5 false positives your Solidity scanner is probably reporting right now

Every automated Solidity security tool has the same disease: it cries wolf. Run one on an audited protocol and you get 600 "findings," 98% of which are noise. The tragedy isn't the wasted time — it's that after the tenth false alarm, you stop reading. The one real bug then hides in the noise. I spent this week hand-verifying every flag my scanner produced against production protocols (Ember, Euler, Liquity, Arcadia, Rubicon, and more). Every single one was a false positive. Here are five of the most common classes, why a naive tool reports them, and the deterministic check that kills each — no AI guesswork required. 1. The "spec violation" that's just... the design A tool reads a spec or a NatSpec comment — "only the rate manager can update the rate" — and flags the function as a violation because it "can't prove" the restriction. On Ember's vaults this produced a CRITICAL : function pause() external onlyGuardian { ... } function processWithdrawalRequests(uint256 n) external onlyOperator { ... } function setMaxTVL(uint256 v) external onlyAdmin { ... } Every one is a correctly access-controlled, intended feature. The tool listed the protocol's own role design and called it a bug. The fix: before emitting, find the affected function and check whether the restriction is actually enforced ( onlyX / onlyRole / require(msg.sender == ...) ). If it is, it's the design, not a violation. If there's genuinely no guard, it still fires. Safe direction. 2. Fee-on-transfer on a token that can't be fee-on-transfer A vault does token.transferFrom(user, address(this), amount) and uses amount for accounting. Fee-on-transfer tokens arrive short, so the internal books inflate → the tool screams "insolvency." Real? Only if users can deposit arbitrary tokens. Two very common cases where they can't: // (a) the deposit is onlyOwner — the owner picks what enters function deposit(address token, uint amount) external onlyOwner { ... } // (b) the token set is curated by a registry / whitelist u