I ran my Solidity scanner across the 10 most-audited codebases in web3. Here's every flag.

The dirty secret of automated smart-contract security tools isn't that they miss bugs. It's that they cry wolf. Point a typical static analyzer at a clean codebase and you'll get forty "criticals" — and after the third false alarm, your team stops reading the output entirely. A tool nobody trusts is worse than no tool at all.

So when I built , leaving it to the integrator. OpenZeppelin's ERC-4626 adds that defense; Solmate's doesn't. The scanner flags the difference — and it's right to. This is signal, not noise.

Morpho Blue — reentrancy candidates. False positives. Morpho Blue is formally verified with the Certora Prover, and the external calls the heuristic latched onto are safeTransfers with correct effects-before-interactions accounting. A pattern-matcher can't see a formal proof; a reviewer can.

Solady — seven flags, all false positives. A documented tx.origin rescue default in Lifebuoy (with explicit warnings in the code), UUPS/ERC-1967 upgrade authorization the regex doesn't parse, and one intentional math ordering. Solady is some of the most carefully-optimized Solidity written; the "issues" are the tool not understanding assembly-level auth, not real holes.

Why this matters more than a big number

I could have tuned the detectors until they screamed on everything and called it "thorough." That's easy, and useless. The skill in this job isn't generating findings — it's not drowning the two that matter under thirty-eight that don't.

A clean run on OpenZeppelin, forge-std, Permit2 and PRBMath means that when this tool does flag something in your code, it's worth a look. And when a human (me) reviews the output, I'm clearing a handful of explainable candidates — not wading through a wall of red.

The goal was never a tool that says "zero bugs." Nothing can promise that. The goal is signal over noise — and a claim you can check yourself rather than one you have to trust.

Check it yourself

git clone --depth 1 https://github.com/OpenZeppelin/openzeppelin-contracts /tmp/oz

pipx run --spec git+https://github.com/juan23z/openclaw-audit openclaw-audit /tmp/oz

# → 0 candidate observations across 247 client .sol contracts

Swap in any repo above — or your own. The full · human review + continuous monitoring: juan23z.github.io