I ran my Solidity scanner on 6 top-audited DeFi protocols. Every 'critical' was a false positive — here's why.

Most Solidity scanners are high-recall, low-precision. They flag 40 things, 38 are noise, and after the third report you stop reading them — so the one real bug ships. Precision, not recall, is what makes a security tool actually get used.

I've been building OpenClaw, a heuristic Solidity scanner with the opposite bar: silence on sound code. To pressure-test it, I pointed it at six codebases that top firms have already audited — Yearn, Sablier, Ajna, Liquity, and a couple of smaller protocols — and hand-verified every single flag.

The result: 14 HIGH/CRITICAL candidates across the six. Every one was a false positive.

That sounds like a failure. It's the whole point — and each FP is a lesson in the exact traps that fool most scanners. Here they are.

1. The "donation attack" that isn't (a PaymentSplitter)