OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Smart Contracts

Securify 2.0

Securify 2.0 is a command-line static-analysis security scanner for Ethereum smart contracts written in Solidity. It checks contracts against documented vulnerability patterns using context-sensitive analysis implemented in Datalog.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Securify 2.0 — OpenViST project profile in Smart Contracts.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use it during development or an initial review when you want static-analysis findings to help identify issues for further investigation.

Who it is for

  • Solidity developers checking flat contracts during development.
  • Reviewers who want pattern-based findings to inform a deeper smart-contract assessment.

Documented uses

  • Scan a local Solidity source file for documented security patterns.
  • Retrieve a contract through Etherscan for scanning, using an API key.
  • Filter analysis by severity or inspect the available patterns.
Before you choose

Requirements & limits

The project is available as a public GitHub repository under the Apache-2.0 license. Etherscan-based contract retrieval requires an Etherscan API key.

  • The README states support for Solidity 0.5.8 and later.
  • Only flat contracts without import statements are currently supported.
  • The documented setup requires Python, solc, Souffle and Graphviz; a Docker workflow is also described.
  • The Docker example defaults to solc 0.5.12 and calls for changing the Dockerfile's SOLC argument when using another compiler version.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Scan a local Solidity contract with Docker

Build the documented Docker image and run it against a local contract file.

Before you start

  • Docker
  • A local Solidity contract in a directory
  • The contract must be flat and contain no import statements

Steps

  1. From the project root, build the image with sudo docker build -t securify ..

  2. Run the image with the contract directory mounted at /share: sudo docker run -it -v :/share securify /share/.sol.

Expected outcome

The container runs Securify against the specified local Solidity file.

Guide limitations

  • The documented input support is limited to flat contracts without imports.
  • The Dockerfile defaults to Solidity compiler version 0.5.12; using another version requires changing its SOLC argument and rebuilding.
Documentation 1 ↗
Source-based practical guide

Prepare the Python environment for Securify

Set up the documented project environment and install its dependencies.

Before you start

  • Python installed, with Python 3.7 used for the documented virtual environment
  • solc, Souffle and Graphviz installed
  • The Securify repository cloned locally

Steps

  1. Create and activate the virtual environment from the project root with virtualenv --python=/usr/bin/python3.7 venv and source venv/bin/activate.

  2. Check the active interpreter with the command below.

    Documented command
    python --version

  3. From securify/staticanalysis/libfunctors, set LD_LIBRARY_PATH to include the current directory as shown in the README.

  4. From the project root, run the command below, the command below and the command below.

    Documented command
    pip install --upgrade pip
    Documented command
    pip install -r requirements.txt
    Documented command
    pip install -e .

Expected outcome

The documented virtual environment and project dependencies are set up; the README says to activate the environment before running framework scripts.

Guide limitations

  • This recipe covers setup only; it does not execute a contract scan.
  • Souffle's unstable version is discouraged in the project instructions.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
13 October 2026
Original website title
eth-sri/securify2 · Official homepage title · retained in its source language
How we review sourcesSuggest a correction