Every finding is one you can run.
ParaCheck measures the storage and parallelism patterns making your Solidity slow on a parallel EVM, and proves the bugs that could drain it — each finding backed by a trace or a failing test you can reproduce. Only proven findings block a merge.
Scans run on every pull request, or on demand from the dashboard.
NaiveAMM.solSample reportswap()reserve0, reserve1 and totalLiquidity are written on every swap, so concurrent swaps serialise.
deposit()balance[user] is loaded four times in one path.
claim()lastClaim is rewritten even when the value is unchanged.
The problem
On a chain that executes transactions in parallel, two transactions touching the same storage slot cannot run at the same time. One is thrown away and re-executed.
That cost is decided when the contract is written, and it is invisible in a normal diff. Nothing in a standard review tells you which slots will contend.
How ParaCheck finds it
Slither's detector suite plus ParaCheck's hot-slot classifier, mapping which functions touch which storage.
Foundry and anvil run the contract under concurrent load, and the execution traces are diffed for real conflicts.
Findings are prioritised by measured impact and posted to the pull request as a Check Run with inline annotations.
In your pull requests
1Sign in and install the app on the repositories you choose.2Scan a repository straight away, or open a pull request that touches a.solfile.3The analysis runs on your own GitHub Actions runner, authenticated by OIDC. Your source never reaches our servers.4A Check Run appears with annotations and a reproduce command — and only a proven finding can gate the merge.
What it is built on
- Static analysisSlither + hot-slot classifier
- Dynamic analysisFoundry / anvil execution traces
- Proof engineGenerated Foundry PoCs, validated by execution
- Control planeCloudflare Workers + D1
- ExecutionGitHub Actions, on your own runner
- IntegrationNative PR Check Runs and annotations
Analysis runs as a GitHub Actions job on your own runner, authenticated back with a short-lived OIDC token. There is no secret to store, and the control plane never receives a copy of your code.
Put ParaCheck in your pull requests.
One install. No configuration file, no YAML, no compiler settings.