Static-analyzer high-severity count
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor records the count of high-severity findings flagged by static analysis tools -- specifically Slither, Mythril, and Semgrep -- run against the protocol's deployed bytecode and verified source code, after deduplication across tools. The count excludes findings that have documented on-chain fixes or that the protocol has formally acknowledged and risk-accepted with curator review. The measurement is programmatic and runs on each assessment cadence using the verified source from Etherscan.
**Why it matters** Static analyzers detect a broad range of well-documented vulnerability patterns automatically: reentrancy, unchecked return values, integer overflow, arbitrary call targets, and storage collision risks. A high count of unresolved high-severity findings indicates that the protocol has deployed code with known warning patterns that have not been investigated or resolved. While false positives exist, each unresolved high finding represents a potential real vulnerability that deserves manual review. Protocols with large numbers of unaddressed static findings have consistently lower code quality baselines in the historical exploit dataset.
**Green / Yellow / Red** Green: zero unresolved high-severity static analysis findings across all deployed contracts covering user funds, or all findings are documented as accepted-risk with curator rationale on file. Yellow: one to three unresolved high-severity findings in non-critical contract paths, with documentation that the team is aware. Red: four or more unresolved high-severity findings, or any unresolved finding in a function that directly controls user fund movements.
**Common gray cases** Curators cannot grade this factor when the protocol's source is not verified on any explorer and static analysis cannot be run, or when the verified source is Yul or assembly-heavy code that the standard Slither/Mythril detectors cannot parse reliably.
**Notable historical examples** Static analyzer findings are a preventive input that correlates with code quality rather than directly with exploits.
Measurement what to look for #
Count the number of unique high-severity detector findings from Slither + Mythril + Semgrep run against the deployed verified source (after deduplication across tools).