AI auditor that finds reentrancy, flash-loan attacks, and privilege escalation in Solidity — in 90 seconds.
A $47M DeFi protocol was drained because a function used .call{value:...} before updating balances. The bug was visible in the code for 8 months. Manual audits cost $80K and take 2-3 weeks. This agent runs continuously.
Solidity Source
↓
Parser → AST + Control Flow Graph + Call Graph
↓
Static Analyzer → checks 200+ vulnerability patterns
Symbolic Executor → explores execution paths for integer overflow
AI Deep Analyzer → MiMo reasoning for novel attack vectors
↓
Risk Scorer → CVSS-style severity + exploitability
↓
Auto-Patch → generates fix PR for safe issues
- Flash Loan Detection: Identifies price oracle manipulation vectors unique to DeFi.
- Cross-Contract Analysis: Tracks external calls across dependency graph.
- Auto-Patch: Generates
ReentrancyGuardimport + modifier insertion as a diff. - Historical Exploit Matching: Embeddings match code against known hacks (Nomad, Wormhole).
| Contract Size | Tokens | Findings |
|---|---|---|
| Simple ERC-20 (~150 LOC) | 15K | 1-3 issues |
| DeFi protocol (~2K LOC) | 480K | 8-15 issues |
| Cross-contract audit | 1.2M | 20+ issues |
| Daily (security firm) | ~5M | — |
Beta with 3 Web3 security firms:
- Found reentrancy vector in a protocol with $12M TVL (patched before exploit)
- Detected missing access control on
mint()function - Audit time: 2 weeks → 4 hours for first-pass
- Zero false positives on critical findings (human verified)
pip install -r requirements.txt
python audit.py --contract ./AaveFork.sol --deep --auto-patch- Python 3.11 + MiMo API (reasoning)
- Slither + Crytic-compile for AST
- EVM bytecode disassembler
- Etherscan API for verified source fetch