KESTROVA | Solidity Security Analysis

Documentation

How a scan works

  1. You paste Solidity or upload a .sol file on the Scanner page.
  2. Kestrova picks a Solidity compiler that matches your pragma solidity line and compiles the code.
  3. Slither runs its vulnerability detectors over the compiled contract.
  4. You see every finding: its severity, the affected lines and code, a plain-English explanation and remediation guidance. Guidance written for that specific detector is labelled; anything else is marked as general guidance.

Your code must compile on its own: include any contracts it imports in the same text. Imports from packages such as OpenZeppelin are not downloaded.

Reading results

Slither reports five levels:

  • High: patterns that often allow loss of funds or control, such as reentrancy or unprotected transfers.
  • Medium: patterns that can cause incorrect behaviour, such as unchecked return values or tx.origin authorisation.
  • Low: smaller risks, such as missing zero-address checks.
  • Informational: code-quality notes.
  • Optimization: gas-saving suggestions.

Slither does not use a "Critical" level, and Kestrova does not invent one. Every finding is an automated finding: a code pattern that matches a known risk. It is not a verified vulnerability until a person confirms it can actually be exploited in your contract. Some findings will be false positives.

Pricing

  • Free scan: free, no account, no wallet, and complete: every finding the engine reports. A few scans per hour and a daily limit per visitor; identical code is answered from a short-lived cache.
  • Professional Security Report: a fixed 1 USDC, optional, after your free scan. It adds a downloadable PDF with an executive summary, SARIF and JSON exports, and a shareable summary with scope, file hashes, a report ID and the payment receipt. It contains the same findings as your free scan. On the website you pay from your own Solana wallet (Phantom, Solflare, Trust Wallet or another wallet that supports Solana transaction signing for websites) when online checkout is open, plus a Solana network fee of less than 0.0001 SOL. On a phone without a wallet you can continue in your wallet app; your code moves with you through a one-time link. The wallet check shows which wallets in your browser can pay. Developers can buy reports through the API and MCP server with x402 payments.
  • If something goes wrong: your purchase is saved in your browser and on Solana. Reopen the Scanner page and choose Resume; Kestrova finds the payment on Solana and delivers the report. A second payment for the same order is detected and flagged for refund.

There are no subscriptions or hidden fees. Kestrova never asks for your seed phrase or private key.

Privacy

Your code is scanned in a temporary folder that is deleted afterwards and is never written to our logs or database. Kestrova never asks for your seed phrase or private key. Details, retention and your rights: Privacy Policy.

Limits and errors

  • Size: up to 60 kB of source for the free scan.
  • Rate limit: a few free scans per hour and a daily limit per visitor. If you reach it, wait and try again later.
  • Busy: scans run one at a time; your scan waits briefly in a queue. If the queue is full, retry after a few seconds.
  • Start-up: if the service has been idle, the first scan can take up to a minute while it starts.
  • Compile errors: if your code does not compile, you will see the compiler message. Check the pragma and include imported files.

What scans cannot find

Static analysis looks for known code patterns. It does not cover business-logic errors, economic, oracle or MEV attacks, whether access control matches your intent, upgrade and admin-key risks, code you did not include, or deployment configuration.

Automated static analysis is not a substitute for a professional security audit. A scan with no findings does not mean a contract is secure.