OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Developer Tools

Semgrep Smart Contracts

Semgrep Smart Contracts is a public repository of Semgrep rules for scanning Solidity smart-contract code. Its rules target vulnerability patterns based on actual DeFi exploits and include gas-optimization checks that can be incorporated into CI pipelines.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Semgrep Smart Contracts — OpenViST project profile in Developer Tools.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use it during Solidity development or code review when you want repeatable Semgrep checks for exploit-related patterns and gas optimization, either locally or in CI.

Who it is for

  • Solidity developers who want to check code for known vulnerability patterns.
  • Teams adding smart-contract security and performance checks to CI.
  • Auditors who want Semgrep rules covering exploit-related patterns as part of code review.

Documented uses

  • Scan a Solidity project with the repository’s security rules.
  • Check code for patterns such as reentrancy, oracle manipulation and missing access controls.
  • Include security and gas-optimization rules in a GitHub Actions workflow.
Before you choose

Requirements & limits

The rules are available in a public GitHub repository and are also listed in the Semgrep registry. Some taint-mode analysis requires Semgrep Pro.

  • Semgrep currently supports Solidity in experimental mode, and the README warns that some rules may not work as expected.
  • The collection includes both security and gas-optimization rules, so teams can include both types of checks in CI.
  • Rules using taint mode require Semgrep Pro for intra-procedural taint analysis.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Add the rules to a GitHub Actions workflow

Configure the documented workflow to run security and gas-optimization rules on pull requests or on demand.

Before you start

  • A GitHub repository containing the Solidity project.
  • GitHub Actions and the workflow permissions needed for checkout and SARIF upload.

Steps

  1. Create .github/workflows/run-semgrep.yaml.

  2. Use the README workflow pattern to check out the project and this rules repository into a rules directory.

  3. Configure SEMGREP_RULES with rules/solidity/security rules/solidity/performance and run semgrep ci --sarif --output=semgrep.sarif || true.

  4. Use the documented SARIF upload step to send the output to GitHub Advanced Security.

Expected outcome

The workflow is configured to scan pull requests and support on-demand runs, then upload SARIF output.

Guide limitations

  • The README workflow excludes pull requests created by Dependabot.
  • Semgrep's Solidity support is experimental; some rules may not work as expected.
  • Some taint-mode analysis requires Semgrep Pro.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
16 October 2026
Original website title
Decurity/semgrep-smart-contracts · Official homepage title · retained in its source language
How we review sourcesSuggest a correction