Developer tests Solidity scanner on 6 audited DeFi protocols, finds 14 false positives

A developer building OpenClaw, a heuristic Solidity security scanner, tested the tool against six already-audited DeFi protocols including Yearn, Sablier, Ajna, and Liquity. The scanner produced 14 HIGH or CRITICAL findings across all six codebases, and every single one turned out to be a false positive upon manual verification. Rather than treating this as a failure, the developer argues it demonstrates the tool's core design goal: achieving high precision by staying silent on sound code. Each false positive revealed a specific pattern that fools most scanners, such as misidentifying legitimate one-time init guards, bounded rate parameters, and read-only functions as exploitable vulnerabilities. The exercise highlights that low false-positive rates are what make security tools trustworthy, since a scanner that raises constant false alarms trains developers to ignore its warnings entirely.