0 false positives on OpenZeppelin MIT no API keys Python + git

Free Solidity security scans
on every pull request

OpenClaw Audit is a fast heuristic security scanner for Solidity. Point it at a repo — or add the GitHub Action — and get a professional report in seconds. Calibrated to stay silent on sound code, so you get signal, not a wall of false positives.

⭐ Get it on GitHub Try it in one command ↓
The claim that sets it apart — and you can check it yourself:
0 findings across all of OpenZeppelin

247 source files, the most-audited codebase in web3 — zero noise. Most scanners flag dozens of non-issues there. Don't take our word for it:

pipx run --spec git+https://github.com/juan23z/openclaw-audit openclaw-audit \
  https://github.com/OpenZeppelin/openzeppelin-contracts
# → 0 candidate observations across 247 client .sol contracts

A claim you can verify, not one you have to trust.

⚡ Try it now

No clone, no config — one command (needs pipx):

pipx run --spec git+https://github.com/juan23z/openclaw-audit openclaw-audit <repo-or-path> --out ./report
# → ./report/report.md  +  ./report/report.html

Or add it to CI and get a scan on every push & PR — a summary lands as a comment on the PR:

# .github/workflows/security.yml
name: security
on: [push, pull_request]
permissions: { contents: read, pull-requests: write }
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: juan23z/openclaw-audit@v1

On the GitHub Marketplace. No API keys, no cost.

✅ Calibrated, not noisy

Run across 10 of the most-reviewed codebases in the ecosystem — every flag verified by hand. 14 candidates across 608 source files; 4 codebases perfectly clean.

CodebaseFilesFlags
OpenZeppelin Contracts2470
forge-std · Permit2 · PRBMath870
Uniswap v2 / v3 / v4-core973
Solmate · Morpho Blue374
Solady1407

Full breakdown — which flags are false positives (and why the heuristic fired), which are real, known design gaps → the Calibration Report.

🔍 What it checks — 12 detectors

Access control
unprotected privileged / init / sweep
Cross-function reentrancy
external call before state update
Oracle staleness
price reads without freshness checks
ERC-4626 rounding
rounding that favors the withdrawer
First-depositor inflation
empty-vault share inflation
Precision loss
division before multiplication
Unchecked low-level call
ignored call/send/delegatecall return
tx.origin auth
phishing vector
Donation attack
balanceOf(this) used for accounting
Fee-on-transfer
unhandled fee/rebasing assumptions
ERC compliance
ERC-20 / 4626 conformance
NatSpec
missing docs on critical functions

⚠️ Honest by design

These are heuristic candidates, not confirmed vulnerabilities. Static heuristics produce false positives — the report labels every item "candidate · verify". The whole point of the calibration above is that there aren't many, and each is explainable.

Want a human on it? A Pre-Mainnet Express review — full engine + hand-verified findings + a plain-English report in 48h — starts at $149. Or go deeper with a full core review + continuous monitoring → see pricing & services.

Free & MIT · built by Nawel · GitHub · Marketplace