Static-analyzer high-severity count
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor records the count of high-severity findings flagged by static analysis tools -- specifically Slither, Mythril, and Semgrep -- run against the protocol's deployed bytecode and verified source code, after deduplication across tools. The count excludes findings that have documented on-chain fixes or that the protocol has formally acknowledged and risk-accepted with curator review. The measurement is programmatic and runs on each assessment cadence using the verified source from Etherscan.
Why it matters
Static analyzers detect a broad range of well-documented vulnerability patterns automatically: reentrancy, unchecked return values, integer overflow, arbitrary call targets, and storage collision risks. A high count of unresolved high-severity findings indicates that the protocol has deployed code with known warning patterns that have not been investigated or resolved. While false positives exist, each unresolved high finding represents a potential real vulnerability that deserves manual review. Protocols with large numbers of unaddressed static findings have consistently lower code quality baselines in the historical exploit dataset.
Green / Yellow / Red
Green: zero unresolved high-severity static analysis findings across all deployed contracts covering user funds, or all findings are documented as accepted-risk with curator rationale on file. Yellow: one to three unresolved high-severity findings in non-critical contract paths, with documentation that the team is aware. Red: four or more unresolved high-severity findings, or any unresolved finding in a function that directly controls user fund movements.
Common gray cases
Curators cannot grade this factor when the protocol's source is not verified on any explorer and static analysis cannot be run, or when the verified source is Yul or assembly-heavy code that the standard Slither/Mythril detectors cannot parse reliably.
Notable historical examples
No hacks are currently linked in the database for this specific factor as a standalone causal driver. Static analyzer findings are a preventive input that correlates with code quality rather than directly with exploits.
Measurement what to look for#
Count the number of unique high-severity detector findings from Slither + Mythril + Semgrep run against the deployed verified source (after deduplication across tools).