Alternative to Bulloak + static analysis + mutation testing

[robotrobo]

Hey Sablier team! Paul asked us to share some info on Olympix comparing how we work to Slither/other open-source tools. I think you guys will be really excited to give it a try!

1. Superior Accuracy: Olympix’s static analyzer offers enterprise-grade security with a custom-built compiler and detectors, which are much more precise and faster than open-source alternatives like Slither. This reduces false positives, saving you time and increasing efficiency.
2. Deeper Contract Coverage: Our tool enables deeper contract traversal and vulnerability detection, catching more complex issues that Slither might miss. It’s tailored for large-scale, high-stakes environments.
3. Real-Time Detection: Olympix integrates seamlessly into development environments, providing real-time feedback while writing code. This proactive approach allows devs to identify and fix vulnerabilities before even starting an external audit.
4. Accelerates Development Cycles: By catching vulnerabilities earlier, your team can avoid lengthy remediation periods, speed up audit readiness, and focus on innovation instead of rework.
   We've done a case study on the Eigen Layer codebase where we ran both Slither and our static analyzer to show how they perform (Olympix = 75% accuracy, Slither = 15% accuracy) so happy to dive into the details of that and show you how easy it is to use the tool on a quick call!

You can use the free tool as well to get a sense of ux/ui - our enteprise version has more premium detectors and we also have enterprise automated unit testing and mutation testing.
Looking forward to your feedback!! 🙏

[PaulRBerg]

Thank you for posting this @robotrobo

cc @sablier-labs/solidity

[robotrobo]

@sablier-labs/solidity
One thing that I think could be valuable for you guys (I know you’re in a push to launch a product in December) - if part of shipping that product is writing a smart contract/getting a contract audited, we can run our tools on that contract post audit, pre-deployment, then hop on a call and walk through results live.
worst case scenario (or best?) we find nothing of note and you can be extra confident in deploying that contract. best case scenario (or worst..) we do find vulnerabilities and you’re able to resolve them, add more tests to your suite, and you still get to be more confident in deploying that contract.
plus, you’ll get a sense of our tooling and if it’s worth exploring in more detail in Q1 or 2.
what do you think? worth a shot?

[PaulRBerg]

Hi @robotrobo, thank you for posting this proposal.

We are currently busy with a tight project deadline, so we will review the proposal next year if that's OK.