Aderyn
A Rust-based static analyzer built specifically for Solidity smart contracts by Cyfrin. Analyzes AST of Solidity contracts to detect vulnerability patterns including reentrancy, unchecked return values, weak randomness, and centralization risks. Supports Foundry and Hardhat project layouts with zero configuration, outputting reports in Markdown, JSON, or SARIF.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Local CLI tool with excellent security posture - no network exposure, no secrets required. Rust implementation reduces memory-safety vulnerabilities. Maintained by professional security audit firm.
⚡ Reliability
Best When
An agent or CI/CD pipeline needs fast, automated detection of known Solidity vulnerability patterns before deployment.
Avoid When
You are working with non-Solidity contracts, need dynamic/runtime analysis, or require comprehensive audit coverage.
Use Cases
- • Automated pre-deployment security scanning of Solidity contracts in CI/CD pipelines
- • Generating SARIF reports for GitHub Code Scanning integration
- • AI-assisted smart contract review: agent runs Aderyn, interprets findings, and proposes fixes
- • Security audit preparation: pre-screen contracts before a full manual audit
- • DeFi protocol monitoring via GitHub Actions
Not For
- • Non-Solidity smart contract languages (Vyper, Rust/Anchor, Move, Cairo)
- • Runtime monitoring or dynamic analysis of deployed on-chain contracts
- • Full security audits - Aderyn catches known patterns but misses novel vulnerabilities
- • Ethereum mainnet live contract bytecode analysis (requires source and compilation)
Interface
Authentication
Runs entirely locally as a CLI tool and MCP server. No authentication, API keys, or network calls required.
Pricing
Agent Metadata
Known Gotchas
- ⚠ MCP server capability is GitHub-tagged but not documented - no published tool definitions or schemas
- ⚠ Requires complete Foundry or Hardhat project structure - won't analyze standalone .sol files
- ⚠ Windows requires WSL
- ⚠ GPL-3.0 copyleft license: linking into larger system may require GPL-3.0
- ⚠ Analysis time scales with codebase size - large DeFi protocols may exceed MCP timeouts
- ⚠ False positives for centralization risk detectors - agents should flag for human review
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Aderyn.
Scores are editorial opinions as of 2026-03-06.