The dirty secret of automated smart-contract security tools isn't that they miss bugs. It's that they cry wolf. Point a typical static analyzer at a clean codebase and you'll get forty "criticals" — and after the third false alarm, your team stops reading the output entirely. A tool nobody trusts is worse than no tool at all.
So when I built OpenClaw Audit — a free, open-source heuristic scanner for Solidity — I held it to a different bar. Not "how many things can it flag?" but the opposite: can it stay silent on code that's already sound?
There's a clean way to test that. Run it across the most-reviewed Solidity codebases on earth — the libraries that thousands of protocols depend on, audited many times over — and see how much noise it makes. A calibrated tool should be quiet here.
Here's what it found. Every number is reproducible in one command; every flag I checked by hand.
The results
