Vulnerability Detectors

200+ vulnerability detectors

Explore our full library of smart contract vulnerability detection patterns across multiple languages and analysis layers.

Showing 1–25 of 247 detectors

ID	Name	Severity	Category	Language	Layer
L020	Use of tx.origin is unsafe in almost every context	low	low-severity	solidity	static
G049	Don't use _msgSender() if not supporting EIP-2771	info	gas	solidity	static
L017	Array does not have a pop function	low	low-severity	solidity	static
G221	Emit Used In Loop	info	gas	solidity	static
NC047	Expressions for constant values such as a call to keccak256(), should use immutable rather than constant	info	non-critical	solidity	static
L022	Missing Reentrancy-Guard when using sendValue from OZ's Address.sol	low	low-severity	solidity	static
NC002	TODO Left in the code	info	non-critical	solidity	static
L026	NFT contract redefines _mint()/_safeMint(), but not both	low	low-severity	solidity	static
	Large approvals may not work with some tokens	medium	general	solidity	static
NC999	Large or complicated code bases should implement invariant tests	info	non-critical	solidity	static
	Pausing withdrawals is unfair to the users	low	general	solidity	static
G039	>= costs less gas than >	info	gas	solidity	static
G009	Use selfbalance() instead of address(this).balance when getting your contract's balance of ETH to save gas.	info	gas	solidity	static
L019	Solidity version 0.8.20 may not work on other chains due to PUSH0	low	low-severity	solidity	static
	Array lengths not checked	low	general	solidity	static
	Code does not follow the best practice of check-effects-interaction	low	general	solidity	static
	No way to retrieve ETH from the contract	medium	general	solidity	static
NC028	Interfaces should be indicated with an I prefix in the contract name	info	non-critical	solidity	static
G042	Use solidity version 0.8.20 or above to improve gas performance	info	gas	solidity	static
G053	array[index] += amount is cheaper than array[index] = array[index] + amount (or related variants)	info	gas	solidity	static
G023	Internal functions only called once can be inlined to save gas	info	gas	solidity	static
NC050	Use abi.encodeCall() instead of abi.encodeSignature()/abi.encodeWithSelector()	info	non-critical	solidity	static
M026	Return values of approve() not checked	medium	medium-severity	solidity	static
	addresses upcast and compared to values larger than a uint160, may result in collisions	low	general	solidity	static
NC035	Lines are too long	info	non-critical	solidity	static