How to Audit Stablecoin Smart Contracts: My Hard-Learned Lessons with Slither & Mythril

# I always start with a fresh Python environment to avoid conflicts
python3 -m venv slither-env
source slither-env/bin/activate

# Install Slither with all dependencies
pip3 install slither-analyzer

# Verify installation - this command saved me hours of debugging
slither --version

# Install Mythril via pip (Docker is more reliable but slower)
pip3 install mythril

# Alternative Docker setup I use for complex projects
docker pull mythril/myth

# Test installation with a simple contract
myth analyze --solv 0.8.19 simple_contract.sol

// slither-config.json - My battle-tested configuration
{
  "detectors_to_exclude": [
    "similar-names",     // Too many false positives in stablecoin contracts
    "too-many-digits"    // Stablecoins naturally have large numbers
  ],
  "detectors_to_include": [
    "reentrancy-eth",
    "reentrancy-no-eth", 
    "uninitialized-storage",
    "arbitrary-send",
    "controlled-delegatecall"
  ],
  "compilation_skip_size": 10000000
}

# My standard first command for every stablecoin audit
slither . --config-file slither-config.json --print human-summary

# Generate a detailed report I can reference throughout the audit
slither . --checklist --markdown-root . > initial-findings.md

// Example vulnerable stablecoin function I found last week
function mint(address to, uint256 amount) external {
    // BUG: No reentrancy protection!
    require(_totalSupply + amount <= maxSupply, "Exceeds max supply");
    
    // BUG: External call before state update
    collateralToken.transferFrom(msg.sender, address(this), amount);
    
    _totalSupply += amount; // State change after external call
    _balances[to] += amount;
    
    emit Transfer(address(0), to, amount);
}

Reentrancy in StableCoin.mint(address,uint256):
    External calls:
    - collateralToken.transferFrom(msg.sender,address(this),amount)
    State variables written after the call(s):
    - _totalSupply += amount
    - _balances[to] += amount

# My Mythril command for comprehensive stablecoin analysis
myth analyze stablecoin.sol \
  --solv 0.8.19 \
  --execution-timeout 900 \
  --max-depth 22 \
  --strategy bfs \
  --call-depth-limit 10

==== Integer Overflow ====
SWC ID: 101
Severity: High
Contract: StableCoin
Function name: calculateCollateralRatio()
PC address: 2847
Estimated Gas Usage: 8234 - 28954

The arithmetic operation can result in an integer overflow.
In function 'calculateCollateralRatio()'
The variable 'collateralValue * PRECISION' can overflow.

# custom_stablecoin_detector.py
from slither.detectors.abstract_detector import AbstractDetector, DetectorClassification

class StablecoinOracleManipulation(AbstractDetector):
    """
    Detect potential oracle manipulation in stablecoin price feeds
    """
    
    ARGUMENT = 'stablecoin-oracle-manipulation'
    HELP = 'Price oracle calls without manipulation protection'
    IMPACT = DetectorClassification.HIGH
    CONFIDENCE = DetectorClassification.MEDIUM

    def _detect(self):
        results = []
        
        for contract in self.compilation_unit.contracts:
            for function in contract.functions:
                # Check for oracle calls without time delays or validation
                if self._has_oracle_call_without_protection(function):
                    results.append(self._build_result(function))
        
        return results

# mythril_stablecoin_analyzer.py
from mythril.mythril import MythrilDisassembler, MythrilAnalyzer
from mythril.ethereum import util

def analyze_stablecoin_timelock_issues(contract_path):
    """
    Custom analysis for stablecoin timelock and governance issues
    """
    disassembler = MythrilDisassembler()
    disassembler.load_from_solidity([contract_path])
    
    analyzer = MythrilAnalyzer(
        disassembler=disassembler,
        onchain_storage_access=False,
        strategy="bfs",
        max_depth=22,
        execution_timeout=600
    )
    
    # Focus on governance and timelock functions
    target_functions = [
        "updateTimelock",
        "executeProposal", 
        "emergencyPause",
        "changeGovernance"
    ]
    
    return analyzer.fire_lasers(modules=["stablecoin-governance"])

StableCoinVault.liquidate(address) uses arbitrary from in transferFrom: 
    collateralToken.transferFrom(user,liquidator,collateralAmount)

function liquidate(address user) external {
    uint256 collateralAmount = calculateLiquidationAmount(user);
    
    // BUG: No validation that msg.sender can liquidate this user
    collateralToken.transferFrom(user, msg.sender, collateralAmount);
    
    // Burn the user's stablecoins
    _burn(user, stablecoinAmount);
}

function getCollateralPrice() public view returns (uint256) {
    // BUG: Single oracle call without validation
    uint256 price = priceOracle.latestAnswer();
    
    // BUG: No staleness check or circuit breaker
    return price;
}

==== Dependence on predictable environment variable ====
SWC ID: 116
Severity: Medium
Contract: StableCoin  
Function name: getCollateralPrice()

The contract uses block.timestamp which can be manipulated by miners.
This price oracle implementation is vulnerable to manipulation attacks.

# My standard Slither command sequence for every audit
slither . --detect reentrancy-eth,reentrancy-no-eth
slither . --detect uninitialized-storage,uninitialized-state
slither . --detect arbitrary-send,controlled-delegatecall
slither . --detect timestamp,block-other-parameters
slither . --print human-summary,contract-summary

# Oracle manipulation detection
myth analyze --solv 0.8.19 --max-depth 22 --strategy bfs oracle_functions.sol

# Governance attack vectors  
myth analyze --solv 0.8.19 --execution-timeout 1200 governance.sol

# Economic logic verification
myth analyze --solv 0.8.19 --call-depth-limit 15 economic_logic.sol

# Skip compilation of test files and dependencies
slither . --ignore-compile --skip-assembly

# Focus on specific contracts instead of entire codebase
slither contracts/StableCoin.sol --detect reentrancy-eth

# Use parallel processing for multiple contracts
find contracts/ -name "*.sol" | xargs -P 4 -I {} slither {} --json {}

# Use lighter analysis for initial screening
myth analyze contract.sol --execution-timeout 300 --max-depth 12

# Deep dive only on flagged functions
myth analyze contract.sol --strategy dfs --max-depth 25 --execution-timeout 1800

# My current comprehensive audit workflow
slither . --config-file slither-config.json --print human-summary
myth analyze . --execution-timeout 900 --max-depth 22
# Custom economic simulation tests
python3 economic_attack_simulation.py
# Manual code review focusing on business logic

#!/bin/bash
# continuous_monitor.sh - Monitors deployed contracts for changes
CONTRACT_ADDRESS="0x..."
NETWORK="mainnet"

while true; do
    # Download latest contract code
    cast code $CONTRACT_ADDRESS --rpc-url $NETWORK > current_contract.bin
    
    # Compare with previous version
    if ! cmp -s current_contract.bin previous_contract.bin; then
        echo "Contract updated! Running security analysis..."
        slither current_contract.sol --detect all
        myth analyze current_contract.sol --execution-timeout 600
    fi
    
    sleep 3600  # Check every hour
done

# vulnerability_patterns.py
STABLECOIN_VULNERABILITY_PATTERNS = {
    'oracle_manipulation': [
        r'\.latestAnswer\(\)',
        r'\.getPrice\(\)',
        r'block\.timestamp'
    ],
    'reentrancy_vectors': [
        r'transferFrom.*_mint',
        r'call.*_burn',
        r'external.*internal'
    ],
    'privilege_escalation': [
        r'onlyOwner.*onlyGovernor',
        r'timelock.*immediate',
        r'emergency.*bypass'
    ]
}