Aderyn

Skill based on Aderyn (Cyfrin/aderyn), generated 2026-02-24.

Aderyn is a Rust-based Solidity static analyzer that finds vulnerabilities and code-quality issues. It supports Foundry and Hardhat with no config, optional aderyn.toml for path and detector control, and an MCP server for AI/editor integration. This skill focuses on agent use: CLI, configuration, detectors, report outputs, and MCP tools.

Core References

Features

Best practices

External links

• Cyfrin Aderyn docs
• Aderyn GitHub
• List of supported detectors
• VSCode Aderyn extension

Generation Info

• Source: sources/aderyn
• Git SHA: 29d0aa0283ebff87e4fff7de21eec31ea5ad00c3
• Generated: 2026-02-24

Project configuration (aderyn.toml)

Create with aderyn init. All paths are relative: root is relative to the workspace (directory where the config is or where the tool is run); src and path filters are relative to root.

Top-level fields

version = 1   # Required; only 1 is supported.

# Base path for remappings and compilation (e.g. directory with foundry.toml or hardhat.config).
root = "."

# Source directory for contracts. If omitted, inferred from Foundry ("src/") or Hardhat ("contracts/").
# src = "src/"

# Path fragments to include (partial or full). Omit = all files in source dir.
# include = ["src/counters/", "src/Main.sol"]

# Path fragments to exclude.
# exclude = ["/interfaces/", "src/mocks/"]

Detector filter

[detectors]
# Run only these detectors (names from `aderyn registry`).
include = ["unused-error", "weak-randomness"]

# Or run all except these.
# exclude = ["costly-loop", "empty-require-revert"]

If both include and exclude are omitted, all detectors run. Use either include or exclude, not both for the same run.

Environment

[env]
FOUNDRY_PROFILE = "icm"

Use when different profiles (e.g. in foundry.toml) change src or remappings. Standard Foundry/DAPP_ env vars apply.

Key points

• Config is optional: with no aderyn.toml, Aderyn uses project root and framework detection.
• Include/exclude: partial match (e.g. /interfaces/) or exact path (e.g. src/Main.sol).
• Remappings can also come from remappings.txt in root or from foundry.toml when applicable.

<!-- Source references:

• sources/aderyn/tests/toml/nested_project1/aderyn.toml
• sources/aderyn/tests/detector-include/aderyn.toml
• sources/aderyn/tests/foundry-nft-f23-icm/aderyn.toml
• https://cyfrin.gitbook.io/cyfrin-docs/project-configuration

-->

Report formats

Aderyn writes one report per run. Format is chosen by the -o filename extension: .md, .json, or .sarif.

Choosing format

aderyn -o report.md      # Markdown (default)
aderyn -o report.json    # JSON
aderyn -o report.sarif   # SARIF (CI / IDE integration)

Markdown structure

• Header: Tool attribution and disclaimer.
• Table of contents: Links to Summary and per-severity sections.
• Summary: Files summary (e.g. .sol count, nSLOC), file list, issue counts (High / Low).
• High Issues / Low Issues: Each issue has a title (e.g. L-1: Unspecific Solidity Pragma), description, and <details> with instances: file, line, and code snippet.

Use --no-snippets (hidden flag) to omit code snippets and reduce report size in large repos.

JSON and SARIF

• JSON: Structured list of issues with severity, title, description, and locations (file, line).
• SARIF: Standard format for static analysis; use for GitHub Code Scanning, VS Code, or other SARIF consumers.

Key points

• Default output path is report.md; override with -o.
• Severities are High and Low only.
• Detector names in reports match aderyn registry (kebab-case).

<!-- Source references:

• sources/aderyn/reports/detector-include-report.md
• sources/aderyn/aderyn_driver (runner, interface)
• https://github.com/Cyfrin/aderyn

-->

Detectors

Aderyn ships with many built-in detectors. Each has a kebab-case name, a severity (High or Low), and optional config via aderyn.toml or --highs-only.

Listing detectors

aderyn registry           # All detectors, grouped by severity
aderyn registry all       # Same
aderyn registry weak-randomness   # Title, severity, description for one detector

Use these names in aderyn.toml under [detectors] include or exclude.

Severity

• High — Security-sensitive (e.g. reentrancy, unchecked sends, weak randomness, tx.origin).
• Low — Best practices, gas, style (e.g. unused state variable, unspecific pragma, costly loop).

Run only high-severity detectors:

aderyn --highs-only -o high.md

Config filter

In aderyn.toml:

[detectors]
include = ["unused-error", "weak-randomness", "unspecific-solidity-pragma"]
# or
exclude = ["costly-loop", "empty-require-revert"]

• include: only listed detectors run.
• exclude: all detectors run except listed ones.

Example detector names (kebab-case)

• High: weak-randomness, unchecked-send, tx-origin-used-for-auth, selfdestruct, unprotected-initializer, reentrancy-state-change, arbitrary-transfer-from.
• Low: unused-state-variable, unspecific-solidity-pragma, costly-loop, empty-require-revert, unused-error, unused-import, state-variable-could-be-immutable.

Full list: run aderyn registry.

Key points

• Detector IDs are kebab-case; use them exactly in config.
• Custom detectors are supported (see Cyfrin docs); built-in set is fixed per release.
• --highs-only is independent of config file; it restricts to High severity only.

<!-- Source references:

• sources/aderyn/aderyn_core/src/detect/detector.rs (IssueDetectorNamePool, severity)
• sources/aderyn/aderyn/src/lib.rs (print_all_detectors_view, print_detail_view)
• https://cyfrin.gitbook.io/cyfrin-docs/project-configuration/list-of-supported-detectors
• https://cyfrin.gitbook.io/cyfrin-docs/aderyn-cli/detectors-quickstart

-->