Every bug class we check for, with the code.
The 22 checks that make up the standards grid in every report — the SWC Registry entries the engine reasons about, and the OWASP Smart Contract Top 10. Each one explains what the bug is, what it costs you, the pattern that triggers it, and the fix.
SWC Registry
The Smart Contract Weakness Classification — the long-standing catalogue of Solidity and EVM failure modes. These are the checks that can be decided from the code itself.
An external call hands control to the callee before your own state is finished updating.
A function that moves money or changes ownership has no modifier restricting who can call it.
selfdestruct is reachable without an access-control check.
delegatecall runs someone else’s code against your storage and your balance.
Auth compares against tx.origin, which any intermediary contract can carry along.
Arithmetic wraps silently instead of reverting.
Randomness derived from block or transaction values the proposer controls.
The boolean returned by a low-level call is discarded, so failures pass silently.
A loop over data that users can grow eventually exceeds the block gas limit.
Logic depends on block.timestamp at a resolution block producers can influence.
A caret pragma lets the deployed bytecode come from a compiler you never tested.
A local or parameter hides a state variable, so writes go to the wrong place.
OWASP Smart Contract Top 10
A shorter, impact-ordered list aimed at what actually causes losses. It overlaps the SWC entries deliberately, and adds the categories that need economic reasoning rather than pattern matching.
Missing, wrong, or over-broad permissions on state-changing functions.
A price the contract trusts can be moved within a single transaction.
The OWASP framing of the same failure as SWC-107, including the cross-contract variants.
Uncollateralised capital within one transaction breaks any assumption that size implies commitment.
The code does exactly what it says, and what it says is wrong.
The OWASP framing of SWC-101, with emphasis on unchecked blocks and unsafe casts.
The OWASP framing of SWC-120 — on-chain randomness is not private.
Parameters are used without checking that they are within sane bounds.
Return values ignored, or external contracts trusted to behave.
The contract can be put into a state where legitimate operations no longer succeed.
How to use this
Read it as the checklist an audit runs, rather than as an encyclopedia. If you are shipping a contract, the fastest path is to work down the critical and high entries first — they account for the overwhelming majority of real losses — and to treat the low-severity entries as hygiene you fix once and never think about again.
Everything here is checked automatically on every audit, and the report shows which items passed as well as which fired. The audit checklist covers the same ground as a working procedure rather than a reference.
Check your contract against all of these
The engine runs every entry above and reports what passed as well as what failed. Testnet scans are free.
Start audit