Security & testing

Semgrep (smart-contracts rules)

Debugging & inspection

Static analysis · Security · Solidity

semgrep/semgrep https://pypi.org/project/semgrep/

Semgrep is a pattern-based static analysis tool with rulesets for Solidity vulnerabilities. Builders run those rules over a codebase to catch known vulnerable patterns and style issues before review.

Related resources

CodeTracer

CodeTracer is a user-friendly time-traveling debugger designed to support a wide range of web3 programming languages.

EDB: The Ethereum Project Debugger

EDB is a source-level debugger for Solidity execution with stepping, locals, watches, and breakpoints when you need IDE-grade visibility into contract behavior onchain or in tests.

Simbolik - Solidity Debugger

Simbolik is a powerful Solidity debugger that combines traditional breakpoint debugging with symbolic execution, enabling developers to explore every possible execution path and uncover vulnerabilities with precision. Available as a VSCode extension, Simbolik integrates seamlessly into existing workflows, offering breakpoint-style debugging, Solidity and EVM-level inspection, and formal verification capabilities.

Abi Ninja

Abi Ninja is a browser UI for calling contracts with known ABIs, pasted ABIs, or decompiled bytecode, with proxy-aware reads across many networks including your locally running Hardhat or Anvil node.

Tenderly

Tenderly provides transaction simulation, trace debugging, alerting, and Virtual TestNets for contracts. Builders use it to replay a failing transaction, watch deployed contracts, and test against a forked network.

sol2uml

sol2uml generates UML class and storage-layout diagrams from Solidity source or from verified contracts. Builders run it to see contract relationships and how state variables are packed into storage.