I ran my Solidity scanner across the 10 most-audited codebases in web3. Here's every flag.

The dirty secret of automated smart-contract security tools isn’t that they miss bugs. It’s that they cry wolf. Point a typical static analyzer at a clean codebase and you’ll get forty “criticals” — and after the third false alarm, your team stops reading the output entirely. A tool nobody trusts is worse than no tool at all.

So when I built OpenClaw Audit — a free, open-source heuristic scanner for Solidity — I held it to a different bar. Not “how many things can it flag?” but the opposite: can it stay silent on code that’s already sound?

There’s a clean way to test that. Run it across the most-reviewed Solidity codebases on earth — the libraries that thousands of protocols depend on, audited many times over — and see how much noise it makes. A calibrated tool should be quiet here.

Here’s what it found. Every number is reproducible in one command; every flag I checked by hand.

The results

Codebase Source files Candidates OpenZeppelin Contracts 247 0 forge-std 31 0 Uniswap Permit2 16 0 PRBMath 40 0 Uniswap v2-core 11 1 Uniswap v3-core 40 1 Uniswap v4-core 46 1 Solmate 20 2 Morpho Blue 17 2 Solady 140 7 Total 608 14

Fourteen candidate observations across 608 source files. Four of the ten codebases came back completely clean. That’s the headline: on the most-audited Solidity in existence, the scanner is nearly silent.

But the more interesting part is what it flagged — because the flags aren’t random noise. They cluster on genuinely notable spots.

The flags, one by one

Uniswap v3 & v4 — initialize() flagged as “unprotected.” False positive, and an instructive one. A Uniswap pool’s initialize() sets its starting price, and it’s permissionless by design — anyone can call it once on a fresh pool. A heuristic sees “an initialize function with no access control” and raises a hand. A human sees the design and clears it in five seconds. That’s the model: the tool surfaces, the human decides.

Solmate — a real, known design gap. Solmate’s minimal ERC-4626 deliberately omits the virtual-share protection against the first-depositor inflation attack, leaving it to the integrator. OpenZeppelin’s ERC-4626 adds that defense; Solmate’s doesn’t. The scanner flags the difference — and it’s right to. This is signal, not noise.

Morpho Blue — reentrancy candidates. False positives. Morpho Blue is formally verified with the Certora Prover, and the external calls the heuristic latched onto are safeTransfers with correct effects-before-interactions accounting. A pattern-matcher can’t see a formal proof; a reviewer can.

Solady — seven flags, all false positives. A documented tx.origin rescue default in Lifebuoy (with explicit warnings in the code), UUPS/ERC-1967 upgrade authorization the regex doesn’t parse, and one intentional math ordering. Solady is some of the most carefully-optimized Solidity written; the “issues” are the tool not understanding assembly-level auth, not real holes.

Why this matters more than a big number

I could have tuned the detectors until they screamed on everything and called it “thorough.” That’s easy, and useless. The skill in this job isn’t generating findings — it’s not drowning the two that matter under thirty-eight that don’t.

A clean run on OpenZeppelin, forge-std, Permit2 and PRBMath means that when this tool does flag something in your code, it’s worth a look. And when a human (me) reviews the output, I’m clearing a handful of explainable candidates — not wading through a wall of red.

The goal was never a tool that says “zero bugs.” Nothing can promise that. The goal is signal over noise — and a claim you can check yourself rather than one you have to trust.

Check it yourself

git clone --depth 1 https://github.com/OpenZeppelin/openzeppelin-contracts /tmp/oz
pipx run --spec git+https://github.com/juan23z/openclaw-audit openclaw-audit /tmp/oz
# → 0 candidate observations across 247 client .sol contracts

Enter fullscreen mode Exit fullscreen mode

Swap in any repo above — or your own. The full Calibration Report and the scanner (MIT-licensed, no API keys, GitHub Action included) are on GitHub.

I do fast, honest Solidity security reviews — heuristics to surface, manual verification to confirm, and a straight answer when your code is solid. Free scanner: github.com/juan23z/openclaw-audit · human review + continuous monitoring: juan23z.github.io