{"owner":"crytic","repo":"slither","hasSkills":true,"totalSkillsCount":21,"totalTokensCount":11663,"categories":["anthropic-skill","claude-rule","plugin-manifest"],"hasMcp":false,"mcpConfig":null,"found":["docs/src/tools/Adding-a-new-utility.md","docs/src/tools/Documentation.md","docs/src/tools/Doctor.md","docs/src/tools/Code-Similarity-Detector.md","docs/src/tools/ERC-Conformance.md","docs/src/tools/Interface.md","docs/src/tools/Contract-Flattening.md","CLAUDE.md","docs/src/tools/Mutator.md","docs/src/tools/Path-Finding-Utility.md","docs/src/tools/README.md","docs/src/tools/Property-generation.md","docs/src/tools/ReadStorage.md","docs/src/tools/Slither-format.md","docs/src/tools/Upgradeability-Checks.md","slither/tools/demo/README.md","slither/tools/erc_conformance/README.md","tests/tools/check_kspec/safeAdd/spec.md","tests/tools/read-storage/test_data/TEST_storage_layout.json","tests/tools/read-storage/test_data/TEST_unstructured_storage.json","tests/tools/mutator/test_data/test_source_unit/README.md"],"skills":{"docs/src/tools/Adding-a-new-utility.md":"# Adding New Utility\n\nSlither can be used as a library to create new utilities.\nOfficial utils are present in [tools](https://github.com/crytic/slither/tree/master/slither/tools)\n\n## Skeleton\n\nThe skeleton util is present in [tools/demo](https://github.com/crytic/slither/tree/master/slither/tools/demo)\n\n## Integration\n\nTo enable an util from the command-line, update `project.scripts` in [pyproject.toml](https://github.com/crytic/slither/blob/master/pyproject.toml).\nInstalling Slither will then install the util.\n\n## Guidelines\n\n- Favor the `logging` module rather than `print`\n- Favor raising an exception rather than `sys.exit`\n- Add unit-tests (ex: [scripts/travis_test_find_paths.sh](https://github.com/crytic/slither/blob/master/scripts/ci_test_find_paths.sh))\n\n## Getting Help\n\nJoin our [slack channel](https://empireslacking.herokuapp.com/) to get any help (#ethereum).\n","docs/src/tools/Documentation.md":"# slither-documentation\n\n`slither-documentation` uses [codex](https://platform.openai.com) to generate natspec documentation.\n\nThis tool is experimental. See [solmate documentation](https://github.com/montyly/solmate/pull/1) for an example of usage.\n","docs/src/tools/Doctor.md":"# Slither doctor\n\nSlither doctor is a tool designed to troubleshoot running Slither on a project.\n","docs/src/tools/Code-Similarity-Detector.md":"`slither-simil` uses state-of-the-art machine learning to detect similar (vulnerable) Solidity functions. We have provided a pretrained model from [etherscan_verified_contracts](https://github.com/thec00n/etherscan_verified_contracts) with 60,000 contracts and more than 850,000 functions to get you started quickly. We included the capability to easily train new models if you have access to larger or different datasets.\n\n`slither-simil` uses [FastText](https://github.com/facebookresearch/fastText), a vector embedding technique, to generate compact numerical representations of every function. We used FastText because it:\n\n- implements several state-of-the-art techniques such as nbow and skipgrams,\n- has high performance (it is C++ code with Python bindings),\n- has MIT license, and\n- is well maintained (by Facebook).\n\n## Requirements\n\nInstall the required packages before using `slither-simil`:\n\n```\npip3 install pybind11 --user\npip3 install https://github.com/facebookresearch/fastText/archive/0.2.0.zip --user\npip3 install sklearn matplotlib --user # for plot mode\n```\n\nMake sure that you are using `pip3.6` or later. If you are running from inside a [virtualenv](https://virtualenv.pypa.io/en/latest/), remove the `--user` parameter.\n\n## Usage\n\nNote that these examples will use the following files:\n\n- [etherscan_verified_contracts.bin](https://drive.google.com/file/d/1oEhbIL4V9582Y5VKp4iiOURGq8qa4cBN/view?usp=sharing)\n- [cache.npz](https://drive.google.com/file/d/1vpwusbyzLn1JqqAvlFivHXtLvsEp0VqX/view?usp=sharing)\n- [MetaCoin.sol](https://github.com/crytic/slither/wiki/MetacoinExample)\n\n`slither-simil` has three modes:\n\n- `test` - finds similar functions to your own in a dataset of contracts\n- `plot` - provide a visual representation of similarity of multiple sampled functions\n- `train` - builds new models of large datasets of contracts\n- `info` - inspects the internal information of the pre-trained model or the assessed code\n\n### Test mode\n\nThis mode transforms a function into a vector and uses it to find similar functions.\n\nTest mode requires the following parameters:\n\n1. A pre-trained model: this file will be used to transform every function into a vector, you can [train your own](#train-mode) or [use our pre-trained one (etherscan_verified_contracts.bin)](#usage).\n2. A contract filename: this file will contain the code that you want to compare,\n3. A function name (e.g. `SafeMath.add` or `add`),\n4. An input directory or file: this can be either a directory with contracts or a [cache file with a pre-computed list of vectors for every contract (cache.npz)](#usage).\n\nUse the cache to avoid long processing times to compile and vectorize the input contracts.\n\nHere's an example that finds functions similar to `sendCoin` in `MetaCoin` (compiled with `solc-0.4.25`). Searching for similar functions among more than 800,000 functions takes only 20 seconds.\n\n```\n$ slither-simil test etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --input cache.npz --ntop 25 --solc solc-0.4.25\nINFO:Slither-simil:Reviewed 825062 functions, listing the 25 most similar ones:\nINFO:Slither-simil:filename                                                          contract             function             score\nINFO:Slither-simil:0x954b5de09a55e59755acbda29e1eb74a45d30175_Fluz.sol               Fluz                 transfer             1.0\nINFO:Slither-simil:0x55648de19836338549130b1af587f16bea46f66b_Pebbles.sol            Pebbles              transfer             1.0\nINFO:Slither-simil:0x3fcee23add6e86dde3c4d395cbce1cae7f16d06d_SnipCoin.sol           SnipCoin             sendCoin             1.0\nINFO:Slither-simil:0x000000005fbe2cc9b1b684ec445caf176042348e_ProperProposal.sol     Vote                 transfer             1.0\nINFO:Slither-simil:0x000000002bb43c83ece652d161ad0fa862129a2c_AccountRegistry.sol    Vote                 transfer             1.0\nINFO:Slither-simil:0x4e84e9e5fb0a972628cf4568c403167ef1d40431_Fluzcoin.sol           Fluzcoin             transfer             1.0\nINFO:Slither-simil:0x334eec1482109bd802d9e72a447848de3bcc1063_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x28ccdda197d319a241005b9c9f01bac48b90f556_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x000000002647e16d9bab9e46604d75591d289277_Vote.sol               Vote                 transfer             1.0\nINFO:Slither-simil:0xc6c4c7826D44ABF22c711E8E86bDC3f5242d2182_token.sol              token                sendCoin             1.0\nINFO:Slither-simil:0x22033df1d104736ff4c2b23a28affe52863ca9c8_AtmOnlyFluzcoin.sol    AtmOnlyFluzcoin      transfer             1.0\nINFO:Slither-simil:0xcad796d6a2c0bb1de7f24262819be96fb08c1c3a_Love.sol               Love                 transfer             1.0\nINFO:Slither-simil:0x6cb2b8dc6a508c9a21db9683d1a729715969a6ee_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0xd75fefe3cdb647281eec3f8fc738e3bc9658f9e4_ProofOfReadToken.sol   ProofOfReadToken     transfer             0.996\nINFO:Slither-simil:0x7A8Ef7E8c8f16B9D6F39069ce03d752Af23b46d6_OBS_V1.sol             MyObs                transfer             0.996\nINFO:Slither-simil:0x5ac0197c944c961f58bb02f3d0df58a74fdc15b6_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transfer             0.996\nINFO:Slither-simil:0x3d8a10ce3228cb428cb56baa058d4432464ea25d_TestToken.sol          TestToken            transfer             0.993\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transferFrom         0.992\nINFO:Slither-simil:0x486e1f44b2a85150a6dd2de5aab87df375cd8880_CAIRToken.sol          StandardToken        transfer             0.991\nINFO:Slither-simil:0x2bec16b164725efc192b7ec0296f838c61317514_eda.sol                StandardToken        transfer             0.991\nINFO:Slither-simil:0xb7cb1c96db6b22b0d3d9536e0108d062bd488f74_WaltonToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0x346c3be6aebEBaF5Cb766a75aDc9827EfbB7E41A_DelphiToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0xf5068761511594c82328102f4fde4650ed9ea6c4_WHP.sol                WHP                  transfer             0.991\nINFO:Slither-simil:0x5f9f2ae7150d0beef3bb50ac8d8f4b43e6a6cc57_NABC.sol               NABC                 transfer             0.991\n```\n\n### Train mode\n\nTrain mode trains new models used to vectorize functions. You will need a large amount of contracts/functions if you plan to train a new model.\n\n```\n$ slither-simil train model.bin --input contracts\nINFO:Slither-simil:Saving extracted data into last_data_train.txt\nINFO:Slither-simil:Starting training\nRead 0M words\nNumber of words:  348\nNumber of labels: 0\nProgress: 100.0% words/sec/thread:   53124 lr:  0.000000 loss:  2.066949 ETA:   0h 0m\nINFO:Slither-simil:Training complete\nINFO:Slither-simil:Saving model\nINFO:Slither-simil:Saving cache in cache.npz\nINFO:Slither-simil:Done!\n```\n\nAfter it runs, the `slither-simil` will output the trained model in `model.bin`, a cache of every function for use in test mode in `cache.npz`, and the SlithIR of every function for debugging in `last_data_train.txt`.\n\n### Plot mode\n\nPlot mode plots sets of functions to visually detect clusters of similar ones.\n\nHere's an example to plot all the functions named `add` from contracts named `SafeMath` sampling from 500 random contracts:\n\n```\n$ slither-simil plot etherscan_verified_contracts.bin --fname SafeMath.add --input cache.npz --nsamples 500\nINFO:Slither-simil:Loading data..\nINFO:Slither-simil:Processing data..\nINFO:Slither-simil:Plotting data..\nINFO:Slither-simil:Saving figure to plot.png..\n```\n\n![plot](https://user-images.githubusercontent.com/31542053/57525857-3d794f80-7302-11e9-9677-b4eb3f6a5c20.png)\n\nThis mode performs dimensionality reduction using PCA, so the axes you see here [are **not** associated with any particular unit](https://stats.stackexchange.com/questions/137813/the-meaning-of-units-on-the-axes-of-a-pca-plot).\n\nIt can also be used to plot sets of functions using only a name from any contract (e.g. `burn`) .\n\n### Info mode\n\nThis mode has two features. You can inspect the internal information about a pre-trained model. Info mode is typically used for debugging.\n\n```\n$ slither-simil info etherscan_verified_contracts.bin\nINFO:Slither-simil:etherscan_verified_contracts.bin uses the following words:\nINFO:Slither-simil:</s>\nINFO:Slither-simil:index(uint256)\nINFO:Slither-simil:return\nINFO:Slither-simil:condition(temporary_variable)\nINFO:Slither-simil:member\nINFO:Slither-simil:solidity_call(require(bool))\nINFO:Slither-simil:library_call\nINFO:Slither-simil:binary(+)\nINFO:Slither-simil:event\nINFO:Slither-simil:(local_solc_variable(default)):=(temporary_variable)\n...\n```\n\n... or examine the internal representation of function:\n\n```\n$ slither-simil info etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --solc solc-0.4.25\nINFO:Slither-simil:Function sendCoin in contract MetaCoin is encoded as:\nINFO:Slither-simil:index(uint256) binary(<) condition(temporary_variable) return index(uint256) binary(-) index(uint256) binary(+) event return\nINFO:Slither-simil:[ 0.00689753 -0.05349572 -0.06854086 -0.01667773  0.1259813  -0.05974023\n  0.06719872 -0.04520541  0.13745852  0.14690697 -0.03721125  0.00579037\n  0.06865194 -0.03804035  0.01224702 -0.1014601  -0.02655532 -0.15334933\n...\n```\n","docs/src/tools/ERC-Conformance.md":"# slither-check-erc\n\n`slither-check-erc` checks for ERC's conformance.\n\n## Features\n\n`slither-check-erc` will check that:\n\n- All the functions are present\n- All the events are present\n- Functions return the correct type\n- Functions that must be view are view\n- Events' parameters are correctly indexed\n- The functions emit the events\n- Derived contracts do not break the conformance\n\n## Supported ERCs\n\n- [ERC20](https://eips.ethereum.org/EIPS/eip-20): Token standard\n- [ERC223](https://github.com/ethereum/eips/issues/223): Token standard\n- [ERC777](https://eips.ethereum.org/EIPS/eip-777): Token standard\n- [ERC721](https://eips.ethereum.org/EIPS/eip-721): Non-fungible token standard\n- [ERC165](https://eips.ethereum.org/EIPS/eip-165): Standard interface detection\n- [ERC1155](https://eips.ethereum.org/EIPS/eip-1155): Multi Token Standard\n- [ERC1820](https://eips.ethereum.org/EIPS/eip-1820): Pseudo-introspection registry contract\n- [ERC4524](https://eips.ethereum.org/EIPS/eip-4524): Safer ERC-20\n- [ERC1363](https://eips.ethereum.org/EIPS/eip-1363): Payable Token\n- [ERC2612](https://eips.ethereum.org/EIPS/eip-2612): Permit Extension for EIP-20 Signed Approvals\n- [ERC4626](https://eips.ethereum.org/EIPS/eip-4626): Tokenized Vaults\n\n## Usage\n\n```sh\nslither-check-erc contract.sol ContractName\n```\n\nFor example, on\n\n```solidity\ncontract ERC20{\n\n    event Transfer(address indexed,address,uint256);\n\n    function transfer(address, uint256) public{\n\n        emit Transfer(msg.sender,msg.sender,0);\n    }\n\n}\n```\n\nThe tool will report:\n\n```text\n# Check ERC20\n\n## Check functions\n[ ] totalSupply() is missing\n[ ] balanceOf(address) is missing\n[✓] transfer(address,uint256) is present\n [ ] transfer(address,uint256) -> () should return bool\n [✓] Transfer(address,address,uint256) is emitted\n[ ] transferFrom(address,address,uint256) is missing\n[ ] approve(address,uint256) is missing\n[ ] allowance(address,address) is missing\n[ ] name() is missing (optional)\n[ ] symbol() is missing (optional)\n[ ] decimals() is missing (optional)\n\n## Check events\n[✓] Transfer(address,address,uint256) is present\n [✓] parameter 0 is indexed\n [ ] parameter 1 should be indexed\n[ ] Approval(address,address,uint256) is missing\n```\n","docs/src/tools/Interface.md":"# Slither-interface\n\nGenerates code for a Solidity interface from contract\n\n## Usage\n\nRun `slither-interface <ContractName> <source file or deployment address>`.\n\n## CLI Interface\n\n```shell\npositional arguments:\n  contract_source       The name of the contract (case sensitive) followed by the deployed contract address if verified on etherscan or project directory/filename for local contracts.\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --unroll-structs      Whether to use structures' underlying types instead of the user-defined type\n  --exclude-events      Excludes event signatures in the interface\n  --exclude-errors      Excludes custom error signatures in the interface\n  --exclude-enums       Excludes enum definitions in the interface\n  --exclude-structs     Exclude struct definitions in the interface\n```\n","docs/src/tools/Contract-Flattening.md":"# slither-flat\n\n`slither-flat` produces a flattened version of the codebase.\n\n## Features\n\n- Code flattening\n- Support multiple [strategies](#strategies)\n- Support circular dependency\n- Support all the compilation platforms (Truffle, embark, buidler, etherlime, ...).\n\n## Usage\n\n`slither-flat target`\n\n- `--contract ContractName`: flatten only one contract (standalone file)\n\n### Strategies\n\n`slither-flat` contains three strategies that can be specified with the `--strategy` flag:\n\n- `MostDerived`: Export all the most derived contracts (every file is standalone)\n- `OneFile`: Export all the contracts in one standalone file\n- `LocalImport`: Export every contract in one separate file, and include import \"..\" in their preludes\n\nDefault: `MostDerived`\n\n### Patching\n\n`slither-flat` can transform the codebase to help some usage (eg. [Echidna](https://github.com/crytic/echidna))\n\n- `--convert-external`: convert `external` function to `public`. This is meant to facilitate [Echidna](https://github.com/crytic/echidna) usage.\n- `--contract name`: To flatten only a target contract\n- `--remove-assert`: Remove call to assert().\n\n### Export option\n\n- `--dir DirName`: output directory\n- `--json file.json`: export the results to a json file (`--json -` output to the standard output\n- `--zip file.zip`: export to a ZIP file\n- `--zip-type type`: ZIP compression type (default lzma))\n","CLAUDE.md":"# Slither\n\nStatic analyzer for Solidity smart contracts. Detects vulnerabilities, prints contract information, and provides an intermediate representation (SlithIR) for analysis.\n\n## Architecture\n\n```\nslither/\n├── analyses/      # Data dependency, dominators, control flow\n├── core/          # Core classes: SlitherCore, Contract, Function\n├── detectors/     # Security checks (subclass AbstractDetector)\n├── printers/      # Output formatters (subclass AbstractPrinter)\n├── slithir/       # Intermediate representation for analysis\n├── solc_parsing/  # Solidity AST parsing\n└── tools/         # CLI tools (slither-read-storage, slither-mutate, etc.)\n```\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for detailed architecture and how to add detectors.\n\n## Development\n\n| tool    | purpose       |\n|---------|---------------|\n| `uv`    | deps & venv   |\n| `ruff`  | lint & format |\n| `prek`  | pre-commit hooks |\n| `pytest`| tests         |\n\n```bash\nmake dev                    # Setup dev environment + pre-commit hooks\nmake lint                   # Run ruff check\nmake reformat               # Run ruff format\nmake test                   # Run all tests\npytest tests/unit/ -q       # Fast unit tests only\n```\n\n### Navigating the codebase\n\nUse `rg` for text search and `ast-grep` for structural patterns:\n\n```bash\n# Find class definition\nast-grep --pattern 'class Contract($_): $$$' --lang py slither\n\n# Find all detector implementations\nast-grep --pattern 'class $NAME(AbstractDetector): $$$' --lang py slither/detectors\n\n# Find method usages\nrg \"\\.is_interface\" slither\n\n# Find function signatures\nast-grep --pattern 'def _detect($$$)' --lang py slither/detectors\n\n# Trace imports\nrg \"^from slither\\.core\" slither\n```\n\n## Code Standards\n\n### Philosophy\n- **No speculative features** - Don't add \"might be useful\" functionality\n- **No premature abstraction** - Don't create utilities until you've written the same code three times\n- **Clarity over cleverness** - Prefer explicit, readable code over dense one-liners\n- **Justify new dependencies** - Each dependency is maintenance burden and complexity\n- **Structured output first** - New commands must support `--json`. Human-readable is secondary.\n- **Atomic operations** - Don't bundle decision logic; separate analyze → suggest → apply for composability.\n\n### Code quality\n- **Comments** - Code should be self-documenting. No commented-out code (delete it). No comments that repeat what code does.\n- **Errors** - Fail fast with clear, actionable messages. Include context: what failed, which file/contract, suggested fix. Never swallow exceptions.\n- **When uncertain** - State your assumption and proceed for small decisions. Ask before changes with significant consequences.\n\n### Hard limits\n1. ≤80 lines/function, cyclomatic complexity ≤8\n2. ≤5 positional params, ≤12 branches, ≤6 returns\n3. 100-char line length\n4. No relative (`..`) imports\n5. Tests in `/tests/` mirroring package structure\n\nBash scripts must use strict mode:\n```bash\n#!/bin/bash\nset -euo pipefail\n```\n\n## Working on Code\n\n### Incremental improvement\nWhen modifying a file, improve what you touch. Don't refactor unrelated code—keep PRs focused.\n\nModernization targets:\n- Type hints on function signatures (aspiration: `ty --strict`)\n- `pathlib.Path` over `os.path` string manipulation\n- f-strings over `.format()` or `%` formatting\n- Context managers (`with`) for file/resource handling\n- Early returns to reduce nesting\n- Fix lint issues you encounter\n\n### Git conventions\n- Commit messages: imperative mood, ≤72 char subject (e.g., \"Fix reentrancy false positive\")\n- One logical change per commit\n- Prefix: `fix:`, `feat:`, `refactor:`, `test:`, `docs:` as appropriate\n\n## Testing\n\n- **Mock boundaries, not logic** - Only mock slow things (network, filesystem), non-deterministic things (time), or external services. Don't mock the code you're testing.\n- **Verify tests catch failures** - Temporarily break code to verify the test fails, then fix it.\n\n### Slither-specific\n- Test detectors across Solidity 0.4.x–0.8.x\n- Update snapshots: `tests/e2e/detectors/snapshots/`\n- Use `compile_force_framework=\"solc\"` when crytic-compile behavior changes\n- **Run e2e tests early** when changing core classes (`Literal`, `Expression`, etc.)—snapshots capture exact `__str__` output, so behavioral changes break many tests\n\n## Slither Internals\n\n### APIs\n- Use `contract.is_interface` not `contract.name.startswith(\"I\")`\n- Use `source_mapping.content` for source code access (handles byte/char offsets)\n- Use `is` / `is not` for enum comparisons (`NodeType.X`, not `== NodeType.X`)\n- CLI features should have Python API equivalents in the `Slither` class\n\n### Traversal patterns\n- **Per-definition analysis** (naming, arithmetic, structure): Use `contracts_derived` + `functions_declared`\n- **Reachability analysis** (call graphs, taint): Use `contracts_derived` + `functions` (inherited functions needed)\n- **Global deduplication**: Use `compilation_unit.functions` directly to process each function exactly once\n- Filter by `function.contract_declarer == contract` when iterating `contract.functions`\n- `high_level_calls` returns `List[Tuple[Contract, Call]]` - don't forget tuple unpacking\n\n### Type handling\n- Expand `isinstance()` checks rather than removing assertions\n- Add type guards before accessing type-specific attributes in AST visitors\n- Check local scope before broader scope when resolving identifiers\n- **`ElementaryType` comparison pitfall**: `ElementaryType.__eq__` only matches other `ElementaryType` instances. `ElementaryType(\"uint256\") in [\"uint256\"]` is **always False**. Convert to string first: `str(t) in [\"uint256\"]`\n\n### SlithIR and SSA\n- **Use `node.irs`** for most detectors—simpler, sufficient for most analyses\n- **Use `node.irs_ssa`** only when you need precise data flow (tracking reassignments, taint analysis)\n- SSA variables have `.index` (e.g., `x_0`, `x_1`) and `.non_ssa_version` to get the original\n- `Phi` operations merge SSA versions at control flow joins (if/else, loops)\n- **Data dependency**: Use `is_dependent(var, source, context)` from `slither.analyses.data_dependency`\n\n### Detector quality\nMinimize false positives over catching edge cases. Noisy detectors get disabled. Output must be actionable.\n\n### Docstrings\nDetectors use class attributes, not Google-style docstrings:\n- `WIKI_TITLE`, `WIKI_DESCRIPTION`, `WIKI_EXPLOIT_SCENARIO`, `WIKI_RECOMMENDATION`\n- Must be thorough—agents use these to decide which detectors apply\n- `VULNERABLE_SOLC_VERSIONS` restricts detector to specific compiler versions\n- Use `make_solc_versions(minor, patch_min, patch_max)` helper for version lists\n\n## Notes\n\n**Version verification**: When adding dependencies or CI actions, web search for current stable versions. Training data is stale—never assume a version from memory is current.\n\n---\n\n> Don't push until asked. Don't be hyperbolic in PR writeups.\n","docs/src/tools/Mutator.md":"# Slither-mutate\n\n`slither-mutate` is a mutation testing tool for solidity based smart contracts.\n\n## Quick Start\n\nIn a foundry project with **passing** tests that are run with `forge test`, you can mutate all solidity files in the `src` folder by running the following:\n\n`slither-mutate src --test-cmd='forge test'`\n\nYou can provide flags to `forge` as part of the `--test-cmd` parameter or target a single file path instead of the whole `src` directory, for example:\n\n`slither-mutate src/core/MyContract.sol --test-cmd='forge test --match-contract=\"MyContract\"'`\n\nIf a `timout` flag is not provided, slither-mutate will default to using a value that's double the runtime of it's initial test cmd execution. Make sure you run `forge clean` or similar beforehand to ensure cache usage doesn't cause a timeout that's too short to be used; this could lead to false-negatives.\n\n### CLI Interface\n\n```shell\n$ slither-mutate --help\nusage: slither-mutate <codebase> --test-cmd <test command> <options>\n\nExperimental smart contract mutator. Based on https://arxiv.org/abs/2006.11597\n\npositional arguments:\n  codebase              Codebase to analyze (.sol file, project directory, ...)\n\noptions:\n  -h, --help            show this help message and exit\n  --list-mutators       List available detectors\n  --test-cmd TEST_CMD   Command to run the tests for your project\n  --test-dir TEST_DIR   Tests directory\n  --ignore-dirs IGNORE_DIRS\n                        Directories to ignore\n  --timeout TIMEOUT     Set timeout for test command (by default 2x the initial test runtime)\n  --output-dir OUTPUT_DIR\n                        Name of output directory (by default 'mutation_campaign')\n  -v, --verbose         log mutants that are caught, uncaught, and fail to compile\n  --mutators-to-run MUTATORS_TO_RUN\n                        mutant generators to run\n  --contract-names CONTRACT_NAMES\n                        list of contract names you want to mutate\n  --target-functions TARGET_FUNCTIONS\n                        Comma-separated list of function selectors (hex like\n                        0xa9059cbb or signature like transfer(address,uint256))\n  --comprehensive       continue testing minor mutations if severe mutants are uncaught\n```\n","docs/src/tools/Path-Finding-Utility.md":"# slither-find-paths\n\n`slither-find-paths` finds all the paths that reach a given target.\n\n## Usage\n\n```sh\nslither-find-paths file.sol [contract.function targets]\n```\n\n- `[contract.function targets]` is either one target, or a list of target\n\n## Example\n\nTested on [tests/e2e/printers/possible_paths/paths.sol](https://github.com/crytic/slither/blob/master/tests/e2e/printers/possible_paths/paths.sol)\n\n```sh\n$ slither-find-paths paths.sol A.destination\nTarget functions:\n- A.destination()\n\n\nThe following functions reach the specified targets:\n- A.call()\n- B.call2(A)\n\n\nThe following paths reach the specified targets:\nA.call() -> A.destination()\n\nB.call2(A) -> A.call() -> A.destination()\n```\n","docs/src/tools/README.md":"# Slither Inbuilt Tools\n\nSlither comes with inbuilt tools\n\n| Name                                                | Command-Line                   | What it Does                                                                                                                                                            |\n| --------------------------------------------------- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| [Code Similarity](./Code-Similarity-Detector.md)    | `slither-simil`                | Detects similar Solidity functions/contracts using code similarity analysis. Useful for finding duplicated code, similar vulnerabilities, or analyzing large codebases. |\n| [Contract Flattening](./Contract-Flattening.md)     | `slither-flat`                 | Flattens a Solidity codebase by inlining all imports into a single file. Useful for contract verification on Etherscan or debugging.                                    |\n| [Documentation](./Documentation.md)                 | `slither-doc`                  | Automatically generates documentation for Solidity contracts, including inheritance information, functions, modifiers, and more.                                        |\n| [Doctor](./Doctor.md)                               | `slither-doctor`               | Helps diagnose and fix common issues in your environment that might prevent Slither from working correctly.                                                             |\n| [ERC Conformance](./ERC-Conformance.md)             | `slither-check-erc`            | Validates whether a contract correctly implements various ERC standards (ERC20, ERC721, etc.) by checking required functions and their signatures.                      |\n| [Interface](./Interface.md)                         | `slither-interface`            | Generates Solidity interfaces from contract implementations, useful for creating minimal interfaces for contract interactions.                                          |\n| [Mutator](./Mutator.md)                             | `slither-mutate`               | Performs mutation testing on Solidity contracts by automatically generating variants with small modifications to test suite effectiveness.                              |\n| [Path Finding](./Path-Finding-Utility.md)           | `slither-prop`                 | Analyzes call paths between functions in smart contracts to understand control and data flow.                                                                           |\n| [Property Generation](./Property-generation.md)     | `slither-prop`                 | Automatically generates security properties and unit tests for smart contracts based on their behavior.                                                                 |\n| [Read Storage](./ReadStorage.md)                    | `slither-read-storage`         | Reads contract storage values directly from the blockchain, helping debug deployed contracts.                                                                           |\n| [Format](./Slither-format.md)                       | `slither-format`               | Automatically patch bugs.                                                                                                                                               |\n| [Upgradeability Checks](./Upgradeability-Checks.md) | `slither-check-upgradeability` | Analyzes upgradeable contracts for common issues and vulnerabilities in proxy patterns.                                                                                 |\n","docs/src/tools/Property-generation.md":"`slither-prop` generates code properties (e.g., invariants) that can be tested with unit tests or [Echidna](https://github.com/crytic/echidna/), entirely automatically. Once you have these properties in hand, use [Crytic](https://crytic.io/) to continuously test them with every commit.\n\nNote: `slither-prop` only supports Truffle for now. We'll be adding support for other frameworks soon!\n\n## How to Use Slither's Property Generator\n\nThere are four steps:\n\n1. [Generate the tests](#step-1-generate-the-tests)\n1. [Customize the constructor](#step-2-customize-the-constructor)\n1. [Run the unit tests](#step-3-run-the-unit-tests-with-truffle)\n1. [Run the Echidna tests](#step-4-run-the-property-tests-with-echidna)\n\n### Step 1. Generate the tests\n\n```\nslither-prop . --contract ContractName\n```\n\n`slither-prop` will generate:\n\n- Solidity files containing the properties\n- `echidna_config.yaml` to configure Echidna\n- One Truffle migration file\n- Two Truffle unit-test files\n\nFor example on [examples/slither-prop](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop).\n\n```\nWrite contracts/crytic/interfaces.sol\nWrite contracts/crytic/PropertiesERC20BuggyTransferable.sol\nWrite contracts/crytic/TestERC20BuggyTransferable.sol\nWrite echidna_config.yaml\nWrite migrations/1_TestERC20BuggyTransferable.js\nWrite test/crytic/InitializationTestERC20BuggyTransferable.js\nWrite test/crytic/TestERC20BuggyTransferable.js\n################################################\nUpdate the constructor in contracts/crytic/TestERC20BuggyTransferable.sol\n\nTo run the unit tests:\n truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n truffle test test/crytic/TestERC20BuggyTransferable.js\n\nTo run Echidna:\n  echidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n### Step 2. Customize the constructor\n\nNext, update the constructor in `contracts/crytic/TestX.sol`:\n\nOn [examples/slither-prop/contracts](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop), update the constructor as follow:\n\n```solidity\n constructor() public{\n\n  _balanceOf[crytic_user] = 1 ether;\n  _balanceOf[crytic_owner] = 1 ether;\n  _balanceOf[crytic_attacker] = 1 ether;\n  _totalSupply = 3 ether;\n\n  //\n  //\n  // Update the following if totalSupply and balanceOf are external functions or state variables:\n\n  initialTotalSupply = totalSupply();\n  initialBalance_owner = balanceOf(crytic_owner);\n  initialBalance_user = balanceOf(crytic_user);\n  initialBalance_attacker = balanceOf(crytic_attacker);\n }\n```\n\n### Step 3. Run the unit tests with Truffle\n\nThe first unit test file, named `InitializationX.js` will check that the constructor has been correctly initialized:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n[..]\n  Contract: TestERC20BuggyTransferable\n    ✓ The total supply is correctly initialized. (47ms)\n    ✓ Owner's balance is correctly initialized.\n    ✓ User's balance is correctly initialized.\n    ✓ Attacker's balance is correctly initialized.\n    ✓ All the users have a positive balance. (69ms)\n    ✓ The total supply is the user and owner balance. (38ms)\n\n```\n\nIf all the unit tests passed, run the property tests:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n  Contract: TestERC20BuggyTransferable\n    ✓ The address 0x0 should not receive tokens.\n    ✓ Allowance can be changed. (108ms)\n    ✓ Balance of one user must be less or equal to the total supply. (70ms)\n    ✓ Balance of the crytic users must be less or equal to the total supply.\n    1) No one should be able to send tokens to the address 0x0 (transfer).\n    > No events were emitted\n    2) No one should be able to send tokens to the address 0x0 (transferFrom).\n    > No events were emitted\n    ✓ Self transferFrom works. (115ms)\n    ✓ transferFrom works. (108ms)\n    ✓ Self transfer works. (89ms)\n    ✓ transfer works. (97ms)\n    3) Cannot transfer more than the balance.\n    > No events were emitted\n\n```\n\nAs you can see, the unit tests detect some of the bugs.\n\n### Step 4. Run the property tests with Echidna\n\n```\nechidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n## Scenarios\n\n`slither-prop` contains different scenarios that can be specified with the `--scenario NAME` flag.\n\nHere are the available scenarios:\n\n```\n#################### ERC20 ####################\nTransferable - Test the correct tokens transfer\nPausable - Test the pausable functionality\nNotMintable - Test that no one can mint tokens\nNotMintableNotBurnable - Test that no one can mint or burn tokens\nNotBurnable - Test that no one can burn tokens\nBurnable - Test the burn of tokens. Require the \"burn(address) returns()\" function\n```\n\n## All properties\n\n```\n+-----+-------------------------------------------------------------------------+------------------------+\n| Num |                               Description                               |        Scenario        |\n+-----+-------------------------------------------------------------------------+------------------------+\n|  0  |                The address 0x0 should not receive tokens.               |      Transferable      |\n|  1  |                        Allowance can be changed.                        |      Transferable      |\n|  2  |      Balance of one user must be less or equal to the total supply.     |      Transferable      |\n|  3  |  Balance of the crytic users must be less or equal to the total supply. |      Transferable      |\n|  4  |   No one should be able to send tokens to the address 0x0 (transfer).   |      Transferable      |\n|  5  | No one should be able to send tokens to the address 0x0 (transferFrom). |      Transferable      |\n|  6  |                         Self transferFrom works.                        |      Transferable      |\n|  7  |                           transferFrom works.                           |      Transferable      |\n|  8  |                           Self transfer works.                          |      Transferable      |\n|  9  |                             transfer works.                             |      Transferable      |\n|  10 |                  Cannot transfer more than the balance.                 |      Transferable      |\n|  11 |                             Cannot transfer.                            |        Pausable        |\n|  12 |                       Cannot execute transferFrom.                      |        Pausable        |\n|  13 |                        Cannot change the balance.                       |        Pausable        |\n|  14 |                       Cannot change the allowance.                      |        Pausable        |\n|  15 |                   The total supply does not increase.                   |      NotMintable       |\n|  16 |                    The total supply does not change.                    | NotMintableNotBurnable |\n|  17 |                   The total supply does not decrease.                   |      NotBurnable       |\n|  18 |                   The total supply does not decrease.                   |        Burnable        |\n+-----+-------------------------------------------------------------------------+------------------------+\n```\n","docs/src/tools/ReadStorage.md":"# Tools Skill\n\nPath: `docs/src/tools/ReadStorage.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/ReadStorage.md)","docs/src/tools/Slither-format.md":"# Tools Skill\n\nPath: `docs/src/tools/Slither-format.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Slither-format.md)","docs/src/tools/Upgradeability-Checks.md":"# Tools Skill\n\nPath: `docs/src/tools/Upgradeability-Checks.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Upgradeability-Checks.md)","slither/tools/demo/README.md":"# demo Documentation\n\nPath: `slither/tools/demo/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/demo/README.md)","slither/tools/erc_conformance/README.md":"# erc_conformance Documentation\n\nPath: `slither/tools/erc_conformance/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/erc_conformance/README.md)","tests/tools/check_kspec/safeAdd/spec.md":"# SafeAdd Skill\n\nPath: `tests/tools/check_kspec/safeAdd/spec.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/check_kspec/safeAdd/spec.md)","tests/tools/read-storage/test_data/TEST_storage_layout.json":"# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_storage_layout.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_storage_layout.json)","tests/tools/read-storage/test_data/TEST_unstructured_storage.json":"# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_unstructured_storage.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_unstructured_storage.json)","tests/tools/mutator/test_data/test_source_unit/README.md":"# test_source_unit Documentation\n\nPath: `tests/tools/mutator/test_data/test_source_unit/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/mutator/test_data/test_source_unit/README.md)"},"files":{"docs/src/tools/Adding-a-new-utility.md":"# Adding New Utility\n\nSlither can be used as a library to create new utilities.\nOfficial utils are present in [tools](https://github.com/crytic/slither/tree/master/slither/tools)\n\n## Skeleton\n\nThe skeleton util is present in [tools/demo](https://github.com/crytic/slither/tree/master/slither/tools/demo)\n\n## Integration\n\nTo enable an util from the command-line, update `project.scripts` in [pyproject.toml](https://github.com/crytic/slither/blob/master/pyproject.toml).\nInstalling Slither will then install the util.\n\n## Guidelines\n\n- Favor the `logging` module rather than `print`\n- Favor raising an exception rather than `sys.exit`\n- Add unit-tests (ex: [scripts/travis_test_find_paths.sh](https://github.com/crytic/slither/blob/master/scripts/ci_test_find_paths.sh))\n\n## Getting Help\n\nJoin our [slack channel](https://empireslacking.herokuapp.com/) to get any help (#ethereum).\n","docs/src/tools/Documentation.md":"# slither-documentation\n\n`slither-documentation` uses [codex](https://platform.openai.com) to generate natspec documentation.\n\nThis tool is experimental. See [solmate documentation](https://github.com/montyly/solmate/pull/1) for an example of usage.\n","docs/src/tools/Doctor.md":"# Slither doctor\n\nSlither doctor is a tool designed to troubleshoot running Slither on a project.\n","docs/src/tools/Code-Similarity-Detector.md":"`slither-simil` uses state-of-the-art machine learning to detect similar (vulnerable) Solidity functions. We have provided a pretrained model from [etherscan_verified_contracts](https://github.com/thec00n/etherscan_verified_contracts) with 60,000 contracts and more than 850,000 functions to get you started quickly. We included the capability to easily train new models if you have access to larger or different datasets.\n\n`slither-simil` uses [FastText](https://github.com/facebookresearch/fastText), a vector embedding technique, to generate compact numerical representations of every function. We used FastText because it:\n\n- implements several state-of-the-art techniques such as nbow and skipgrams,\n- has high performance (it is C++ code with Python bindings),\n- has MIT license, and\n- is well maintained (by Facebook).\n\n## Requirements\n\nInstall the required packages before using `slither-simil`:\n\n```\npip3 install pybind11 --user\npip3 install https://github.com/facebookresearch/fastText/archive/0.2.0.zip --user\npip3 install sklearn matplotlib --user # for plot mode\n```\n\nMake sure that you are using `pip3.6` or later. If you are running from inside a [virtualenv](https://virtualenv.pypa.io/en/latest/), remove the `--user` parameter.\n\n## Usage\n\nNote that these examples will use the following files:\n\n- [etherscan_verified_contracts.bin](https://drive.google.com/file/d/1oEhbIL4V9582Y5VKp4iiOURGq8qa4cBN/view?usp=sharing)\n- [cache.npz](https://drive.google.com/file/d/1vpwusbyzLn1JqqAvlFivHXtLvsEp0VqX/view?usp=sharing)\n- [MetaCoin.sol](https://github.com/crytic/slither/wiki/MetacoinExample)\n\n`slither-simil` has three modes:\n\n- `test` - finds similar functions to your own in a dataset of contracts\n- `plot` - provide a visual representation of similarity of multiple sampled functions\n- `train` - builds new models of large datasets of contracts\n- `info` - inspects the internal information of the pre-trained model or the assessed code\n\n### Test mode\n\nThis mode transforms a function into a vector and uses it to find similar functions.\n\nTest mode requires the following parameters:\n\n1. A pre-trained model: this file will be used to transform every function into a vector, you can [train your own](#train-mode) or [use our pre-trained one (etherscan_verified_contracts.bin)](#usage).\n2. A contract filename: this file will contain the code that you want to compare,\n3. A function name (e.g. `SafeMath.add` or `add`),\n4. An input directory or file: this can be either a directory with contracts or a [cache file with a pre-computed list of vectors for every contract (cache.npz)](#usage).\n\nUse the cache to avoid long processing times to compile and vectorize the input contracts.\n\nHere's an example that finds functions similar to `sendCoin` in `MetaCoin` (compiled with `solc-0.4.25`). Searching for similar functions among more than 800,000 functions takes only 20 seconds.\n\n```\n$ slither-simil test etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --input cache.npz --ntop 25 --solc solc-0.4.25\nINFO:Slither-simil:Reviewed 825062 functions, listing the 25 most similar ones:\nINFO:Slither-simil:filename                                                          contract             function             score\nINFO:Slither-simil:0x954b5de09a55e59755acbda29e1eb74a45d30175_Fluz.sol               Fluz                 transfer             1.0\nINFO:Slither-simil:0x55648de19836338549130b1af587f16bea46f66b_Pebbles.sol            Pebbles              transfer             1.0\nINFO:Slither-simil:0x3fcee23add6e86dde3c4d395cbce1cae7f16d06d_SnipCoin.sol           SnipCoin             sendCoin             1.0\nINFO:Slither-simil:0x000000005fbe2cc9b1b684ec445caf176042348e_ProperProposal.sol     Vote                 transfer             1.0\nINFO:Slither-simil:0x000000002bb43c83ece652d161ad0fa862129a2c_AccountRegistry.sol    Vote                 transfer             1.0\nINFO:Slither-simil:0x4e84e9e5fb0a972628cf4568c403167ef1d40431_Fluzcoin.sol           Fluzcoin             transfer             1.0\nINFO:Slither-simil:0x334eec1482109bd802d9e72a447848de3bcc1063_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x28ccdda197d319a241005b9c9f01bac48b90f556_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x000000002647e16d9bab9e46604d75591d289277_Vote.sol               Vote                 transfer             1.0\nINFO:Slither-simil:0xc6c4c7826D44ABF22c711E8E86bDC3f5242d2182_token.sol              token                sendCoin             1.0\nINFO:Slither-simil:0x22033df1d104736ff4c2b23a28affe52863ca9c8_AtmOnlyFluzcoin.sol    AtmOnlyFluzcoin      transfer             1.0\nINFO:Slither-simil:0xcad796d6a2c0bb1de7f24262819be96fb08c1c3a_Love.sol               Love                 transfer             1.0\nINFO:Slither-simil:0x6cb2b8dc6a508c9a21db9683d1a729715969a6ee_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0xd75fefe3cdb647281eec3f8fc738e3bc9658f9e4_ProofOfReadToken.sol   ProofOfReadToken     transfer             0.996\nINFO:Slither-simil:0x7A8Ef7E8c8f16B9D6F39069ce03d752Af23b46d6_OBS_V1.sol             MyObs                transfer             0.996\nINFO:Slither-simil:0x5ac0197c944c961f58bb02f3d0df58a74fdc15b6_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transfer             0.996\nINFO:Slither-simil:0x3d8a10ce3228cb428cb56baa058d4432464ea25d_TestToken.sol          TestToken            transfer             0.993\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transferFrom         0.992\nINFO:Slither-simil:0x486e1f44b2a85150a6dd2de5aab87df375cd8880_CAIRToken.sol          StandardToken        transfer             0.991\nINFO:Slither-simil:0x2bec16b164725efc192b7ec0296f838c61317514_eda.sol                StandardToken        transfer             0.991\nINFO:Slither-simil:0xb7cb1c96db6b22b0d3d9536e0108d062bd488f74_WaltonToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0x346c3be6aebEBaF5Cb766a75aDc9827EfbB7E41A_DelphiToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0xf5068761511594c82328102f4fde4650ed9ea6c4_WHP.sol                WHP                  transfer             0.991\nINFO:Slither-simil:0x5f9f2ae7150d0beef3bb50ac8d8f4b43e6a6cc57_NABC.sol               NABC                 transfer             0.991\n```\n\n### Train mode\n\nTrain mode trains new models used to vectorize functions. You will need a large amount of contracts/functions if you plan to train a new model.\n\n```\n$ slither-simil train model.bin --input contracts\nINFO:Slither-simil:Saving extracted data into last_data_train.txt\nINFO:Slither-simil:Starting training\nRead 0M words\nNumber of words:  348\nNumber of labels: 0\nProgress: 100.0% words/sec/thread:   53124 lr:  0.000000 loss:  2.066949 ETA:   0h 0m\nINFO:Slither-simil:Training complete\nINFO:Slither-simil:Saving model\nINFO:Slither-simil:Saving cache in cache.npz\nINFO:Slither-simil:Done!\n```\n\nAfter it runs, the `slither-simil` will output the trained model in `model.bin`, a cache of every function for use in test mode in `cache.npz`, and the SlithIR of every function for debugging in `last_data_train.txt`.\n\n### Plot mode\n\nPlot mode plots sets of functions to visually detect clusters of similar ones.\n\nHere's an example to plot all the functions named `add` from contracts named `SafeMath` sampling from 500 random contracts:\n\n```\n$ slither-simil plot etherscan_verified_contracts.bin --fname SafeMath.add --input cache.npz --nsamples 500\nINFO:Slither-simil:Loading data..\nINFO:Slither-simil:Processing data..\nINFO:Slither-simil:Plotting data..\nINFO:Slither-simil:Saving figure to plot.png..\n```\n\n![plot](https://user-images.githubusercontent.com/31542053/57525857-3d794f80-7302-11e9-9677-b4eb3f6a5c20.png)\n\nThis mode performs dimensionality reduction using PCA, so the axes you see here [are **not** associated with any particular unit](https://stats.stackexchange.com/questions/137813/the-meaning-of-units-on-the-axes-of-a-pca-plot).\n\nIt can also be used to plot sets of functions using only a name from any contract (e.g. `burn`) .\n\n### Info mode\n\nThis mode has two features. You can inspect the internal information about a pre-trained model. Info mode is typically used for debugging.\n\n```\n$ slither-simil info etherscan_verified_contracts.bin\nINFO:Slither-simil:etherscan_verified_contracts.bin uses the following words:\nINFO:Slither-simil:</s>\nINFO:Slither-simil:index(uint256)\nINFO:Slither-simil:return\nINFO:Slither-simil:condition(temporary_variable)\nINFO:Slither-simil:member\nINFO:Slither-simil:solidity_call(require(bool))\nINFO:Slither-simil:library_call\nINFO:Slither-simil:binary(+)\nINFO:Slither-simil:event\nINFO:Slither-simil:(local_solc_variable(default)):=(temporary_variable)\n...\n```\n\n... or examine the internal representation of function:\n\n```\n$ slither-simil info etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --solc solc-0.4.25\nINFO:Slither-simil:Function sendCoin in contract MetaCoin is encoded as:\nINFO:Slither-simil:index(uint256) binary(<) condition(temporary_variable) return index(uint256) binary(-) index(uint256) binary(+) event return\nINFO:Slither-simil:[ 0.00689753 -0.05349572 -0.06854086 -0.01667773  0.1259813  -0.05974023\n  0.06719872 -0.04520541  0.13745852  0.14690697 -0.03721125  0.00579037\n  0.06865194 -0.03804035  0.01224702 -0.1014601  -0.02655532 -0.15334933\n...\n```\n","docs/src/tools/ERC-Conformance.md":"# slither-check-erc\n\n`slither-check-erc` checks for ERC's conformance.\n\n## Features\n\n`slither-check-erc` will check that:\n\n- All the functions are present\n- All the events are present\n- Functions return the correct type\n- Functions that must be view are view\n- Events' parameters are correctly indexed\n- The functions emit the events\n- Derived contracts do not break the conformance\n\n## Supported ERCs\n\n- [ERC20](https://eips.ethereum.org/EIPS/eip-20): Token standard\n- [ERC223](https://github.com/ethereum/eips/issues/223): Token standard\n- [ERC777](https://eips.ethereum.org/EIPS/eip-777): Token standard\n- [ERC721](https://eips.ethereum.org/EIPS/eip-721): Non-fungible token standard\n- [ERC165](https://eips.ethereum.org/EIPS/eip-165): Standard interface detection\n- [ERC1155](https://eips.ethereum.org/EIPS/eip-1155): Multi Token Standard\n- [ERC1820](https://eips.ethereum.org/EIPS/eip-1820): Pseudo-introspection registry contract\n- [ERC4524](https://eips.ethereum.org/EIPS/eip-4524): Safer ERC-20\n- [ERC1363](https://eips.ethereum.org/EIPS/eip-1363): Payable Token\n- [ERC2612](https://eips.ethereum.org/EIPS/eip-2612): Permit Extension for EIP-20 Signed Approvals\n- [ERC4626](https://eips.ethereum.org/EIPS/eip-4626): Tokenized Vaults\n\n## Usage\n\n```sh\nslither-check-erc contract.sol ContractName\n```\n\nFor example, on\n\n```solidity\ncontract ERC20{\n\n    event Transfer(address indexed,address,uint256);\n\n    function transfer(address, uint256) public{\n\n        emit Transfer(msg.sender,msg.sender,0);\n    }\n\n}\n```\n\nThe tool will report:\n\n```text\n# Check ERC20\n\n## Check functions\n[ ] totalSupply() is missing\n[ ] balanceOf(address) is missing\n[✓] transfer(address,uint256) is present\n [ ] transfer(address,uint256) -> () should return bool\n [✓] Transfer(address,address,uint256) is emitted\n[ ] transferFrom(address,address,uint256) is missing\n[ ] approve(address,uint256) is missing\n[ ] allowance(address,address) is missing\n[ ] name() is missing (optional)\n[ ] symbol() is missing (optional)\n[ ] decimals() is missing (optional)\n\n## Check events\n[✓] Transfer(address,address,uint256) is present\n [✓] parameter 0 is indexed\n [ ] parameter 1 should be indexed\n[ ] Approval(address,address,uint256) is missing\n```\n","docs/src/tools/Interface.md":"# Slither-interface\n\nGenerates code for a Solidity interface from contract\n\n## Usage\n\nRun `slither-interface <ContractName> <source file or deployment address>`.\n\n## CLI Interface\n\n```shell\npositional arguments:\n  contract_source       The name of the contract (case sensitive) followed by the deployed contract address if verified on etherscan or project directory/filename for local contracts.\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --unroll-structs      Whether to use structures' underlying types instead of the user-defined type\n  --exclude-events      Excludes event signatures in the interface\n  --exclude-errors      Excludes custom error signatures in the interface\n  --exclude-enums       Excludes enum definitions in the interface\n  --exclude-structs     Exclude struct definitions in the interface\n```\n","docs/src/tools/Contract-Flattening.md":"# slither-flat\n\n`slither-flat` produces a flattened version of the codebase.\n\n## Features\n\n- Code flattening\n- Support multiple [strategies](#strategies)\n- Support circular dependency\n- Support all the compilation platforms (Truffle, embark, buidler, etherlime, ...).\n\n## Usage\n\n`slither-flat target`\n\n- `--contract ContractName`: flatten only one contract (standalone file)\n\n### Strategies\n\n`slither-flat` contains three strategies that can be specified with the `--strategy` flag:\n\n- `MostDerived`: Export all the most derived contracts (every file is standalone)\n- `OneFile`: Export all the contracts in one standalone file\n- `LocalImport`: Export every contract in one separate file, and include import \"..\" in their preludes\n\nDefault: `MostDerived`\n\n### Patching\n\n`slither-flat` can transform the codebase to help some usage (eg. [Echidna](https://github.com/crytic/echidna))\n\n- `--convert-external`: convert `external` function to `public`. This is meant to facilitate [Echidna](https://github.com/crytic/echidna) usage.\n- `--contract name`: To flatten only a target contract\n- `--remove-assert`: Remove call to assert().\n\n### Export option\n\n- `--dir DirName`: output directory\n- `--json file.json`: export the results to a json file (`--json -` output to the standard output\n- `--zip file.zip`: export to a ZIP file\n- `--zip-type type`: ZIP compression type (default lzma))\n","CLAUDE.md":"# Slither\n\nStatic analyzer for Solidity smart contracts. Detects vulnerabilities, prints contract information, and provides an intermediate representation (SlithIR) for analysis.\n\n## Architecture\n\n```\nslither/\n├── analyses/      # Data dependency, dominators, control flow\n├── core/          # Core classes: SlitherCore, Contract, Function\n├── detectors/     # Security checks (subclass AbstractDetector)\n├── printers/      # Output formatters (subclass AbstractPrinter)\n├── slithir/       # Intermediate representation for analysis\n├── solc_parsing/  # Solidity AST parsing\n└── tools/         # CLI tools (slither-read-storage, slither-mutate, etc.)\n```\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for detailed architecture and how to add detectors.\n\n## Development\n\n| tool    | purpose       |\n|---------|---------------|\n| `uv`    | deps & venv   |\n| `ruff`  | lint & format |\n| `prek`  | pre-commit hooks |\n| `pytest`| tests         |\n\n```bash\nmake dev                    # Setup dev environment + pre-commit hooks\nmake lint                   # Run ruff check\nmake reformat               # Run ruff format\nmake test                   # Run all tests\npytest tests/unit/ -q       # Fast unit tests only\n```\n\n### Navigating the codebase\n\nUse `rg` for text search and `ast-grep` for structural patterns:\n\n```bash\n# Find class definition\nast-grep --pattern 'class Contract($_): $$$' --lang py slither\n\n# Find all detector implementations\nast-grep --pattern 'class $NAME(AbstractDetector): $$$' --lang py slither/detectors\n\n# Find method usages\nrg \"\\.is_interface\" slither\n\n# Find function signatures\nast-grep --pattern 'def _detect($$$)' --lang py slither/detectors\n\n# Trace imports\nrg \"^from slither\\.core\" slither\n```\n\n## Code Standards\n\n### Philosophy\n- **No speculative features** - Don't add \"might be useful\" functionality\n- **No premature abstraction** - Don't create utilities until you've written the same code three times\n- **Clarity over cleverness** - Prefer explicit, readable code over dense one-liners\n- **Justify new dependencies** - Each dependency is maintenance burden and complexity\n- **Structured output first** - New commands must support `--json`. Human-readable is secondary.\n- **Atomic operations** - Don't bundle decision logic; separate analyze → suggest → apply for composability.\n\n### Code quality\n- **Comments** - Code should be self-documenting. No commented-out code (delete it). No comments that repeat what code does.\n- **Errors** - Fail fast with clear, actionable messages. Include context: what failed, which file/contract, suggested fix. Never swallow exceptions.\n- **When uncertain** - State your assumption and proceed for small decisions. Ask before changes with significant consequences.\n\n### Hard limits\n1. ≤80 lines/function, cyclomatic complexity ≤8\n2. ≤5 positional params, ≤12 branches, ≤6 returns\n3. 100-char line length\n4. No relative (`..`) imports\n5. Tests in `/tests/` mirroring package structure\n\nBash scripts must use strict mode:\n```bash\n#!/bin/bash\nset -euo pipefail\n```\n\n## Working on Code\n\n### Incremental improvement\nWhen modifying a file, improve what you touch. Don't refactor unrelated code—keep PRs focused.\n\nModernization targets:\n- Type hints on function signatures (aspiration: `ty --strict`)\n- `pathlib.Path` over `os.path` string manipulation\n- f-strings over `.format()` or `%` formatting\n- Context managers (`with`) for file/resource handling\n- Early returns to reduce nesting\n- Fix lint issues you encounter\n\n### Git conventions\n- Commit messages: imperative mood, ≤72 char subject (e.g., \"Fix reentrancy false positive\")\n- One logical change per commit\n- Prefix: `fix:`, `feat:`, `refactor:`, `test:`, `docs:` as appropriate\n\n## Testing\n\n- **Mock boundaries, not logic** - Only mock slow things (network, filesystem), non-deterministic things (time), or external services. Don't mock the code you're testing.\n- **Verify tests catch failures** - Temporarily break code to verify the test fails, then fix it.\n\n### Slither-specific\n- Test detectors across Solidity 0.4.x–0.8.x\n- Update snapshots: `tests/e2e/detectors/snapshots/`\n- Use `compile_force_framework=\"solc\"` when crytic-compile behavior changes\n- **Run e2e tests early** when changing core classes (`Literal`, `Expression`, etc.)—snapshots capture exact `__str__` output, so behavioral changes break many tests\n\n## Slither Internals\n\n### APIs\n- Use `contract.is_interface` not `contract.name.startswith(\"I\")`\n- Use `source_mapping.content` for source code access (handles byte/char offsets)\n- Use `is` / `is not` for enum comparisons (`NodeType.X`, not `== NodeType.X`)\n- CLI features should have Python API equivalents in the `Slither` class\n\n### Traversal patterns\n- **Per-definition analysis** (naming, arithmetic, structure): Use `contracts_derived` + `functions_declared`\n- **Reachability analysis** (call graphs, taint): Use `contracts_derived` + `functions` (inherited functions needed)\n- **Global deduplication**: Use `compilation_unit.functions` directly to process each function exactly once\n- Filter by `function.contract_declarer == contract` when iterating `contract.functions`\n- `high_level_calls` returns `List[Tuple[Contract, Call]]` - don't forget tuple unpacking\n\n### Type handling\n- Expand `isinstance()` checks rather than removing assertions\n- Add type guards before accessing type-specific attributes in AST visitors\n- Check local scope before broader scope when resolving identifiers\n- **`ElementaryType` comparison pitfall**: `ElementaryType.__eq__` only matches other `ElementaryType` instances. `ElementaryType(\"uint256\") in [\"uint256\"]` is **always False**. Convert to string first: `str(t) in [\"uint256\"]`\n\n### SlithIR and SSA\n- **Use `node.irs`** for most detectors—simpler, sufficient for most analyses\n- **Use `node.irs_ssa`** only when you need precise data flow (tracking reassignments, taint analysis)\n- SSA variables have `.index` (e.g., `x_0`, `x_1`) and `.non_ssa_version` to get the original\n- `Phi` operations merge SSA versions at control flow joins (if/else, loops)\n- **Data dependency**: Use `is_dependent(var, source, context)` from `slither.analyses.data_dependency`\n\n### Detector quality\nMinimize false positives over catching edge cases. Noisy detectors get disabled. Output must be actionable.\n\n### Docstrings\nDetectors use class attributes, not Google-style docstrings:\n- `WIKI_TITLE`, `WIKI_DESCRIPTION`, `WIKI_EXPLOIT_SCENARIO`, `WIKI_RECOMMENDATION`\n- Must be thorough—agents use these to decide which detectors apply\n- `VULNERABLE_SOLC_VERSIONS` restricts detector to specific compiler versions\n- Use `make_solc_versions(minor, patch_min, patch_max)` helper for version lists\n\n## Notes\n\n**Version verification**: When adding dependencies or CI actions, web search for current stable versions. Training data is stale—never assume a version from memory is current.\n\n---\n\n> Don't push until asked. Don't be hyperbolic in PR writeups.\n","docs/src/tools/Mutator.md":"# Slither-mutate\n\n`slither-mutate` is a mutation testing tool for solidity based smart contracts.\n\n## Quick Start\n\nIn a foundry project with **passing** tests that are run with `forge test`, you can mutate all solidity files in the `src` folder by running the following:\n\n`slither-mutate src --test-cmd='forge test'`\n\nYou can provide flags to `forge` as part of the `--test-cmd` parameter or target a single file path instead of the whole `src` directory, for example:\n\n`slither-mutate src/core/MyContract.sol --test-cmd='forge test --match-contract=\"MyContract\"'`\n\nIf a `timout` flag is not provided, slither-mutate will default to using a value that's double the runtime of it's initial test cmd execution. Make sure you run `forge clean` or similar beforehand to ensure cache usage doesn't cause a timeout that's too short to be used; this could lead to false-negatives.\n\n### CLI Interface\n\n```shell\n$ slither-mutate --help\nusage: slither-mutate <codebase> --test-cmd <test command> <options>\n\nExperimental smart contract mutator. Based on https://arxiv.org/abs/2006.11597\n\npositional arguments:\n  codebase              Codebase to analyze (.sol file, project directory, ...)\n\noptions:\n  -h, --help            show this help message and exit\n  --list-mutators       List available detectors\n  --test-cmd TEST_CMD   Command to run the tests for your project\n  --test-dir TEST_DIR   Tests directory\n  --ignore-dirs IGNORE_DIRS\n                        Directories to ignore\n  --timeout TIMEOUT     Set timeout for test command (by default 2x the initial test runtime)\n  --output-dir OUTPUT_DIR\n                        Name of output directory (by default 'mutation_campaign')\n  -v, --verbose         log mutants that are caught, uncaught, and fail to compile\n  --mutators-to-run MUTATORS_TO_RUN\n                        mutant generators to run\n  --contract-names CONTRACT_NAMES\n                        list of contract names you want to mutate\n  --target-functions TARGET_FUNCTIONS\n                        Comma-separated list of function selectors (hex like\n                        0xa9059cbb or signature like transfer(address,uint256))\n  --comprehensive       continue testing minor mutations if severe mutants are uncaught\n```\n","docs/src/tools/Path-Finding-Utility.md":"# slither-find-paths\n\n`slither-find-paths` finds all the paths that reach a given target.\n\n## Usage\n\n```sh\nslither-find-paths file.sol [contract.function targets]\n```\n\n- `[contract.function targets]` is either one target, or a list of target\n\n## Example\n\nTested on [tests/e2e/printers/possible_paths/paths.sol](https://github.com/crytic/slither/blob/master/tests/e2e/printers/possible_paths/paths.sol)\n\n```sh\n$ slither-find-paths paths.sol A.destination\nTarget functions:\n- A.destination()\n\n\nThe following functions reach the specified targets:\n- A.call()\n- B.call2(A)\n\n\nThe following paths reach the specified targets:\nA.call() -> A.destination()\n\nB.call2(A) -> A.call() -> A.destination()\n```\n","docs/src/tools/README.md":"# Slither Inbuilt Tools\n\nSlither comes with inbuilt tools\n\n| Name                                                | Command-Line                   | What it Does                                                                                                                                                            |\n| --------------------------------------------------- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| [Code Similarity](./Code-Similarity-Detector.md)    | `slither-simil`                | Detects similar Solidity functions/contracts using code similarity analysis. Useful for finding duplicated code, similar vulnerabilities, or analyzing large codebases. |\n| [Contract Flattening](./Contract-Flattening.md)     | `slither-flat`                 | Flattens a Solidity codebase by inlining all imports into a single file. Useful for contract verification on Etherscan or debugging.                                    |\n| [Documentation](./Documentation.md)                 | `slither-doc`                  | Automatically generates documentation for Solidity contracts, including inheritance information, functions, modifiers, and more.                                        |\n| [Doctor](./Doctor.md)                               | `slither-doctor`               | Helps diagnose and fix common issues in your environment that might prevent Slither from working correctly.                                                             |\n| [ERC Conformance](./ERC-Conformance.md)             | `slither-check-erc`            | Validates whether a contract correctly implements various ERC standards (ERC20, ERC721, etc.) by checking required functions and their signatures.                      |\n| [Interface](./Interface.md)                         | `slither-interface`            | Generates Solidity interfaces from contract implementations, useful for creating minimal interfaces for contract interactions.                                          |\n| [Mutator](./Mutator.md)                             | `slither-mutate`               | Performs mutation testing on Solidity contracts by automatically generating variants with small modifications to test suite effectiveness.                              |\n| [Path Finding](./Path-Finding-Utility.md)           | `slither-prop`                 | Analyzes call paths between functions in smart contracts to understand control and data flow.                                                                           |\n| [Property Generation](./Property-generation.md)     | `slither-prop`                 | Automatically generates security properties and unit tests for smart contracts based on their behavior.                                                                 |\n| [Read Storage](./ReadStorage.md)                    | `slither-read-storage`         | Reads contract storage values directly from the blockchain, helping debug deployed contracts.                                                                           |\n| [Format](./Slither-format.md)                       | `slither-format`               | Automatically patch bugs.                                                                                                                                               |\n| [Upgradeability Checks](./Upgradeability-Checks.md) | `slither-check-upgradeability` | Analyzes upgradeable contracts for common issues and vulnerabilities in proxy patterns.                                                                                 |\n","docs/src/tools/Property-generation.md":"`slither-prop` generates code properties (e.g., invariants) that can be tested with unit tests or [Echidna](https://github.com/crytic/echidna/), entirely automatically. Once you have these properties in hand, use [Crytic](https://crytic.io/) to continuously test them with every commit.\n\nNote: `slither-prop` only supports Truffle for now. We'll be adding support for other frameworks soon!\n\n## How to Use Slither's Property Generator\n\nThere are four steps:\n\n1. [Generate the tests](#step-1-generate-the-tests)\n1. [Customize the constructor](#step-2-customize-the-constructor)\n1. [Run the unit tests](#step-3-run-the-unit-tests-with-truffle)\n1. [Run the Echidna tests](#step-4-run-the-property-tests-with-echidna)\n\n### Step 1. Generate the tests\n\n```\nslither-prop . --contract ContractName\n```\n\n`slither-prop` will generate:\n\n- Solidity files containing the properties\n- `echidna_config.yaml` to configure Echidna\n- One Truffle migration file\n- Two Truffle unit-test files\n\nFor example on [examples/slither-prop](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop).\n\n```\nWrite contracts/crytic/interfaces.sol\nWrite contracts/crytic/PropertiesERC20BuggyTransferable.sol\nWrite contracts/crytic/TestERC20BuggyTransferable.sol\nWrite echidna_config.yaml\nWrite migrations/1_TestERC20BuggyTransferable.js\nWrite test/crytic/InitializationTestERC20BuggyTransferable.js\nWrite test/crytic/TestERC20BuggyTransferable.js\n################################################\nUpdate the constructor in contracts/crytic/TestERC20BuggyTransferable.sol\n\nTo run the unit tests:\n truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n truffle test test/crytic/TestERC20BuggyTransferable.js\n\nTo run Echidna:\n  echidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n### Step 2. Customize the constructor\n\nNext, update the constructor in `contracts/crytic/TestX.sol`:\n\nOn [examples/slither-prop/contracts](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop), update the constructor as follow:\n\n```solidity\n constructor() public{\n\n  _balanceOf[crytic_user] = 1 ether;\n  _balanceOf[crytic_owner] = 1 ether;\n  _balanceOf[crytic_attacker] = 1 ether;\n  _totalSupply = 3 ether;\n\n  //\n  //\n  // Update the following if totalSupply and balanceOf are external functions or state variables:\n\n  initialTotalSupply = totalSupply();\n  initialBalance_owner = balanceOf(crytic_owner);\n  initialBalance_user = balanceOf(crytic_user);\n  initialBalance_attacker = balanceOf(crytic_attacker);\n }\n```\n\n### Step 3. Run the unit tests with Truffle\n\nThe first unit test file, named `InitializationX.js` will check that the constructor has been correctly initialized:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n[..]\n  Contract: TestERC20BuggyTransferable\n    ✓ The total supply is correctly initialized. (47ms)\n    ✓ Owner's balance is correctly initialized.\n    ✓ User's balance is correctly initialized.\n    ✓ Attacker's balance is correctly initialized.\n    ✓ All the users have a positive balance. (69ms)\n    ✓ The total supply is the user and owner balance. (38ms)\n\n```\n\nIf all the unit tests passed, run the property tests:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n  Contract: TestERC20BuggyTransferable\n    ✓ The address 0x0 should not receive tokens.\n    ✓ Allowance can be changed. (108ms)\n    ✓ Balance of one user must be less or equal to the total supply. (70ms)\n    ✓ Balance of the crytic users must be less or equal to the total supply.\n    1) No one should be able to send tokens to the address 0x0 (transfer).\n    > No events were emitted\n    2) No one should be able to send tokens to the address 0x0 (transferFrom).\n    > No events were emitted\n    ✓ Self transferFrom works. (115ms)\n    ✓ transferFrom works. (108ms)\n    ✓ Self transfer works. (89ms)\n    ✓ transfer works. (97ms)\n    3) Cannot transfer more than the balance.\n    > No events were emitted\n\n```\n\nAs you can see, the unit tests detect some of the bugs.\n\n### Step 4. Run the property tests with Echidna\n\n```\nechidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n## Scenarios\n\n`slither-prop` contains different scenarios that can be specified with the `--scenario NAME` flag.\n\nHere are the available scenarios:\n\n```\n#################### ERC20 ####################\nTransferable - Test the correct tokens transfer\nPausable - Test the pausable functionality\nNotMintable - Test that no one can mint tokens\nNotMintableNotBurnable - Test that no one can mint or burn tokens\nNotBurnable - Test that no one can burn tokens\nBurnable - Test the burn of tokens. Require the \"burn(address) returns()\" function\n```\n\n## All properties\n\n```\n+-----+-------------------------------------------------------------------------+------------------------+\n| Num |                               Description                               |        Scenario        |\n+-----+-------------------------------------------------------------------------+------------------------+\n|  0  |                The address 0x0 should not receive tokens.               |      Transferable      |\n|  1  |                        Allowance can be changed.                        |      Transferable      |\n|  2  |      Balance of one user must be less or equal to the total supply.     |      Transferable      |\n|  3  |  Balance of the crytic users must be less or equal to the total supply. |      Transferable      |\n|  4  |   No one should be able to send tokens to the address 0x0 (transfer).   |      Transferable      |\n|  5  | No one should be able to send tokens to the address 0x0 (transferFrom). |      Transferable      |\n|  6  |                         Self transferFrom works.                        |      Transferable      |\n|  7  |                           transferFrom works.                           |      Transferable      |\n|  8  |                           Self transfer works.                          |      Transferable      |\n|  9  |                             transfer works.                             |      Transferable      |\n|  10 |                  Cannot transfer more than the balance.                 |      Transferable      |\n|  11 |                             Cannot transfer.                            |        Pausable        |\n|  12 |                       Cannot execute transferFrom.                      |        Pausable        |\n|  13 |                        Cannot change the balance.                       |        Pausable        |\n|  14 |                       Cannot change the allowance.                      |        Pausable        |\n|  15 |                   The total supply does not increase.                   |      NotMintable       |\n|  16 |                    The total supply does not change.                    | NotMintableNotBurnable |\n|  17 |                   The total supply does not decrease.                   |      NotBurnable       |\n|  18 |                   The total supply does not decrease.                   |        Burnable        |\n+-----+-------------------------------------------------------------------------+------------------------+\n```\n","docs/src/tools/ReadStorage.md":"# Tools Skill\n\nPath: `docs/src/tools/ReadStorage.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/ReadStorage.md)","docs/src/tools/Slither-format.md":"# Tools Skill\n\nPath: `docs/src/tools/Slither-format.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Slither-format.md)","docs/src/tools/Upgradeability-Checks.md":"# Tools Skill\n\nPath: `docs/src/tools/Upgradeability-Checks.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Upgradeability-Checks.md)","slither/tools/demo/README.md":"# demo Documentation\n\nPath: `slither/tools/demo/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/demo/README.md)","slither/tools/erc_conformance/README.md":"# erc_conformance Documentation\n\nPath: `slither/tools/erc_conformance/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/erc_conformance/README.md)","tests/tools/check_kspec/safeAdd/spec.md":"# SafeAdd Skill\n\nPath: `tests/tools/check_kspec/safeAdd/spec.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/check_kspec/safeAdd/spec.md)","tests/tools/read-storage/test_data/TEST_storage_layout.json":"# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_storage_layout.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_storage_layout.json)","tests/tools/read-storage/test_data/TEST_unstructured_storage.json":"# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_unstructured_storage.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_unstructured_storage.json)","tests/tools/mutator/test_data/test_source_unit/README.md":"# test_source_unit Documentation\n\nPath: `tests/tools/mutator/test_data/test_source_unit/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/mutator/test_data/test_source_unit/README.md)"},"items":[{"name":"Adding-a-new-utility.md","path":"docs/src/tools/Adding-a-new-utility.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Adding-a-new-utility.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Adding New Utility\n\nSlither can be used as a library to create new utilities.\nOfficial utils are present in [tools](https://github.com/crytic/slither/tree/master/slither/tools)\n\n## Skeleton\n\nThe skeleton util is present in [tools/demo](https://github.com/crytic/slither/tree/master/slither/tools/demo)\n\n## Integration\n\nTo enable an util from the command-line, update `project.scripts` in [pyproject.toml](https://github.com/crytic/slither/blob/master/pyproject.toml).\nInstalling Slither will then install the util.\n\n## Guidelines\n\n- Favor the `logging` module rather than `print`\n- Favor raising an exception rather than `sys.exit`\n- Add unit-tests (ex: [scripts/travis_test_find_paths.sh](https://github.com/crytic/slither/blob/master/scripts/ci_test_find_paths.sh))\n\n## Getting Help\n\nJoin our [slack channel](https://empireslacking.herokuapp.com/) to get any help (#ethereum).\n","isInternal":false,"tokens":207,"sizeBytes":881},{"name":"Code-Similarity-Detector.md","path":"docs/src/tools/Code-Similarity-Detector.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Code-Similarity-Detector.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"`slither-simil` uses state-of-the-art machine learning to detect similar (vulnerable) Solidity functions. We have provided a pretrained model from [etherscan_verified_contracts](https://github.com/thec00n/etherscan_verified_contracts) with 60,000 contracts and more than 850,000 functions to get you started quickly. We included the capability to easily train new models if you have access to larger or different datasets.\n\n`slither-simil` uses [FastText](https://github.com/facebookresearch/fastText), a vector embedding technique, to generate compact numerical representations of every function. We used FastText because it:\n\n- implements several state-of-the-art techniques such as nbow and skipgrams,\n- has high performance (it is C++ code with Python bindings),\n- has MIT license, and\n- is well maintained (by Facebook).\n\n## Requirements\n\nInstall the required packages before using `slither-simil`:\n\n```\npip3 install pybind11 --user\npip3 install https://github.com/facebookresearch/fastText/archive/0.2.0.zip --user\npip3 install sklearn matplotlib --user # for plot mode\n```\n\nMake sure that you are using `pip3.6` or later. If you are running from inside a [virtualenv](https://virtualenv.pypa.io/en/latest/), remove the `--user` parameter.\n\n## Usage\n\nNote that these examples will use the following files:\n\n- [etherscan_verified_contracts.bin](https://drive.google.com/file/d/1oEhbIL4V9582Y5VKp4iiOURGq8qa4cBN/view?usp=sharing)\n- [cache.npz](https://drive.google.com/file/d/1vpwusbyzLn1JqqAvlFivHXtLvsEp0VqX/view?usp=sharing)\n- [MetaCoin.sol](https://github.com/crytic/slither/wiki/MetacoinExample)\n\n`slither-simil` has three modes:\n\n- `test` - finds similar functions to your own in a dataset of contracts\n- `plot` - provide a visual representation of similarity of multiple sampled functions\n- `train` - builds new models of large datasets of contracts\n- `info` - inspects the internal information of the pre-trained model or the assessed code\n\n### Test mode\n\nThis mode transforms a function into a vector and uses it to find similar functions.\n\nTest mode requires the following parameters:\n\n1. A pre-trained model: this file will be used to transform every function into a vector, you can [train your own](#train-mode) or [use our pre-trained one (etherscan_verified_contracts.bin)](#usage).\n2. A contract filename: this file will contain the code that you want to compare,\n3. A function name (e.g. `SafeMath.add` or `add`),\n4. An input directory or file: this can be either a directory with contracts or a [cache file with a pre-computed list of vectors for every contract (cache.npz)](#usage).\n\nUse the cache to avoid long processing times to compile and vectorize the input contracts.\n\nHere's an example that finds functions similar to `sendCoin` in `MetaCoin` (compiled with `solc-0.4.25`). Searching for similar functions among more than 800,000 functions takes only 20 seconds.\n\n```\n$ slither-simil test etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --input cache.npz --ntop 25 --solc solc-0.4.25\nINFO:Slither-simil:Reviewed 825062 functions, listing the 25 most similar ones:\nINFO:Slither-simil:filename                                                          contract             function             score\nINFO:Slither-simil:0x954b5de09a55e59755acbda29e1eb74a45d30175_Fluz.sol               Fluz                 transfer             1.0\nINFO:Slither-simil:0x55648de19836338549130b1af587f16bea46f66b_Pebbles.sol            Pebbles              transfer             1.0\nINFO:Slither-simil:0x3fcee23add6e86dde3c4d395cbce1cae7f16d06d_SnipCoin.sol           SnipCoin             sendCoin             1.0\nINFO:Slither-simil:0x000000005fbe2cc9b1b684ec445caf176042348e_ProperProposal.sol     Vote                 transfer             1.0\nINFO:Slither-simil:0x000000002bb43c83ece652d161ad0fa862129a2c_AccountRegistry.sol    Vote                 transfer             1.0\nINFO:Slither-simil:0x4e84e9e5fb0a972628cf4568c403167ef1d40431_Fluzcoin.sol           Fluzcoin             transfer             1.0\nINFO:Slither-simil:0x334eec1482109bd802d9e72a447848de3bcc1063_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x28ccdda197d319a241005b9c9f01bac48b90f556_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x000000002647e16d9bab9e46604d75591d289277_Vote.sol               Vote                 transfer             1.0\nINFO:Slither-simil:0xc6c4c7826D44ABF22c711E8E86bDC3f5242d2182_token.sol              token                sendCoin             1.0\nINFO:Slither-simil:0x22033df1d104736ff4c2b23a28affe52863ca9c8_AtmOnlyFluzcoin.sol    AtmOnlyFluzcoin      transfer             1.0\nINFO:Slither-simil:0xcad796d6a2c0bb1de7f24262819be96fb08c1c3a_Love.sol               Love                 transfer             1.0\nINFO:Slither-simil:0x6cb2b8dc6a508c9a21db9683d1a729715969a6ee_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0xd75fefe3cdb647281eec3f8fc738e3bc9658f9e4_ProofOfReadToken.sol   ProofOfReadToken     transfer             0.996\nINFO:Slither-simil:0x7A8Ef7E8c8f16B9D6F39069ce03d752Af23b46d6_OBS_V1.sol             MyObs                transfer             0.996\nINFO:Slither-simil:0x5ac0197c944c961f58bb02f3d0df58a74fdc15b6_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transfer             0.996\nINFO:Slither-simil:0x3d8a10ce3228cb428cb56baa058d4432464ea25d_TestToken.sol          TestToken            transfer             0.993\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transferFrom         0.992\nINFO:Slither-simil:0x486e1f44b2a85150a6dd2de5aab87df375cd8880_CAIRToken.sol          StandardToken        transfer             0.991\nINFO:Slither-simil:0x2bec16b164725efc192b7ec0296f838c61317514_eda.sol                StandardToken        transfer             0.991\nINFO:Slither-simil:0xb7cb1c96db6b22b0d3d9536e0108d062bd488f74_WaltonToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0x346c3be6aebEBaF5Cb766a75aDc9827EfbB7E41A_DelphiToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0xf5068761511594c82328102f4fde4650ed9ea6c4_WHP.sol                WHP                  transfer             0.991\nINFO:Slither-simil:0x5f9f2ae7150d0beef3bb50ac8d8f4b43e6a6cc57_NABC.sol               NABC                 transfer             0.991\n```\n\n### Train mode\n\nTrain mode trains new models used to vectorize functions. You will need a large amount of contracts/functions if you plan to train a new model.\n\n```\n$ slither-simil train model.bin --input contracts\nINFO:Slither-simil:Saving extracted data into last_data_train.txt\nINFO:Slither-simil:Starting training\nRead 0M words\nNumber of words:  348\nNumber of labels: 0\nProgress: 100.0% words/sec/thread:   53124 lr:  0.000000 loss:  2.066949 ETA:   0h 0m\nINFO:Slither-simil:Training complete\nINFO:Slither-simil:Saving model\nINFO:Slither-simil:Saving cache in cache.npz\nINFO:Slither-simil:Done!\n```\n\nAfter it runs, the `slither-simil` will output the trained model in `model.bin`, a cache of every function for use in test mode in `cache.npz`, and the SlithIR of every function for debugging in `last_data_train.txt`.\n\n### Plot mode\n\nPlot mode plots sets of functions to visually detect clusters of similar ones.\n\nHere's an example to plot all the functions named `add` from contracts named `SafeMath` sampling from 500 random contracts:\n\n```\n$ slither-simil plot etherscan_verified_contracts.bin --fname SafeMath.add --input cache.npz --nsamples 500\nINFO:Slither-simil:Loading data..\nINFO:Slither-simil:Processing data..\nINFO:Slither-simil:Plotting data..\nINFO:Slither-simil:Saving figure to plot.png..\n```\n\n![plot](https://user-images.githubusercontent.com/31542053/57525857-3d794f80-7302-11e9-9677-b4eb3f6a5c20.png)\n\nThis mode performs dimensionality reduction using PCA, so the axes you see here [are **not** associated with any particular unit](https://stats.stackexchange.com/questions/137813/the-meaning-of-units-on-the-axes-of-a-pca-plot).\n\nIt can also be used to plot sets of functions using only a name from any contract (e.g. `burn`) .\n\n### Info mode\n\nThis mode has two features. You can inspect the internal information about a pre-trained model. Info mode is typically used for debugging.\n\n```\n$ slither-simil info etherscan_verified_contracts.bin\nINFO:Slither-simil:etherscan_verified_contracts.bin uses the following words:\nINFO:Slither-simil:</s>\nINFO:Slither-simil:index(uint256)\nINFO:Slither-simil:return\nINFO:Slither-simil:condition(temporary_variable)\nINFO:Slither-simil:member\nINFO:Slither-simil:solidity_call(require(bool))\nINFO:Slither-simil:library_call\nINFO:Slither-simil:binary(+)\nINFO:Slither-simil:event\nINFO:Slither-simil:(local_solc_variable(default)):=(temporary_variable)\n...\n```\n\n... or examine the internal representation of function:\n\n```\n$ slither-simil info etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --solc solc-0.4.25\nINFO:Slither-simil:Function sendCoin in contract MetaCoin is encoded as:\nINFO:Slither-simil:index(uint256) binary(<) condition(temporary_variable) return index(uint256) binary(-) index(uint256) binary(+) event return\nINFO:Slither-simil:[ 0.00689753 -0.05349572 -0.06854086 -0.01667773  0.1259813  -0.05974023\n  0.06719872 -0.04520541  0.13745852  0.14690697 -0.03721125  0.00579037\n  0.06865194 -0.03804035  0.01224702 -0.1014601  -0.02655532 -0.15334933\n...\n```\n","isInternal":false,"tokens":2926,"sizeBytes":9632},{"name":"Contract-Flattening.md","path":"docs/src/tools/Contract-Flattening.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Contract-Flattening.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# slither-flat\n\n`slither-flat` produces a flattened version of the codebase.\n\n## Features\n\n- Code flattening\n- Support multiple [strategies](#strategies)\n- Support circular dependency\n- Support all the compilation platforms (Truffle, embark, buidler, etherlime, ...).\n\n## Usage\n\n`slither-flat target`\n\n- `--contract ContractName`: flatten only one contract (standalone file)\n\n### Strategies\n\n`slither-flat` contains three strategies that can be specified with the `--strategy` flag:\n\n- `MostDerived`: Export all the most derived contracts (every file is standalone)\n- `OneFile`: Export all the contracts in one standalone file\n- `LocalImport`: Export every contract in one separate file, and include import \"..\" in their preludes\n\nDefault: `MostDerived`\n\n### Patching\n\n`slither-flat` can transform the codebase to help some usage (eg. [Echidna](https://github.com/crytic/echidna))\n\n- `--convert-external`: convert `external` function to `public`. This is meant to facilitate [Echidna](https://github.com/crytic/echidna) usage.\n- `--contract name`: To flatten only a target contract\n- `--remove-assert`: Remove call to assert().\n\n### Export option\n\n- `--dir DirName`: output directory\n- `--json file.json`: export the results to a json file (`--json -` output to the standard output\n- `--zip file.zip`: export to a ZIP file\n- `--zip-type type`: ZIP compression type (default lzma))\n","isInternal":false,"tokens":346,"sizeBytes":1381},{"name":"Doctor.md","path":"docs/src/tools/Doctor.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Doctor.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Slither doctor\n\nSlither doctor is a tool designed to troubleshoot running Slither on a project.\n","isInternal":false,"tokens":22,"sizeBytes":98},{"name":"Documentation.md","path":"docs/src/tools/Documentation.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Documentation.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# slither-documentation\n\n`slither-documentation` uses [codex](https://platform.openai.com) to generate natspec documentation.\n\nThis tool is experimental. See [solmate documentation](https://github.com/montyly/solmate/pull/1) for an example of usage.\n","isInternal":false,"tokens":64,"sizeBytes":250},{"name":"ERC-Conformance.md","path":"docs/src/tools/ERC-Conformance.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/ERC-Conformance.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# slither-check-erc\n\n`slither-check-erc` checks for ERC's conformance.\n\n## Features\n\n`slither-check-erc` will check that:\n\n- All the functions are present\n- All the events are present\n- Functions return the correct type\n- Functions that must be view are view\n- Events' parameters are correctly indexed\n- The functions emit the events\n- Derived contracts do not break the conformance\n\n## Supported ERCs\n\n- [ERC20](https://eips.ethereum.org/EIPS/eip-20): Token standard\n- [ERC223](https://github.com/ethereum/eips/issues/223): Token standard\n- [ERC777](https://eips.ethereum.org/EIPS/eip-777): Token standard\n- [ERC721](https://eips.ethereum.org/EIPS/eip-721): Non-fungible token standard\n- [ERC165](https://eips.ethereum.org/EIPS/eip-165): Standard interface detection\n- [ERC1155](https://eips.ethereum.org/EIPS/eip-1155): Multi Token Standard\n- [ERC1820](https://eips.ethereum.org/EIPS/eip-1820): Pseudo-introspection registry contract\n- [ERC4524](https://eips.ethereum.org/EIPS/eip-4524): Safer ERC-20\n- [ERC1363](https://eips.ethereum.org/EIPS/eip-1363): Payable Token\n- [ERC2612](https://eips.ethereum.org/EIPS/eip-2612): Permit Extension for EIP-20 Signed Approvals\n- [ERC4626](https://eips.ethereum.org/EIPS/eip-4626): Tokenized Vaults\n\n## Usage\n\n```sh\nslither-check-erc contract.sol ContractName\n```\n\nFor example, on\n\n```solidity\ncontract ERC20{\n\n    event Transfer(address indexed,address,uint256);\n\n    function transfer(address, uint256) public{\n\n        emit Transfer(msg.sender,msg.sender,0);\n    }\n\n}\n```\n\nThe tool will report:\n\n```text\n# Check ERC20\n\n## Check functions\n[ ] totalSupply() is missing\n[ ] balanceOf(address) is missing\n[✓] transfer(address,uint256) is present\n [ ] transfer(address,uint256) -> () should return bool\n [✓] Transfer(address,address,uint256) is emitted\n[ ] transferFrom(address,address,uint256) is missing\n[ ] approve(address,uint256) is missing\n[ ] allowance(address,address) is missing\n[ ] name() is missing (optional)\n[ ] symbol() is missing (optional)\n[ ] decimals() is missing (optional)\n\n## Check events\n[✓] Transfer(address,address,uint256) is present\n [✓] parameter 0 is indexed\n [ ] parameter 1 should be indexed\n[ ] Approval(address,address,uint256) is missing\n```\n","isInternal":false,"tokens":615,"sizeBytes":2223},{"name":"Interface.md","path":"docs/src/tools/Interface.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Interface.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Slither-interface\n\nGenerates code for a Solidity interface from contract\n\n## Usage\n\nRun `slither-interface <ContractName> <source file or deployment address>`.\n\n## CLI Interface\n\n```shell\npositional arguments:\n  contract_source       The name of the contract (case sensitive) followed by the deployed contract address if verified on etherscan or project directory/filename for local contracts.\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --unroll-structs      Whether to use structures' underlying types instead of the user-defined type\n  --exclude-events      Excludes event signatures in the interface\n  --exclude-errors      Excludes custom error signatures in the interface\n  --exclude-enums       Excludes enum definitions in the interface\n  --exclude-structs     Exclude struct definitions in the interface\n```\n","isInternal":false,"tokens":176,"sizeBytes":854},{"name":"Mutator.md","path":"docs/src/tools/Mutator.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Mutator.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Slither-mutate\n\n`slither-mutate` is a mutation testing tool for solidity based smart contracts.\n\n## Quick Start\n\nIn a foundry project with **passing** tests that are run with `forge test`, you can mutate all solidity files in the `src` folder by running the following:\n\n`slither-mutate src --test-cmd='forge test'`\n\nYou can provide flags to `forge` as part of the `--test-cmd` parameter or target a single file path instead of the whole `src` directory, for example:\n\n`slither-mutate src/core/MyContract.sol --test-cmd='forge test --match-contract=\"MyContract\"'`\n\nIf a `timout` flag is not provided, slither-mutate will default to using a value that's double the runtime of it's initial test cmd execution. Make sure you run `forge clean` or similar beforehand to ensure cache usage doesn't cause a timeout that's too short to be used; this could lead to false-negatives.\n\n### CLI Interface\n\n```shell\n$ slither-mutate --help\nusage: slither-mutate <codebase> --test-cmd <test command> <options>\n\nExperimental smart contract mutator. Based on https://arxiv.org/abs/2006.11597\n\npositional arguments:\n  codebase              Codebase to analyze (.sol file, project directory, ...)\n\noptions:\n  -h, --help            show this help message and exit\n  --list-mutators       List available detectors\n  --test-cmd TEST_CMD   Command to run the tests for your project\n  --test-dir TEST_DIR   Tests directory\n  --ignore-dirs IGNORE_DIRS\n                        Directories to ignore\n  --timeout TIMEOUT     Set timeout for test command (by default 2x the initial test runtime)\n  --output-dir OUTPUT_DIR\n                        Name of output directory (by default 'mutation_campaign')\n  -v, --verbose         log mutants that are caught, uncaught, and fail to compile\n  --mutators-to-run MUTATORS_TO_RUN\n                        mutant generators to run\n  --contract-names CONTRACT_NAMES\n                        list of contract names you want to mutate\n  --target-functions TARGET_FUNCTIONS\n                        Comma-separated list of function selectors (hex like\n                        0xa9059cbb or signature like transfer(address,uint256))\n  --comprehensive       continue testing minor mutations if severe mutants are uncaught\n```\n","isInternal":false,"tokens":515,"sizeBytes":2231},{"name":"Path-Finding-Utility.md","path":"docs/src/tools/Path-Finding-Utility.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Path-Finding-Utility.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# slither-find-paths\n\n`slither-find-paths` finds all the paths that reach a given target.\n\n## Usage\n\n```sh\nslither-find-paths file.sol [contract.function targets]\n```\n\n- `[contract.function targets]` is either one target, or a list of target\n\n## Example\n\nTested on [tests/e2e/printers/possible_paths/paths.sol](https://github.com/crytic/slither/blob/master/tests/e2e/printers/possible_paths/paths.sol)\n\n```sh\n$ slither-find-paths paths.sol A.destination\nTarget functions:\n- A.destination()\n\n\nThe following functions reach the specified targets:\n- A.call()\n- B.call2(A)\n\n\nThe following paths reach the specified targets:\nA.call() -> A.destination()\n\nB.call2(A) -> A.call() -> A.destination()\n```\n","isInternal":false,"tokens":175,"sizeBytes":695},{"name":"Property-generation.md","path":"docs/src/tools/Property-generation.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Property-generation.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"`slither-prop` generates code properties (e.g., invariants) that can be tested with unit tests or [Echidna](https://github.com/crytic/echidna/), entirely automatically. Once you have these properties in hand, use [Crytic](https://crytic.io/) to continuously test them with every commit.\n\nNote: `slither-prop` only supports Truffle for now. We'll be adding support for other frameworks soon!\n\n## How to Use Slither's Property Generator\n\nThere are four steps:\n\n1. [Generate the tests](#step-1-generate-the-tests)\n1. [Customize the constructor](#step-2-customize-the-constructor)\n1. [Run the unit tests](#step-3-run-the-unit-tests-with-truffle)\n1. [Run the Echidna tests](#step-4-run-the-property-tests-with-echidna)\n\n### Step 1. Generate the tests\n\n```\nslither-prop . --contract ContractName\n```\n\n`slither-prop` will generate:\n\n- Solidity files containing the properties\n- `echidna_config.yaml` to configure Echidna\n- One Truffle migration file\n- Two Truffle unit-test files\n\nFor example on [examples/slither-prop](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop).\n\n```\nWrite contracts/crytic/interfaces.sol\nWrite contracts/crytic/PropertiesERC20BuggyTransferable.sol\nWrite contracts/crytic/TestERC20BuggyTransferable.sol\nWrite echidna_config.yaml\nWrite migrations/1_TestERC20BuggyTransferable.js\nWrite test/crytic/InitializationTestERC20BuggyTransferable.js\nWrite test/crytic/TestERC20BuggyTransferable.js\n################################################\nUpdate the constructor in contracts/crytic/TestERC20BuggyTransferable.sol\n\nTo run the unit tests:\n truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n truffle test test/crytic/TestERC20BuggyTransferable.js\n\nTo run Echidna:\n  echidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n### Step 2. Customize the constructor\n\nNext, update the constructor in `contracts/crytic/TestX.sol`:\n\nOn [examples/slither-prop/contracts](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop), update the constructor as follow:\n\n```solidity\n constructor() public{\n\n  _balanceOf[crytic_user] = 1 ether;\n  _balanceOf[crytic_owner] = 1 ether;\n  _balanceOf[crytic_attacker] = 1 ether;\n  _totalSupply = 3 ether;\n\n  //\n  //\n  // Update the following if totalSupply and balanceOf are external functions or state variables:\n\n  initialTotalSupply = totalSupply();\n  initialBalance_owner = balanceOf(crytic_owner);\n  initialBalance_user = balanceOf(crytic_user);\n  initialBalance_attacker = balanceOf(crytic_attacker);\n }\n```\n\n### Step 3. Run the unit tests with Truffle\n\nThe first unit test file, named `InitializationX.js` will check that the constructor has been correctly initialized:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n[..]\n  Contract: TestERC20BuggyTransferable\n    ✓ The total supply is correctly initialized. (47ms)\n    ✓ Owner's balance is correctly initialized.\n    ✓ User's balance is correctly initialized.\n    ✓ Attacker's balance is correctly initialized.\n    ✓ All the users have a positive balance. (69ms)\n    ✓ The total supply is the user and owner balance. (38ms)\n\n```\n\nIf all the unit tests passed, run the property tests:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n  Contract: TestERC20BuggyTransferable\n    ✓ The address 0x0 should not receive tokens.\n    ✓ Allowance can be changed. (108ms)\n    ✓ Balance of one user must be less or equal to the total supply. (70ms)\n    ✓ Balance of the crytic users must be less or equal to the total supply.\n    1) No one should be able to send tokens to the address 0x0 (transfer).\n    > No events were emitted\n    2) No one should be able to send tokens to the address 0x0 (transferFrom).\n    > No events were emitted\n    ✓ Self transferFrom works. (115ms)\n    ✓ transferFrom works. (108ms)\n    ✓ Self transfer works. (89ms)\n    ✓ transfer works. (97ms)\n    3) Cannot transfer more than the balance.\n    > No events were emitted\n\n```\n\nAs you can see, the unit tests detect some of the bugs.\n\n### Step 4. Run the property tests with Echidna\n\n```\nechidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n## Scenarios\n\n`slither-prop` contains different scenarios that can be specified with the `--scenario NAME` flag.\n\nHere are the available scenarios:\n\n```\n#################### ERC20 ####################\nTransferable - Test the correct tokens transfer\nPausable - Test the pausable functionality\nNotMintable - Test that no one can mint tokens\nNotMintableNotBurnable - Test that no one can mint or burn tokens\nNotBurnable - Test that no one can burn tokens\nBurnable - Test the burn of tokens. Require the \"burn(address) returns()\" function\n```\n\n## All properties\n\n```\n+-----+-------------------------------------------------------------------------+------------------------+\n| Num |                               Description                               |        Scenario        |\n+-----+-------------------------------------------------------------------------+------------------------+\n|  0  |                The address 0x0 should not receive tokens.               |      Transferable      |\n|  1  |                        Allowance can be changed.                        |      Transferable      |\n|  2  |      Balance of one user must be less or equal to the total supply.     |      Transferable      |\n|  3  |  Balance of the crytic users must be less or equal to the total supply. |      Transferable      |\n|  4  |   No one should be able to send tokens to the address 0x0 (transfer).   |      Transferable      |\n|  5  | No one should be able to send tokens to the address 0x0 (transferFrom). |      Transferable      |\n|  6  |                         Self transferFrom works.                        |      Transferable      |\n|  7  |                           transferFrom works.                           |      Transferable      |\n|  8  |                           Self transfer works.                          |      Transferable      |\n|  9  |                             transfer works.                             |      Transferable      |\n|  10 |                  Cannot transfer more than the balance.                 |      Transferable      |\n|  11 |                             Cannot transfer.                            |        Pausable        |\n|  12 |                       Cannot execute transferFrom.                      |        Pausable        |\n|  13 |                        Cannot change the balance.                       |        Pausable        |\n|  14 |                       Cannot change the allowance.                      |        Pausable        |\n|  15 |                   The total supply does not increase.                   |      NotMintable       |\n|  16 |                    The total supply does not change.                    | NotMintableNotBurnable |\n|  17 |                   The total supply does not decrease.                   |      NotBurnable       |\n|  18 |                   The total supply does not decrease.                   |        Burnable        |\n+-----+-------------------------------------------------------------------------+------------------------+\n```\n","isInternal":false,"tokens":1709,"sizeBytes":7300},{"name":"ReadStorage.md","path":"docs/src/tools/ReadStorage.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/ReadStorage.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Tools Skill\n\nPath: `docs/src/tools/ReadStorage.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/ReadStorage.md)","tokens":300,"sizeBytes":167},{"name":"Slither-format.md","path":"docs/src/tools/Slither-format.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Slither-format.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Tools Skill\n\nPath: `docs/src/tools/Slither-format.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Slither-format.md)","tokens":300,"sizeBytes":173},{"name":"Upgradeability-Checks.md","path":"docs/src/tools/Upgradeability-Checks.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Upgradeability-Checks.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"# Tools Skill\n\nPath: `docs/src/tools/Upgradeability-Checks.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Upgradeability-Checks.md)","tokens":300,"sizeBytes":187},{"name":"spec.md","path":"tests/tools/check_kspec/safeAdd/spec.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/check_kspec/safeAdd/spec.md","title":"SafeAdd Skill","category":"anthropic-skill","format":"markdown","content":"# SafeAdd Skill\n\nPath: `tests/tools/check_kspec/safeAdd/spec.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/check_kspec/safeAdd/spec.md)","tokens":300,"sizeBytes":189},{"name":"TEST_storage_layout.json","path":"tests/tools/read-storage/test_data/TEST_storage_layout.json","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_storage_layout.json","title":"Test_data Skill","category":"anthropic-skill","format":"json","content":"# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_storage_layout.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_storage_layout.json)","tokens":300,"sizeBytes":231},{"name":"TEST_unstructured_storage.json","path":"tests/tools/read-storage/test_data/TEST_unstructured_storage.json","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_unstructured_storage.json","title":"Test_data Skill","category":"anthropic-skill","format":"json","content":"# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_unstructured_storage.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_unstructured_storage.json)","tokens":300,"sizeBytes":243},{"name":"CLAUDE.md","path":"CLAUDE.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/CLAUDE.md","title":"Claude Agent Guidelines & System Prompt","category":"claude-rule","format":"markdown","content":"# Slither\n\nStatic analyzer for Solidity smart contracts. Detects vulnerabilities, prints contract information, and provides an intermediate representation (SlithIR) for analysis.\n\n## Architecture\n\n```\nslither/\n├── analyses/      # Data dependency, dominators, control flow\n├── core/          # Core classes: SlitherCore, Contract, Function\n├── detectors/     # Security checks (subclass AbstractDetector)\n├── printers/      # Output formatters (subclass AbstractPrinter)\n├── slithir/       # Intermediate representation for analysis\n├── solc_parsing/  # Solidity AST parsing\n└── tools/         # CLI tools (slither-read-storage, slither-mutate, etc.)\n```\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for detailed architecture and how to add detectors.\n\n## Development\n\n| tool    | purpose       |\n|---------|---------------|\n| `uv`    | deps & venv   |\n| `ruff`  | lint & format |\n| `prek`  | pre-commit hooks |\n| `pytest`| tests         |\n\n```bash\nmake dev                    # Setup dev environment + pre-commit hooks\nmake lint                   # Run ruff check\nmake reformat               # Run ruff format\nmake test                   # Run all tests\npytest tests/unit/ -q       # Fast unit tests only\n```\n\n### Navigating the codebase\n\nUse `rg` for text search and `ast-grep` for structural patterns:\n\n```bash\n# Find class definition\nast-grep --pattern 'class Contract($_): $$$' --lang py slither\n\n# Find all detector implementations\nast-grep --pattern 'class $NAME(AbstractDetector): $$$' --lang py slither/detectors\n\n# Find method usages\nrg \"\\.is_interface\" slither\n\n# Find function signatures\nast-grep --pattern 'def _detect($$$)' --lang py slither/detectors\n\n# Trace imports\nrg \"^from slither\\.core\" slither\n```\n\n## Code Standards\n\n### Philosophy\n- **No speculative features** - Don't add \"might be useful\" functionality\n- **No premature abstraction** - Don't create utilities until you've written the same code three times\n- **Clarity over cleverness** - Prefer explicit, readable code over dense one-liners\n- **Justify new dependencies** - Each dependency is maintenance burden and complexity\n- **Structured output first** - New commands must support `--json`. Human-readable is secondary.\n- **Atomic operations** - Don't bundle decision logic; separate analyze → suggest → apply for composability.\n\n### Code quality\n- **Comments** - Code should be self-documenting. No commented-out code (delete it). No comments that repeat what code does.\n- **Errors** - Fail fast with clear, actionable messages. Include context: what failed, which file/contract, suggested fix. Never swallow exceptions.\n- **When uncertain** - State your assumption and proceed for small decisions. Ask before changes with significant consequences.\n\n### Hard limits\n1. ≤80 lines/function, cyclomatic complexity ≤8\n2. ≤5 positional params, ≤12 branches, ≤6 returns\n3. 100-char line length\n4. No relative (`..`) imports\n5. Tests in `/tests/` mirroring package structure\n\nBash scripts must use strict mode:\n```bash\n#!/bin/bash\nset -euo pipefail\n```\n\n## Working on Code\n\n### Incremental improvement\nWhen modifying a file, improve what you touch. Don't refactor unrelated code—keep PRs focused.\n\nModernization targets:\n- Type hints on function signatures (aspiration: `ty --strict`)\n- `pathlib.Path` over `os.path` string manipulation\n- f-strings over `.format()` or `%` formatting\n- Context managers (`with`) for file/resource handling\n- Early returns to reduce nesting\n- Fix lint issues you encounter\n\n### Git conventions\n- Commit messages: imperative mood, ≤72 char subject (e.g., \"Fix reentrancy false positive\")\n- One logical change per commit\n- Prefix: `fix:`, `feat:`, `refactor:`, `test:`, `docs:` as appropriate\n\n## Testing\n\n- **Mock boundaries, not logic** - Only mock slow things (network, filesystem), non-deterministic things (time), or external services. Don't mock the code you're testing.\n- **Verify tests catch failures** - Temporarily break code to verify the test fails, then fix it.\n\n### Slither-specific\n- Test detectors across Solidity 0.4.x–0.8.x\n- Update snapshots: `tests/e2e/detectors/snapshots/`\n- Use `compile_force_framework=\"solc\"` when crytic-compile behavior changes\n- **Run e2e tests early** when changing core classes (`Literal`, `Expression`, etc.)—snapshots capture exact `__str__` output, so behavioral changes break many tests\n\n## Slither Internals\n\n### APIs\n- Use `contract.is_interface` not `contract.name.startswith(\"I\")`\n- Use `source_mapping.content` for source code access (handles byte/char offsets)\n- Use `is` / `is not` for enum comparisons (`NodeType.X`, not `== NodeType.X`)\n- CLI features should have Python API equivalents in the `Slither` class\n\n### Traversal patterns\n- **Per-definition analysis** (naming, arithmetic, structure): Use `contracts_derived` + `functions_declared`\n- **Reachability analysis** (call graphs, taint): Use `contracts_derived` + `functions` (inherited functions needed)\n- **Global deduplication**: Use `compilation_unit.functions` directly to process each function exactly once\n- Filter by `function.contract_declarer == contract` when iterating `contract.functions`\n- `high_level_calls` returns `List[Tuple[Contract, Call]]` - don't forget tuple unpacking\n\n### Type handling\n- Expand `isinstance()` checks rather than removing assertions\n- Add type guards before accessing type-specific attributes in AST visitors\n- Check local scope before broader scope when resolving identifiers\n- **`ElementaryType` comparison pitfall**: `ElementaryType.__eq__` only matches other `ElementaryType` instances. `ElementaryType(\"uint256\") in [\"uint256\"]` is **always False**. Convert to string first: `str(t) in [\"uint256\"]`\n\n### SlithIR and SSA\n- **Use `node.irs`** for most detectors—simpler, sufficient for most analyses\n- **Use `node.irs_ssa`** only when you need precise data flow (tracking reassignments, taint analysis)\n- SSA variables have `.index` (e.g., `x_0`, `x_1`) and `.non_ssa_version` to get the original\n- `Phi` operations merge SSA versions at control flow joins (if/else, loops)\n- **Data dependency**: Use `is_dependent(var, source, context)` from `slither.analyses.data_dependency`\n\n### Detector quality\nMinimize false positives over catching edge cases. Noisy detectors get disabled. Output must be actionable.\n\n### Docstrings\nDetectors use class attributes, not Google-style docstrings:\n- `WIKI_TITLE`, `WIKI_DESCRIPTION`, `WIKI_EXPLOIT_SCENARIO`, `WIKI_RECOMMENDATION`\n- Must be thorough—agents use these to decide which detectors apply\n- `VULNERABLE_SOLC_VERSIONS` restricts detector to specific compiler versions\n- Use `make_solc_versions(minor, patch_min, patch_max)` helper for version lists\n\n## Notes\n\n**Version verification**: When adding dependencies or CI actions, web search for current stable versions. Training data is stale—never assume a version from memory is current.\n\n---\n\n> Don't push until asked. Don't be hyperbolic in PR writeups.\n","isInternal":false,"tokens":1675,"sizeBytes":6978},{"name":"README.md","path":"docs/src/tools/README.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/README.md","title":"tools Documentation","category":"plugin-manifest","format":"markdown","content":"# Slither Inbuilt Tools\n\nSlither comes with inbuilt tools\n\n| Name                                                | Command-Line                   | What it Does                                                                                                                                                            |\n| --------------------------------------------------- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| [Code Similarity](./Code-Similarity-Detector.md)    | `slither-simil`                | Detects similar Solidity functions/contracts using code similarity analysis. Useful for finding duplicated code, similar vulnerabilities, or analyzing large codebases. |\n| [Contract Flattening](./Contract-Flattening.md)     | `slither-flat`                 | Flattens a Solidity codebase by inlining all imports into a single file. Useful for contract verification on Etherscan or debugging.                                    |\n| [Documentation](./Documentation.md)                 | `slither-doc`                  | Automatically generates documentation for Solidity contracts, including inheritance information, functions, modifiers, and more.                                        |\n| [Doctor](./Doctor.md)                               | `slither-doctor`               | Helps diagnose and fix common issues in your environment that might prevent Slither from working correctly.                                                             |\n| [ERC Conformance](./ERC-Conformance.md)             | `slither-check-erc`            | Validates whether a contract correctly implements various ERC standards (ERC20, ERC721, etc.) by checking required functions and their signatures.                      |\n| [Interface](./Interface.md)                         | `slither-interface`            | Generates Solidity interfaces from contract implementations, useful for creating minimal interfaces for contract interactions.                                          |\n| [Mutator](./Mutator.md)                             | `slither-mutate`               | Performs mutation testing on Solidity contracts by automatically generating variants with small modifications to test suite effectiveness.                              |\n| [Path Finding](./Path-Finding-Utility.md)           | `slither-prop`                 | Analyzes call paths between functions in smart contracts to understand control and data flow.                                                                           |\n| [Property Generation](./Property-generation.md)     | `slither-prop`                 | Automatically generates security properties and unit tests for smart contracts based on their behavior.                                                                 |\n| [Read Storage](./ReadStorage.md)                    | `slither-read-storage`         | Reads contract storage values directly from the blockchain, helping debug deployed contracts.                                                                           |\n| [Format](./Slither-format.md)                       | `slither-format`               | Automatically patch bugs.                                                                                                                                               |\n| [Upgradeability Checks](./Upgradeability-Checks.md) | `slither-check-upgradeability` | Analyzes upgradeable contracts for common issues and vulnerabilities in proxy patterns.                                                                                 |\n","isInternal":false,"tokens":533,"sizeBytes":3685},{"name":"README.md","path":"slither/tools/demo/README.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/demo/README.md","title":"demo Documentation","category":"plugin-manifest","format":"markdown","content":"# demo Documentation\n\nPath: `slither/tools/demo/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/demo/README.md)","tokens":300,"sizeBytes":172},{"name":"README.md","path":"slither/tools/erc_conformance/README.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/erc_conformance/README.md","title":"erc_conformance Documentation","category":"plugin-manifest","format":"markdown","content":"# erc_conformance Documentation\n\nPath: `slither/tools/erc_conformance/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/erc_conformance/README.md)","tokens":300,"sizeBytes":205},{"name":"README.md","path":"tests/tools/mutator/test_data/test_source_unit/README.md","rawUrl":"https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/mutator/test_data/test_source_unit/README.md","title":"test_source_unit Documentation","category":"plugin-manifest","format":"markdown","content":"# test_source_unit Documentation\n\nPath: `tests/tools/mutator/test_data/test_source_unit/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/mutator/test_data/test_source_unit/README.md)","tokens":300,"sizeBytes":240}],"systemPromptSnippet":"<yakaai_skills repo=\"crytic/slither\">\n<!-- File: docs/src/tools/Adding-a-new-utility.md (Tokens: ~207 | Category: anthropic-skill) -->\n# Adding New Utility\n\nSlither can be used as a library to create new utilities.\nOfficial utils are present in [tools](https://github.com/crytic/slither/tree/master/slither/tools)\n\n## Skeleton\n\nThe skeleton util is present in [tools/demo](https://github.com/crytic/slither/tree/master/slither/tools/demo)\n\n## Integration\n\nTo enable an util from the command-line, update `project.scripts` in [pyproject.toml](https://github.com/crytic/slither/blob/master/pyproject.toml).\nInstalling Slither will then install the util.\n\n## Guidelines\n\n- Favor the `logging` module rather than `print`\n- Favor raising an exception rather than `sys.exit`\n- Add unit-tests (ex: [scripts/travis_test_find_paths.sh](https://github.com/crytic/slither/blob/master/scripts/ci_test_find_paths.sh))\n\n## Getting Help\n\nJoin our [slack channel](https://empireslacking.herokuapp.com/) to get any help (#ethereum).\n\n<!-- File: docs/src/tools/Code-Similarity-Detector.md (Tokens: ~2926 | Category: anthropic-skill) -->\n`slither-simil` uses state-of-the-art machine learning to detect similar (vulnerable) Solidity functions. We have provided a pretrained model from [etherscan_verified_contracts](https://github.com/thec00n/etherscan_verified_contracts) with 60,000 contracts and more than 850,000 functions to get you started quickly. We included the capability to easily train new models if you have access to larger or different datasets.\n\n`slither-simil` uses [FastText](https://github.com/facebookresearch/fastText), a vector embedding technique, to generate compact numerical representations of every function. We used FastText because it:\n\n- implements several state-of-the-art techniques such as nbow and skipgrams,\n- has high performance (it is C++ code with Python bindings),\n- has MIT license, and\n- is well maintained (by Facebook).\n\n## Requirements\n\nInstall the required packages before using `slither-simil`:\n\n```\npip3 install pybind11 --user\npip3 install https://github.com/facebookresearch/fastText/archive/0.2.0.zip --user\npip3 install sklearn matplotlib --user # for plot mode\n```\n\nMake sure that you are using `pip3.6` or later. If you are running from inside a [virtualenv](https://virtualenv.pypa.io/en/latest/), remove the `--user` parameter.\n\n## Usage\n\nNote that these examples will use the following files:\n\n- [etherscan_verified_contracts.bin](https://drive.google.com/file/d/1oEhbIL4V9582Y5VKp4iiOURGq8qa4cBN/view?usp=sharing)\n- [cache.npz](https://drive.google.com/file/d/1vpwusbyzLn1JqqAvlFivHXtLvsEp0VqX/view?usp=sharing)\n- [MetaCoin.sol](https://github.com/crytic/slither/wiki/MetacoinExample)\n\n`slither-simil` has three modes:\n\n- `test` - finds similar functions to your own in a dataset of contracts\n- `plot` - provide a visual representation of similarity of multiple sampled functions\n- `train` - builds new models of large datasets of contracts\n- `info` - inspects the internal information of the pre-trained model or the assessed code\n\n### Test mode\n\nThis mode transforms a function into a vector and uses it to find similar functions.\n\nTest mode requires the following parameters:\n\n1. A pre-trained model: this file will be used to transform every function into a vector, you can [train your own](#train-mode) or [use our pre-trained one (etherscan_verified_contracts.bin)](#usage).\n2. A contract filename: this file will contain the code that you want to compare,\n3. A function name (e.g. `SafeMath.add` or `add`),\n4. An input directory or file: this can be either a directory with contracts or a [cache file with a pre-computed list of vectors for every contract (cache.npz)](#usage).\n\nUse the cache to avoid long processing times to compile and vectorize the input contracts.\n\nHere's an example that finds functions similar to `sendCoin` in `MetaCoin` (compiled with `solc-0.4.25`). Searching for similar functions among more than 800,000 functions takes only 20 seconds.\n\n```\n$ slither-simil test etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --input cache.npz --ntop 25 --solc solc-0.4.25\nINFO:Slither-simil:Reviewed 825062 functions, listing the 25 most similar ones:\nINFO:Slither-simil:filename                                                          contract             function             score\nINFO:Slither-simil:0x954b5de09a55e59755acbda29e1eb74a45d30175_Fluz.sol               Fluz                 transfer             1.0\nINFO:Slither-simil:0x55648de19836338549130b1af587f16bea46f66b_Pebbles.sol            Pebbles              transfer             1.0\nINFO:Slither-simil:0x3fcee23add6e86dde3c4d395cbce1cae7f16d06d_SnipCoin.sol           SnipCoin             sendCoin             1.0\nINFO:Slither-simil:0x000000005fbe2cc9b1b684ec445caf176042348e_ProperProposal.sol     Vote                 transfer             1.0\nINFO:Slither-simil:0x000000002bb43c83ece652d161ad0fa862129a2c_AccountRegistry.sol    Vote                 transfer             1.0\nINFO:Slither-simil:0x4e84e9e5fb0a972628cf4568c403167ef1d40431_Fluzcoin.sol           Fluzcoin             transfer             1.0\nINFO:Slither-simil:0x334eec1482109bd802d9e72a447848de3bcc1063_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x28ccdda197d319a241005b9c9f01bac48b90f556_AirDropToken.sol       AirDropToken         transfer             1.0\nINFO:Slither-simil:0x000000002647e16d9bab9e46604d75591d289277_Vote.sol               Vote                 transfer             1.0\nINFO:Slither-simil:0xc6c4c7826D44ABF22c711E8E86bDC3f5242d2182_token.sol              token                sendCoin             1.0\nINFO:Slither-simil:0x22033df1d104736ff4c2b23a28affe52863ca9c8_AtmOnlyFluzcoin.sol    AtmOnlyFluzcoin      transfer             1.0\nINFO:Slither-simil:0xcad796d6a2c0bb1de7f24262819be96fb08c1c3a_Love.sol               Love                 transfer             1.0\nINFO:Slither-simil:0x6cb2b8dc6a508c9a21db9683d1a729715969a6ee_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0xd75fefe3cdb647281eec3f8fc738e3bc9658f9e4_ProofOfReadToken.sol   ProofOfReadToken     transfer             0.996\nINFO:Slither-simil:0x7A8Ef7E8c8f16B9D6F39069ce03d752Af23b46d6_OBS_V1.sol             MyObs                transfer             0.996\nINFO:Slither-simil:0x5ac0197c944c961f58bb02f3d0df58a74fdc15b6_TokenEscrow.sol        TokenEscrow          transferFromOwner    0.996\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transfer             0.996\nINFO:Slither-simil:0x3d8a10ce3228cb428cb56baa058d4432464ea25d_TestToken.sol          TestToken            transfer             0.993\nINFO:Slither-simil:0x69719c8c207036bdfc3632ccc24b290fb7240f4a_BitPayToken.sol        BitPayToken          transferFrom         0.992\nINFO:Slither-simil:0x486e1f44b2a85150a6dd2de5aab87df375cd8880_CAIRToken.sol          StandardToken        transfer             0.991\nINFO:Slither-simil:0x2bec16b164725efc192b7ec0296f838c61317514_eda.sol                StandardToken        transfer             0.991\nINFO:Slither-simil:0xb7cb1c96db6b22b0d3d9536e0108d062bd488f74_WaltonToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0x346c3be6aebEBaF5Cb766a75aDc9827EfbB7E41A_DelphiToken.sol        StandardToken        transfer             0.991\nINFO:Slither-simil:0xf5068761511594c82328102f4fde4650ed9ea6c4_WHP.sol                WHP                  transfer             0.991\nINFO:Slither-simil:0x5f9f2ae7150d0beef3bb50ac8d8f4b43e6a6cc57_NABC.sol               NABC                 transfer             0.991\n```\n\n### Train mode\n\nTrain mode trains new models used to vectorize functions. You will need a large amount of contracts/functions if you plan to train a new model.\n\n```\n$ slither-simil train model.bin --input contracts\nINFO:Slither-simil:Saving extracted data into last_data_train.txt\nINFO:Slither-simil:Starting training\nRead 0M words\nNumber of words:  348\nNumber of labels: 0\nProgress: 100.0% words/sec/thread:   53124 lr:  0.000000 loss:  2.066949 ETA:   0h 0m\nINFO:Slither-simil:Training complete\nINFO:Slither-simil:Saving model\nINFO:Slither-simil:Saving cache in cache.npz\nINFO:Slither-simil:Done!\n```\n\nAfter it runs, the `slither-simil` will output the trained model in `model.bin`, a cache of every function for use in test mode in `cache.npz`, and the SlithIR of every function for debugging in `last_data_train.txt`.\n\n### Plot mode\n\nPlot mode plots sets of functions to visually detect clusters of similar ones.\n\nHere's an example to plot all the functions named `add` from contracts named `SafeMath` sampling from 500 random contracts:\n\n```\n$ slither-simil plot etherscan_verified_contracts.bin --fname SafeMath.add --input cache.npz --nsamples 500\nINFO:Slither-simil:Loading data..\nINFO:Slither-simil:Processing data..\nINFO:Slither-simil:Plotting data..\nINFO:Slither-simil:Saving figure to plot.png..\n```\n\n![plot](https://user-images.githubusercontent.com/31542053/57525857-3d794f80-7302-11e9-9677-b4eb3f6a5c20.png)\n\nThis mode performs dimensionality reduction using PCA, so the axes you see here [are **not** associated with any particular unit](https://stats.stackexchange.com/questions/137813/the-meaning-of-units-on-the-axes-of-a-pca-plot).\n\nIt can also be used to plot sets of functions using only a name from any contract (e.g. `burn`) .\n\n### Info mode\n\nThis mode has two features. You can inspect the internal information about a pre-trained model. Info mode is typically used for debugging.\n\n```\n$ slither-simil info etherscan_verified_contracts.bin\nINFO:Slither-simil:etherscan_verified_contracts.bin uses the following words:\nINFO:Slither-simil:</s>\nINFO:Slither-simil:index(uint256)\nINFO:Slither-simil:return\nINFO:Slither-simil:condition(temporary_variable)\nINFO:Slither-simil:member\nINFO:Slither-simil:solidity_call(require(bool))\nINFO:Slither-simil:library_call\nINFO:Slither-simil:binary(+)\nINFO:Slither-simil:event\nINFO:Slither-simil:(local_solc_variable(default)):=(temporary_variable)\n...\n```\n\n... or examine the internal representation of function:\n\n```\n$ slither-simil info etherscan_verified_contracts.bin --filename MetaCoin.sol --fname MetaCoin.sendCoin --solc solc-0.4.25\nINFO:Slither-simil:Function sendCoin in contract MetaCoin is encoded as:\nINFO:Slither-simil:index(uint256) binary(<) condition(temporary_variable) return index(uint256) binary(-) index(uint256) binary(+) event return\nINFO:Slither-simil:[ 0.00689753 -0.05349572 -0.06854086 -0.01667773  0.1259813  -0.05974023\n  0.06719872 -0.04520541  0.13745852  0.14690697 -0.03721125  0.00579037\n  0.06865194 -0.03804035  0.01224702 -0.1014601  -0.02655532 -0.15334933\n...\n```\n\n<!-- File: docs/src/tools/Contract-Flattening.md (Tokens: ~346 | Category: anthropic-skill) -->\n# slither-flat\n\n`slither-flat` produces a flattened version of the codebase.\n\n## Features\n\n- Code flattening\n- Support multiple [strategies](#strategies)\n- Support circular dependency\n- Support all the compilation platforms (Truffle, embark, buidler, etherlime, ...).\n\n## Usage\n\n`slither-flat target`\n\n- `--contract ContractName`: flatten only one contract (standalone file)\n\n### Strategies\n\n`slither-flat` contains three strategies that can be specified with the `--strategy` flag:\n\n- `MostDerived`: Export all the most derived contracts (every file is standalone)\n- `OneFile`: Export all the contracts in one standalone file\n- `LocalImport`: Export every contract in one separate file, and include import \"..\" in their preludes\n\nDefault: `MostDerived`\n\n### Patching\n\n`slither-flat` can transform the codebase to help some usage (eg. [Echidna](https://github.com/crytic/echidna))\n\n- `--convert-external`: convert `external` function to `public`. This is meant to facilitate [Echidna](https://github.com/crytic/echidna) usage.\n- `--contract name`: To flatten only a target contract\n- `--remove-assert`: Remove call to assert().\n\n### Export option\n\n- `--dir DirName`: output directory\n- `--json file.json`: export the results to a json file (`--json -` output to the standard output\n- `--zip file.zip`: export to a ZIP file\n- `--zip-type type`: ZIP compression type (default lzma))\n\n<!-- File: docs/src/tools/Doctor.md (Tokens: ~22 | Category: anthropic-skill) -->\n# Slither doctor\n\nSlither doctor is a tool designed to troubleshoot running Slither on a project.\n\n<!-- File: docs/src/tools/Documentation.md (Tokens: ~64 | Category: anthropic-skill) -->\n# slither-documentation\n\n`slither-documentation` uses [codex](https://platform.openai.com) to generate natspec documentation.\n\nThis tool is experimental. See [solmate documentation](https://github.com/montyly/solmate/pull/1) for an example of usage.\n\n<!-- File: docs/src/tools/ERC-Conformance.md (Tokens: ~615 | Category: anthropic-skill) -->\n# slither-check-erc\n\n`slither-check-erc` checks for ERC's conformance.\n\n## Features\n\n`slither-check-erc` will check that:\n\n- All the functions are present\n- All the events are present\n- Functions return the correct type\n- Functions that must be view are view\n- Events' parameters are correctly indexed\n- The functions emit the events\n- Derived contracts do not break the conformance\n\n## Supported ERCs\n\n- [ERC20](https://eips.ethereum.org/EIPS/eip-20): Token standard\n- [ERC223](https://github.com/ethereum/eips/issues/223): Token standard\n- [ERC777](https://eips.ethereum.org/EIPS/eip-777): Token standard\n- [ERC721](https://eips.ethereum.org/EIPS/eip-721): Non-fungible token standard\n- [ERC165](https://eips.ethereum.org/EIPS/eip-165): Standard interface detection\n- [ERC1155](https://eips.ethereum.org/EIPS/eip-1155): Multi Token Standard\n- [ERC1820](https://eips.ethereum.org/EIPS/eip-1820): Pseudo-introspection registry contract\n- [ERC4524](https://eips.ethereum.org/EIPS/eip-4524): Safer ERC-20\n- [ERC1363](https://eips.ethereum.org/EIPS/eip-1363): Payable Token\n- [ERC2612](https://eips.ethereum.org/EIPS/eip-2612): Permit Extension for EIP-20 Signed Approvals\n- [ERC4626](https://eips.ethereum.org/EIPS/eip-4626): Tokenized Vaults\n\n## Usage\n\n```sh\nslither-check-erc contract.sol ContractName\n```\n\nFor example, on\n\n```solidity\ncontract ERC20{\n\n    event Transfer(address indexed,address,uint256);\n\n    function transfer(address, uint256) public{\n\n        emit Transfer(msg.sender,msg.sender,0);\n    }\n\n}\n```\n\nThe tool will report:\n\n```text\n# Check ERC20\n\n## Check functions\n[ ] totalSupply() is missing\n[ ] balanceOf(address) is missing\n[✓] transfer(address,uint256) is present\n [ ] transfer(address,uint256) -> () should return bool\n [✓] Transfer(address,address,uint256) is emitted\n[ ] transferFrom(address,address,uint256) is missing\n[ ] approve(address,uint256) is missing\n[ ] allowance(address,address) is missing\n[ ] name() is missing (optional)\n[ ] symbol() is missing (optional)\n[ ] decimals() is missing (optional)\n\n## Check events\n[✓] Transfer(address,address,uint256) is present\n [✓] parameter 0 is indexed\n [ ] parameter 1 should be indexed\n[ ] Approval(address,address,uint256) is missing\n```\n\n<!-- File: docs/src/tools/Interface.md (Tokens: ~176 | Category: anthropic-skill) -->\n# Slither-interface\n\nGenerates code for a Solidity interface from contract\n\n## Usage\n\nRun `slither-interface <ContractName> <source file or deployment address>`.\n\n## CLI Interface\n\n```shell\npositional arguments:\n  contract_source       The name of the contract (case sensitive) followed by the deployed contract address if verified on etherscan or project directory/filename for local contracts.\n\noptional arguments:\n  -h, --help            show this help message and exit\n  --unroll-structs      Whether to use structures' underlying types instead of the user-defined type\n  --exclude-events      Excludes event signatures in the interface\n  --exclude-errors      Excludes custom error signatures in the interface\n  --exclude-enums       Excludes enum definitions in the interface\n  --exclude-structs     Exclude struct definitions in the interface\n```\n\n<!-- File: docs/src/tools/Mutator.md (Tokens: ~515 | Category: anthropic-skill) -->\n# Slither-mutate\n\n`slither-mutate` is a mutation testing tool for solidity based smart contracts.\n\n## Quick Start\n\nIn a foundry project with **passing** tests that are run with `forge test`, you can mutate all solidity files in the `src` folder by running the following:\n\n`slither-mutate src --test-cmd='forge test'`\n\nYou can provide flags to `forge` as part of the `--test-cmd` parameter or target a single file path instead of the whole `src` directory, for example:\n\n`slither-mutate src/core/MyContract.sol --test-cmd='forge test --match-contract=\"MyContract\"'`\n\nIf a `timout` flag is not provided, slither-mutate will default to using a value that's double the runtime of it's initial test cmd execution. Make sure you run `forge clean` or similar beforehand to ensure cache usage doesn't cause a timeout that's too short to be used; this could lead to false-negatives.\n\n### CLI Interface\n\n```shell\n$ slither-mutate --help\nusage: slither-mutate <codebase> --test-cmd <test command> <options>\n\nExperimental smart contract mutator. Based on https://arxiv.org/abs/2006.11597\n\npositional arguments:\n  codebase              Codebase to analyze (.sol file, project directory, ...)\n\noptions:\n  -h, --help            show this help message and exit\n  --list-mutators       List available detectors\n  --test-cmd TEST_CMD   Command to run the tests for your project\n  --test-dir TEST_DIR   Tests directory\n  --ignore-dirs IGNORE_DIRS\n                        Directories to ignore\n  --timeout TIMEOUT     Set timeout for test command (by default 2x the initial test runtime)\n  --output-dir OUTPUT_DIR\n                        Name of output directory (by default 'mutation_campaign')\n  -v, --verbose         log mutants that are caught, uncaught, and fail to compile\n  --mutators-to-run MUTATORS_TO_RUN\n                        mutant generators to run\n  --contract-names CONTRACT_NAMES\n                        list of contract names you want to mutate\n  --target-functions TARGET_FUNCTIONS\n                        Comma-separated list of function selectors (hex like\n                        0xa9059cbb or signature like transfer(address,uint256))\n  --comprehensive       continue testing minor mutations if severe mutants are uncaught\n```\n\n<!-- File: docs/src/tools/Path-Finding-Utility.md (Tokens: ~175 | Category: anthropic-skill) -->\n# slither-find-paths\n\n`slither-find-paths` finds all the paths that reach a given target.\n\n## Usage\n\n```sh\nslither-find-paths file.sol [contract.function targets]\n```\n\n- `[contract.function targets]` is either one target, or a list of target\n\n## Example\n\nTested on [tests/e2e/printers/possible_paths/paths.sol](https://github.com/crytic/slither/blob/master/tests/e2e/printers/possible_paths/paths.sol)\n\n```sh\n$ slither-find-paths paths.sol A.destination\nTarget functions:\n- A.destination()\n\n\nThe following functions reach the specified targets:\n- A.call()\n- B.call2(A)\n\n\nThe following paths reach the specified targets:\nA.call() -> A.destination()\n\nB.call2(A) -> A.call() -> A.destination()\n```\n\n<!-- File: docs/src/tools/Property-generation.md (Tokens: ~1709 | Category: anthropic-skill) -->\n`slither-prop` generates code properties (e.g., invariants) that can be tested with unit tests or [Echidna](https://github.com/crytic/echidna/), entirely automatically. Once you have these properties in hand, use [Crytic](https://crytic.io/) to continuously test them with every commit.\n\nNote: `slither-prop` only supports Truffle for now. We'll be adding support for other frameworks soon!\n\n## How to Use Slither's Property Generator\n\nThere are four steps:\n\n1. [Generate the tests](#step-1-generate-the-tests)\n1. [Customize the constructor](#step-2-customize-the-constructor)\n1. [Run the unit tests](#step-3-run-the-unit-tests-with-truffle)\n1. [Run the Echidna tests](#step-4-run-the-property-tests-with-echidna)\n\n### Step 1. Generate the tests\n\n```\nslither-prop . --contract ContractName\n```\n\n`slither-prop` will generate:\n\n- Solidity files containing the properties\n- `echidna_config.yaml` to configure Echidna\n- One Truffle migration file\n- Two Truffle unit-test files\n\nFor example on [examples/slither-prop](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop).\n\n```\nWrite contracts/crytic/interfaces.sol\nWrite contracts/crytic/PropertiesERC20BuggyTransferable.sol\nWrite contracts/crytic/TestERC20BuggyTransferable.sol\nWrite echidna_config.yaml\nWrite migrations/1_TestERC20BuggyTransferable.js\nWrite test/crytic/InitializationTestERC20BuggyTransferable.js\nWrite test/crytic/TestERC20BuggyTransferable.js\n################################################\nUpdate the constructor in contracts/crytic/TestERC20BuggyTransferable.sol\n\nTo run the unit tests:\n truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n truffle test test/crytic/TestERC20BuggyTransferable.js\n\nTo run Echidna:\n  echidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n### Step 2. Customize the constructor\n\nNext, update the constructor in `contracts/crytic/TestX.sol`:\n\nOn [examples/slither-prop/contracts](https://github.com/crytic/slither/tree/9623a2781faa4e7759f06d2e8c4adcd45078af69/examples/slither-prop), update the constructor as follow:\n\n```solidity\n constructor() public{\n\n  _balanceOf[crytic_user] = 1 ether;\n  _balanceOf[crytic_owner] = 1 ether;\n  _balanceOf[crytic_attacker] = 1 ether;\n  _totalSupply = 3 ether;\n\n  //\n  //\n  // Update the following if totalSupply and balanceOf are external functions or state variables:\n\n  initialTotalSupply = totalSupply();\n  initialBalance_owner = balanceOf(crytic_owner);\n  initialBalance_user = balanceOf(crytic_user);\n  initialBalance_attacker = balanceOf(crytic_attacker);\n }\n```\n\n### Step 3. Run the unit tests with Truffle\n\nThe first unit test file, named `InitializationX.js` will check that the constructor has been correctly initialized:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n[..]\n  Contract: TestERC20BuggyTransferable\n    ✓ The total supply is correctly initialized. (47ms)\n    ✓ Owner's balance is correctly initialized.\n    ✓ User's balance is correctly initialized.\n    ✓ Attacker's balance is correctly initialized.\n    ✓ All the users have a positive balance. (69ms)\n    ✓ The total supply is the user and owner balance. (38ms)\n\n```\n\nIf all the unit tests passed, run the property tests:\n\n```\n$ truffle test test/crytic/InitializationTestERC20BuggyTransferable.js\n  Contract: TestERC20BuggyTransferable\n    ✓ The address 0x0 should not receive tokens.\n    ✓ Allowance can be changed. (108ms)\n    ✓ Balance of one user must be less or equal to the total supply. (70ms)\n    ✓ Balance of the crytic users must be less or equal to the total supply.\n    1) No one should be able to send tokens to the address 0x0 (transfer).\n    > No events were emitted\n    2) No one should be able to send tokens to the address 0x0 (transferFrom).\n    > No events were emitted\n    ✓ Self transferFrom works. (115ms)\n    ✓ transferFrom works. (108ms)\n    ✓ Self transfer works. (89ms)\n    ✓ transfer works. (97ms)\n    3) Cannot transfer more than the balance.\n    > No events were emitted\n\n```\n\nAs you can see, the unit tests detect some of the bugs.\n\n### Step 4. Run the property tests with Echidna\n\n```\nechidna-test . --contract TestERC20BuggyTransferable --config echidna_config.yaml\n```\n\n## Scenarios\n\n`slither-prop` contains different scenarios that can be specified with the `--scenario NAME` flag.\n\nHere are the available scenarios:\n\n```\n#################### ERC20 ####################\nTransferable - Test the correct tokens transfer\nPausable - Test the pausable functionality\nNotMintable - Test that no one can mint tokens\nNotMintableNotBurnable - Test that no one can mint or burn tokens\nNotBurnable - Test that no one can burn tokens\nBurnable - Test the burn of tokens. Require the \"burn(address) returns()\" function\n```\n\n## All properties\n\n```\n+-----+-------------------------------------------------------------------------+------------------------+\n| Num |                               Description                               |        Scenario        |\n+-----+-------------------------------------------------------------------------+------------------------+\n|  0  |                The address 0x0 should not receive tokens.               |      Transferable      |\n|  1  |                        Allowance can be changed.                        |      Transferable      |\n|  2  |      Balance of one user must be less or equal to the total supply.     |      Transferable      |\n|  3  |  Balance of the crytic users must be less or equal to the total supply. |      Transferable      |\n|  4  |   No one should be able to send tokens to the address 0x0 (transfer).   |      Transferable      |\n|  5  | No one should be able to send tokens to the address 0x0 (transferFrom). |      Transferable      |\n|  6  |                         Self transferFrom works.                        |      Transferable      |\n|  7  |                           transferFrom works.                           |      Transferable      |\n|  8  |                           Self transfer works.                          |      Transferable      |\n|  9  |                             transfer works.                             |      Transferable      |\n|  10 |                  Cannot transfer more than the balance.                 |      Transferable      |\n|  11 |                             Cannot transfer.                            |        Pausable        |\n|  12 |                       Cannot execute transferFrom.                      |        Pausable        |\n|  13 |                        Cannot change the balance.                       |        Pausable        |\n|  14 |                       Cannot change the allowance.                      |        Pausable        |\n|  15 |                   The total supply does not increase.                   |      NotMintable       |\n|  16 |                    The total supply does not change.                    | NotMintableNotBurnable |\n|  17 |                   The total supply does not decrease.                   |      NotBurnable       |\n|  18 |                   The total supply does not decrease.                   |        Burnable        |\n+-----+-------------------------------------------------------------------------+------------------------+\n```\n\n<!-- File: docs/src/tools/ReadStorage.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Tools Skill\n\nPath: `docs/src/tools/ReadStorage.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/ReadStorage.md)\n\n<!-- File: docs/src/tools/Slither-format.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Tools Skill\n\nPath: `docs/src/tools/Slither-format.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Slither-format.md)\n\n<!-- File: docs/src/tools/Upgradeability-Checks.md (Tokens: ~300 | Category: anthropic-skill) -->\n# Tools Skill\n\nPath: `docs/src/tools/Upgradeability-Checks.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/docs/src/tools/Upgradeability-Checks.md)\n\n<!-- File: tests/tools/check_kspec/safeAdd/spec.md (Tokens: ~300 | Category: anthropic-skill) -->\n# SafeAdd Skill\n\nPath: `tests/tools/check_kspec/safeAdd/spec.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/check_kspec/safeAdd/spec.md)\n\n<!-- File: tests/tools/read-storage/test_data/TEST_storage_layout.json (Tokens: ~300 | Category: anthropic-skill) -->\n# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_storage_layout.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_storage_layout.json)\n\n<!-- File: tests/tools/read-storage/test_data/TEST_unstructured_storage.json (Tokens: ~300 | Category: anthropic-skill) -->\n# Test_data Skill\n\nPath: `tests/tools/read-storage/test_data/TEST_unstructured_storage.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/read-storage/test_data/TEST_unstructured_storage.json)\n\n<!-- File: CLAUDE.md (Tokens: ~1675 | Category: claude-rule) -->\n# Slither\n\nStatic analyzer for Solidity smart contracts. Detects vulnerabilities, prints contract information, and provides an intermediate representation (SlithIR) for analysis.\n\n## Architecture\n\n```\nslither/\n├── analyses/      # Data dependency, dominators, control flow\n├── core/          # Core classes: SlitherCore, Contract, Function\n├── detectors/     # Security checks (subclass AbstractDetector)\n├── printers/      # Output formatters (subclass AbstractPrinter)\n├── slithir/       # Intermediate representation for analysis\n├── solc_parsing/  # Solidity AST parsing\n└── tools/         # CLI tools (slither-read-storage, slither-mutate, etc.)\n```\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for detailed architecture and how to add detectors.\n\n## Development\n\n| tool    | purpose       |\n|---------|---------------|\n| `uv`    | deps & venv   |\n| `ruff`  | lint & format |\n| `prek`  | pre-commit hooks |\n| `pytest`| tests         |\n\n```bash\nmake dev                    # Setup dev environment + pre-commit hooks\nmake lint                   # Run ruff check\nmake reformat               # Run ruff format\nmake test                   # Run all tests\npytest tests/unit/ -q       # Fast unit tests only\n```\n\n### Navigating the codebase\n\nUse `rg` for text search and `ast-grep` for structural patterns:\n\n```bash\n# Find class definition\nast-grep --pattern 'class Contract($_): $$$' --lang py slither\n\n# Find all detector implementations\nast-grep --pattern 'class $NAME(AbstractDetector): $$$' --lang py slither/detectors\n\n# Find method usages\nrg \"\\.is_interface\" slither\n\n# Find function signatures\nast-grep --pattern 'def _detect($$$)' --lang py slither/detectors\n\n# Trace imports\nrg \"^from slither\\.core\" slither\n```\n\n## Code Standards\n\n### Philosophy\n- **No speculative features** - Don't add \"might be useful\" functionality\n- **No premature abstraction** - Don't create utilities until you've written the same code three times\n- **Clarity over cleverness** - Prefer explicit, readable code over dense one-liners\n- **Justify new dependencies** - Each dependency is maintenance burden and complexity\n- **Structured output first** - New commands must support `--json`. Human-readable is secondary.\n- **Atomic operations** - Don't bundle decision logic; separate analyze → suggest → apply for composability.\n\n### Code quality\n- **Comments** - Code should be self-documenting. No commented-out code (delete it). No comments that repeat what code does.\n- **Errors** - Fail fast with clear, actionable messages. Include context: what failed, which file/contract, suggested fix. Never swallow exceptions.\n- **When uncertain** - State your assumption and proceed for small decisions. Ask before changes with significant consequences.\n\n### Hard limits\n1. ≤80 lines/function, cyclomatic complexity ≤8\n2. ≤5 positional params, ≤12 branches, ≤6 returns\n3. 100-char line length\n4. No relative (`..`) imports\n5. Tests in `/tests/` mirroring package structure\n\nBash scripts must use strict mode:\n```bash\n#!/bin/bash\nset -euo pipefail\n```\n\n## Working on Code\n\n### Incremental improvement\nWhen modifying a file, improve what you touch. Don't refactor unrelated code—keep PRs focused.\n\nModernization targets:\n- Type hints on function signatures (aspiration: `ty --strict`)\n- `pathlib.Path` over `os.path` string manipulation\n- f-strings over `.format()` or `%` formatting\n- Context managers (`with`) for file/resource handling\n- Early returns to reduce nesting\n- Fix lint issues you encounter\n\n### Git conventions\n- Commit messages: imperative mood, ≤72 char subject (e.g., \"Fix reentrancy false positive\")\n- One logical change per commit\n- Prefix: `fix:`, `feat:`, `refactor:`, `test:`, `docs:` as appropriate\n\n## Testing\n\n- **Mock boundaries, not logic** - Only mock slow things (network, filesystem), non-deterministic things (time), or external services. Don't mock the code you're testing.\n- **Verify tests catch failures** - Temporarily break code to verify the test fails, then fix it.\n\n### Slither-specific\n- Test detectors across Solidity 0.4.x–0.8.x\n- Update snapshots: `tests/e2e/detectors/snapshots/`\n- Use `compile_force_framework=\"solc\"` when crytic-compile behavior changes\n- **Run e2e tests early** when changing core classes (`Literal`, `Expression`, etc.)—snapshots capture exact `__str__` output, so behavioral changes break many tests\n\n## Slither Internals\n\n### APIs\n- Use `contract.is_interface` not `contract.name.startswith(\"I\")`\n- Use `source_mapping.content` for source code access (handles byte/char offsets)\n- Use `is` / `is not` for enum comparisons (`NodeType.X`, not `== NodeType.X`)\n- CLI features should have Python API equivalents in the `Slither` class\n\n### Traversal patterns\n- **Per-definition analysis** (naming, arithmetic, structure): Use `contracts_derived` + `functions_declared`\n- **Reachability analysis** (call graphs, taint): Use `contracts_derived` + `functions` (inherited functions needed)\n- **Global deduplication**: Use `compilation_unit.functions` directly to process each function exactly once\n- Filter by `function.contract_declarer == contract` when iterating `contract.functions`\n- `high_level_calls` returns `List[Tuple[Contract, Call]]` - don't forget tuple unpacking\n\n### Type handling\n- Expand `isinstance()` checks rather than removing assertions\n- Add type guards before accessing type-specific attributes in AST visitors\n- Check local scope before broader scope when resolving identifiers\n- **`ElementaryType` comparison pitfall**: `ElementaryType.__eq__` only matches other `ElementaryType` instances. `ElementaryType(\"uint256\") in [\"uint256\"]` is **always False**. Convert to string first: `str(t) in [\"uint256\"]`\n\n### SlithIR and SSA\n- **Use `node.irs`** for most detectors—simpler, sufficient for most analyses\n- **Use `node.irs_ssa`** only when you need precise data flow (tracking reassignments, taint analysis)\n- SSA variables have `.index` (e.g., `x_0`, `x_1`) and `.non_ssa_version` to get the original\n- `Phi` operations merge SSA versions at control flow joins (if/else, loops)\n- **Data dependency**: Use `is_dependent(var, source, context)` from `slither.analyses.data_dependency`\n\n### Detector quality\nMinimize false positives over catching edge cases. Noisy detectors get disabled. Output must be actionable.\n\n### Docstrings\nDetectors use class attributes, not Google-style docstrings:\n- `WIKI_TITLE`, `WIKI_DESCRIPTION`, `WIKI_EXPLOIT_SCENARIO`, `WIKI_RECOMMENDATION`\n- Must be thorough—agents use these to decide which detectors apply\n- `VULNERABLE_SOLC_VERSIONS` restricts detector to specific compiler versions\n- Use `make_solc_versions(minor, patch_min, patch_max)` helper for version lists\n\n## Notes\n\n**Version verification**: When adding dependencies or CI actions, web search for current stable versions. Training data is stale—never assume a version from memory is current.\n\n---\n\n> Don't push until asked. Don't be hyperbolic in PR writeups.\n\n<!-- File: docs/src/tools/README.md (Tokens: ~533 | Category: plugin-manifest) -->\n# Slither Inbuilt Tools\n\nSlither comes with inbuilt tools\n\n| Name                                                | Command-Line                   | What it Does                                                                                                                                                            |\n| --------------------------------------------------- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| [Code Similarity](./Code-Similarity-Detector.md)    | `slither-simil`                | Detects similar Solidity functions/contracts using code similarity analysis. Useful for finding duplicated code, similar vulnerabilities, or analyzing large codebases. |\n| [Contract Flattening](./Contract-Flattening.md)     | `slither-flat`                 | Flattens a Solidity codebase by inlining all imports into a single file. Useful for contract verification on Etherscan or debugging.                                    |\n| [Documentation](./Documentation.md)                 | `slither-doc`                  | Automatically generates documentation for Solidity contracts, including inheritance information, functions, modifiers, and more.                                        |\n| [Doctor](./Doctor.md)                               | `slither-doctor`               | Helps diagnose and fix common issues in your environment that might prevent Slither from working correctly.                                                             |\n| [ERC Conformance](./ERC-Conformance.md)             | `slither-check-erc`            | Validates whether a contract correctly implements various ERC standards (ERC20, ERC721, etc.) by checking required functions and their signatures.                      |\n| [Interface](./Interface.md)                         | `slither-interface`            | Generates Solidity interfaces from contract implementations, useful for creating minimal interfaces for contract interactions.                                          |\n| [Mutator](./Mutator.md)                             | `slither-mutate`               | Performs mutation testing on Solidity contracts by automatically generating variants with small modifications to test suite effectiveness.                              |\n| [Path Finding](./Path-Finding-Utility.md)           | `slither-prop`                 | Analyzes call paths between functions in smart contracts to understand control and data flow.                                                                           |\n| [Property Generation](./Property-generation.md)     | `slither-prop`                 | Automatically generates security properties and unit tests for smart contracts based on their behavior.                                                                 |\n| [Read Storage](./ReadStorage.md)                    | `slither-read-storage`         | Reads contract storage values directly from the blockchain, helping debug deployed contracts.                                                                           |\n| [Format](./Slither-format.md)                       | `slither-format`               | Automatically patch bugs.                                                                                                                                               |\n| [Upgradeability Checks](./Upgradeability-Checks.md) | `slither-check-upgradeability` | Analyzes upgradeable contracts for common issues and vulnerabilities in proxy patterns.                                                                                 |\n\n<!-- File: slither/tools/demo/README.md (Tokens: ~300 | Category: plugin-manifest) -->\n# demo Documentation\n\nPath: `slither/tools/demo/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/demo/README.md)\n\n<!-- File: slither/tools/erc_conformance/README.md (Tokens: ~300 | Category: plugin-manifest) -->\n# erc_conformance Documentation\n\nPath: `slither/tools/erc_conformance/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/slither/tools/erc_conformance/README.md)\n\n<!-- File: tests/tools/mutator/test_data/test_source_unit/README.md (Tokens: ~300 | Category: plugin-manifest) -->\n# test_source_unit Documentation\n\nPath: `tests/tools/mutator/test_data/test_source_unit/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/crytic/slither/HEAD/tests/tools/mutator/test_data/test_source_unit/README.md)\n</yakaai_skills>"}