Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.solidscipt.zoracle.xyz/llms.txt

Use this file to discover all available pages before exploring further.

SolidScript ships two commands that run its security pipeline: verify and secure-deploy. verify reports findings without blocking. secure-deploy refuses to deploy unless all enabled gates pass, making it the right command for any environment that touches real value. 
npx solidscript verify contracts
npx solidscript verify contracts --deep
npx solidscript secure-deploy contracts -c MyToken -n base-sepolia

​
Gates

#GateEngineWhat it catches
1Native validatorSolidScriptFootguns including tx.origin, selfdestruct, zero-address mint, unbounded loops, missing visibility, and view mutation
2Solc compilesolcSyntax and type errors in emitted Solidity
3SMTCheckerSolc/Z3Assertions, arithmetic safety, division by zero, contract-level invariants
4MythrilMythril/Z3Deeper symbolic execution paths; opt in with --deep
5SlitherSlitherReentrancy, arbitrary send, weak randomness, locked ether, strict equality risks
6Pattern librarySolidScriptUnsafe or unknown inherited bases/imports
7Fuzz harnessForgeUnexpected reverts across generated public-method fuzz tests
8Invariant testsForge@invariant properties across random call sequences
9AttestationSolidScriptReproducible-build manifest and gate results

​
Skipping gates during local iteration

You can skip slow gates while iterating locally. Pass --skip with a comma-separated list of gate names, or tune fuzz depth with --fuzz-runs: 
npx solidscript verify contracts --skip fuzz,invariants,patterns
npx solidscript verify contracts --fuzz-runs 5000

​
Running deep symbolic execution

Mythril is slower than the default path, so it is opt-in via --deep. You can also cap its timeout to keep CI times predictable: 
npx solidscript verify contracts --deep
npx solidscript verify contracts --deep --mythril-timeout 30
The pipeline catches code-level vulnerability classes. It cannot prove economic trust assumptions, off-chain relayer correctness, or chain reorg behavior.