannot see, and confirms which findings matter.

Discuss Your Security RequirementsToken Scanner