DEV Community
•
2026-07-30 22:08
I ran my Solidity scanner on 6 top-audited DeFi protocols. Every 'critical' was a false positive — here's why.
Most Solidity scanners are high-recall, low-precision. They flag 40 things, 38 are noise, and after the third report you stop reading them — so the one real bug ships. Precision, not recall, is what makes a security tool actually get used.
I've been building OpenClaw, a heuristic Solidity scanner with the opposite bar: silence on sound code. To pressure-test it, I pointed it at six codebases that...