Sponsored Listings
Reach founders at the moment they are shopping for security.
Everyone on our tools directory is comparing auditors and tools before they spend. Three slots, clearly labeled, never mixed into our rankings.
- Labeled, never ranked
- Three slots per page
- No interstitials or pop-ups
Audience
- Auditors
- 42
- Tools
- 64
Traffic and unique-visitor figures are available on request. We do not publish a guessed number.
Security Tools
Open source and commercial tools for smart contract security, monitoring, and threat detection.
4naly3er
4naly3er is Picodes' open-source Solidity static analyzer. Point it at a contracts directory, with an optional scope file, and it writes report.md from regex and solc-AST detectors in gas, non-critical, low, medium, and high buckets; the README's sample reports are from Code4rena contests.
Updated
Aderyn
Cyfrin's open-source Rust static analyzer for Solidity. The CLI writes vulnerability reports; the VS Code extension documents AI-suggested remediation from Quick Fix.
Updated
Arkham Intelligence
Arkham is a blockchain explorer that groups addresses into labeled entities and lets you graph and trace fund flows across chains. Use its alerts, token-holder views, or the Intel Exchange when you need the entity behind an address rather than a raw transaction list.
Updated
AuditAgent
AuditAgent is Nethermind's AI scanner for Solidity, Cairo, and Solana Rust. Run it on a repository, a deployed contract, in CI, or from an MCP client when you want a vulnerability report and suggested invariants before a manual audit.
Updated
Blockaid
Blockaid screens transactions, dApps, and tokens in real time for scams, fraud, exploits, and compliance risk. Wallets use it for end-user protection; protocol and wallet operators use onchain monitoring and Cosigner when they need programmatic policy checks.
Updated
cargo-audit
cargo-audit scans a Cargo.lock for crates with security vulnerabilities reported to the RustSec Advisory Database. Run it at the project root or in CI before a release; cargo audit bin checks compiled binaries, and an optional fix feature can update vulnerable requirements in Cargo.toml.
Updated
Certora Prover
Certora Prover checks smart-contract bytecode against rules you write in the Certora Verification Language (CVL). Use it when you need an SMT-backed check that those rules hold on the modeled executions, with a concrete counterexample trace when an assertion fails.
Updated
Chainalysis
Chainalysis is a blockchain analytics platform for compliance and investigations. KYT scores transfers on your platform and alerts on the risk rules you set; Reactor is where those alerts are traced across chains, mixers, bridges, and labeled entities.
Updated
ChainGPT Smart Contract Auditor
ChainGPT's Smart Contract Auditor is an AI review of Solidity you paste, load from GitHub, or select as a deployed contract, offered as a quick pass or a longer full report. Use it as a development-time screen; ChainGPT's docs say a human review is what still provides the finer-grained result.
Updated
Chaos Labs
Chaos Labs builds onchain risk oracles and proof-of-reserves feeds that update protocol parameters and collateral attestations in real time, inside governance-set bounds. Use the oracle product when a market needs automated risk limits or an independent reserve check; the homepage also describes enterprise AI-workflow infrastructure.
Updated
Circomspect
Circomspect is Trail of Bits' static analyzer and linter for the Circom language. Run it on a circuit file or directory when you need warnings for under-constrained signals, unconstrained division or LessThan, and assignments that never reach a constraint.
Updated
De.Fi Scanner
De.Fi Scanner checks a token, NFT, or contract address and returns a De.Fi Score plus findings grouped as high risk, medium risk, and attention required. Use it before interacting with a contract when you want honeypot, mint, proxy, and admin-permission checks on the EVM chains it lists, or on Solana tokens.
Updated
Dedaub Decompiler
The Dedaub Decompiler reconstructs deployed EVM bytecode into a Solidity-like view, with Yul, three-address code, disassembly, and a recovered ABI on the same page. Use the web app when source is missing or you are reading a proxy or an exploit deployment; individual use is free and the API is a paid plan.
Updated
DeFiSafety
DeFiSafety scores DeFi protocols from 0 to 100 on process quality: smart contracts and team, documentation, testing, security, admin controls, and oracles. Use a Process Quality Review or a pre-audit review when you want an independent read on what a team has published.
Updated
Echidna
Echidna is a Haskell fuzzer for Ethereum smart contracts that builds ABI call sequences to falsify invariants, Solidity assertions, or Foundry-style tests. Use it when you can name a property — an echidna_ function, an assert, or a Foundry test — and want a minimized call sequence if the campaign breaks it.
Updated
Elliptic
Elliptic is crypto compliance software for screening wallets and transactions, monitoring AML risk, and investigating fund flows across chains. Use it when a bank, exchange, or government team needs that on-chain risk decision; the homepage also describes agentic AI inside those workflows.
Updated
Fireblocks
Fireblocks is digital-asset and stablecoin infrastructure for custody, payments, treasury, wallets, and tokenization. Use it when an organization is building those operations.
Updated
Flashbots Protect
Flashbots Protect submits transactions to a private mempool so they are hidden from frontrunning and sandwich bots, and it can refund MEV or priority fees. Point eth_sendRawTransaction at rpc.flashbots.net/fast when a transaction should stay out of the public mempool; reverted transactions are not included and are not charged.
Updated
Fordefi
Fordefi is an institutional MPC wallet: self-custodied keys, a policy engine, and transaction simulation before you sign. Use it when a trading or treasury team needs to connect to dApps without a blind signature; the site states a 99.9% uptime guarantee.
Updated
Forta
Forta is an onchain risk platform: Forta Risk maps and monitors dependencies behind assets, and Forta Firewall screens transactions at the sequencer. Use Forta Risk for ongoing exposure alerts, or Firewall when undesired transactions should be stopped before execution.
Updated
Foundry Fuzz
Forge fuzzes Solidity test functions that take parameters, 256 runs by default, inside a Foundry project. Use forge test when you want those random inputs, and vm.assume or bound when an input must stay in range.
Updated
Gambit
Gambit rewrites Solidity with mutation operators, such as turning a + b into a - b, and writes the mutants to disk. Use gambit mutate when you want to see whether a test suite or a formal spec still fails on those edits; it needs a compatible solc.
Updated
Gauntlet
Gauntlet curates onchain yield vaults and publishes the risk-management work behind them, for fintechs, exchanges, wallets, and asset issuers. Use it when you want those curated vaults or the risk framework the site describes.
Updated
GoPlus Security
GoPlus Security APIs return token, address, approval, NFT, dApp, and phishing-URL risk data, and can simulate a transaction on EVM chains and Solana. Call the token or address API before a transfer or an approval; the Token Security API for Solana is marked Beta in the docs.
Updated
Halmos
Halmos is a symbolic testing tool for EVM smart contracts, with a Solidity and Foundry frontend. Run halmos in a Foundry project when you want existing tests explored symbolically.
Updated
Harvey
Harvey is the EVM-bytecode fuzzer inside Diligence Fuzzing: it generates and mutates inputs to explore execution paths. Use it through a Foundry fuzz campaign or Scribble property annotations submitted with the Diligence Fuzzing CLI.
Updated
Heimdall
Heimdall is a Rust toolkit for EVM bytecode: disassembly, control-flow graphs, decompilation, storage dumps, and decoding of calldata and traces. Use it on unverified bytecode when you need one of those views.
Updated
Hexagate
Chainalysis Hexagate: real-time Web3 threat detection and prevention (formerly Hexagate standalone).
Updated
Hypernative
Real-time Web3 threat detection and prevention platform using proprietary ML models. Detects cyber, economic, governance, and community threats before they have impact.
Updated
Immunefi Bug Bounty
The largest Web3 bug bounty platform. Connects security researchers with protocols offering bounties up to $10M+ for critical vulnerabilities.
Updated
KEVM
Formal semantics of the EVM in the K Framework. Enables rigorous verification of smart contract bytecode against formal specifications.
Updated
Kontrol
Formal verification tool that combines KEVM with Foundry, letting developers verify smart contracts symbolically using existing test suites without learning new languages.
Updated
Ledger Enterprise
Hardware security module (HSM) based custody solution for institutions. Air-gapped signing with governance rules and DeFi connectivity.
Updated
Medusa
Parallelized smart contract fuzzer based on go-ethereum. Designed for high-throughput fuzzing with coverage-guided mutation strategies.
Updated
MetaSleuth
On-chain fund tracking and investigation platform by BlockSec. Traces transaction flows and wallet relationships for incident response and forensic analysis.
Updated
Move Analyzer
VSCode plugin suite by MoveBit providing syntax highlighting, code completion, diagnostics, and Move Specification Language support for Aptos and Sui development.
Updated
Move Prover
Formal verification tool for Move smart contracts on Aptos. Uses Move Specification Language to mathematically prove contract correctness.
Updated
Mythril
Symbolic execution tool for EVM bytecode analysis. Detects security vulnerabilities in Ethereum smart contracts.
Updated
Nansen
AI-driven on-chain analytics platform with 500M+ labeled wallets. Tracks smart money flows, whale movements, and DeFi activity across major chains.
Updated
npm audit
Built-in Node.js dependency vulnerability scanner. Checks installed packages against the GitHub Advisory Database.
Updated
Olympix
Deterministic static analysis, unit-test generation, and mutation testing for Solidity, with an AI-assisted proof-of-concept component. Runs as a VS Code extension and in CI.
Updated
OpenZeppelin Defender
OpenZeppelin Defender (hosted ops platform) reached its planned final shutdown on July 1, 2026; sign-ups closed 2025-06-30. Migrate to the open-source OpenZeppelin Monitor and Relayer.
Updated
Phalcon
Crypto hack blocking system by BlockSec. Real-time attack detection in the mempool and automated response, with $20M+ saved in whitehat rescues.
Updated
Picus
In-house ZK circuit vulnerability detection tool by Veridise. Specifically designed for ensuring correctness of zero-knowledge circuit implementations.
Updated
Pyrometer
Abstract interpretation-based Solidity analyzer by Nascent. Detects range violations and arithmetic issues through value-range analysis.
Updated
QuillShield
AI-powered smart contract analyzer by QuillAudits that detects logical errors beyond common vulnerability patterns in Solidity code.
Updated
Recon
Unified invariant testing platform that integrates Echidna, Medusa, Halmos, and Foundry into one workflow with auto-generated boilerplate and parallel fuzzing.
Updated
Safe (Gnosis Safe)
The most trusted smart contract wallet for multisig asset management. Secures $60B+ in digital assets with $1T+ in transaction volume across 40+ networks.
Updated
Scribble
Specification language and runtime verification tool for Solidity. Annotate contracts with properties that are checked at runtime or via fuzzing.
Updated
Semgrep (Solidity)
Lightweight static analysis with custom Solidity rules. Fast pattern matching for security anti-patterns in smart contract code.
Updated
Slither
Static analysis framework for Solidity smart contracts. Detects vulnerabilities, optimizes gas usage, and suggests code improvements.
Updated
Snyk
Developer-first security platform for open-source dependencies, containers, and infrastructure as code. Finds and fixes vulnerabilities automatically.
Updated
Socket.dev
Supply chain security for open-source dependencies. Detects malicious packages, typosquats, and compromised maintainers before they reach your project.
Updated
Solhint
Solidity linter for code quality and security rules. Catches common mistakes and enforces best practices in smart contract development.
Updated
Solidity Visual Developer
VSCode extension for smart contract auditors. Provides visual code analysis, flowchart generation, and security-focused code navigation for Solidity.
Updated
Surya
Smart contract visualization tool by ConsenSys. Generates call graphs, inheritance diagrams, and function interaction maps for Solidity codebases.
Updated
Tenderly
Full-stack blockchain development platform with transaction simulation, debugging, monitoring, and alerting for EVM chains.
Updated
Token Sniffer
Automated token contract scanner for detecting rug pulls, honeypots, and scam tokens across EVM chains. Free to use for basic analysis.
Updated
TRM Labs
Blockchain intelligence platform covering 77 chains with FedRAMP High authorization. Used by government agencies and financial institutions for compliance and investigation.
Updated
Trugard
AI-driven smart contract risk intelligence engine, acquired by Webacy. Uses dynamic analysis to predict contract behavior beyond known vulnerability patterns.
Updated
Veritas Protocol
Automated smart contract audit platform using AI to find vulnerabilities faster and cheaper than manual audits.
Updated
Vertigo-rs
Mutation testing framework for Solidity smart contracts. Introduces subtle code changes (mutants) to verify your test suite catches real vulnerabilities.
Updated
Wake
Python-based Solidity development and testing framework with built-in vulnerability detectors and cross-reference analysis.
Updated
X-Ray (Sec3)
Open-source static analysis tool for Solana programs by Sec3 (formerly Soteria). Analyzes Rust code for common Solana-specific vulnerabilities including missing account validation and CPI issues.
Updated
Sponsored
Partners we have relationships with that can improve your security posture
Become a sponsor