SmartReco — Static and Dynamic DeFi Contract Analysis
A four-stage pipeline that pairs Slither's static analysis with REVM-based transaction replay, then checks findings from one against the other across 17 live DeFi protocols.
At a glance
Static analyzers flag what might go wrong; replaying real transactions shows what actually happened. SmartReco runs both over the same contracts and correlates the results, so a finding has to survive two independent methods before it counts.
The problem
Public bodies, funds and companies increasingly hold value that moves through smart contracts — tokenized assets, payment rails, grant-disbursement pilots. The code is public, which is routinely mistaken for the code being understood. In practice the organization has to answer a question it has no instrument for: does this contract behave the way its source suggests, on-chain, with real money?
- A professional audit is scarce and expensive, and it is a point-in-time document — the contract keeps running long after the report is filed.
- Static analyzers are affordable and produce long lists of things that might be wrong. A team triages the list a few times, finds mostly noise, and stops reading it. Alert fatigue is how the real finding gets missed.
- A warning that cannot be tied to observed behavior is not evidence. It is not something a risk officer can act on, escalate, or put in front of a board.
How this helps
SmartReco makes a finding earn its place by requiring two independent methods to agree. Slither reads the source and proposes what could go wrong; a REVM harness replays transactions that really happened and shows what did. The two passes are correlated, so what reaches a human has survived both.
- Less noise per finding. Cross-checking static warnings against replayed execution filters exactly the false positives that cause teams to abandon the tool.
- Evidence, not conjecture. A finding backed by a replayed transaction can be shown, reproduced and argued about — the form a risk finding has to take before anyone acts on it.
- Continuous rather than point-in-time. The pipeline is a program, so it can be re-run as the chain moves, instead of describing the contract as it was on the day of an audit.
- The measurable claim is the harness. Over 90% replay accuracy across 17 major protocols is what says the observations can be trusted; zero vulnerabilities on contracts this heavily audited is the expected result, not the achievement.
The generalizable part is not DeFi-specific. Any due-diligence question of the form does this deployed system do what its source implies has the same structure: one method that reasons about the code, one that observes it running, and a correlation step that only surfaces what both support.
What it does
- Runs Slither static analysis over contract source to produce candidate findings.
- Replays historical on-chain transactions through REVM to observe real execution.
- Correlates the two passes, so static warnings are checked against actual behavior.
- Was exercised against 17 major DeFi protocols, including Aave V3, Compound V3, Uniswap V3, Balancer V2, and Lido.
Results
Across the 17 protocols tested, the pipeline reported zero vulnerabilities and reached over 90% transaction replay accuracy after a round of bug fixes to the replay layer.
A zero-finding result on mature, heavily audited protocols is the expected outcome — these are among the most reviewed contracts in production. The meaningful number here is the replay accuracy, because that measures whether the harness faithfully reproduces on-chain execution, which is what any finding would rest on.
Presentation
The work was written up and presented as an interactive HTML slide deck rather than a static report, so the pipeline stages and per-protocol results could be stepped through.