Product
VeriAudit
Smart contract auditing that proves the finding is exploitable and writes the attestation on-chain.
Most automated smart contract scanners produce a list of maybes. VeriAudit only reports a vulnerability after it has generated a proof-of-concept exploit and run it, and it binds the resulting audit to the exact bytecode that was audited, so an attestation cannot be quietly reused for different code.
It is built as three pillars: an on-chain registry and attestation layer, an AI analysis layer, and a static analysis and exploit validation layer.
On-chain layer
- A Solidity AuditRegistry holds the auditor registry and staking.
- Attestations are signed with EIP-712.
- Verification is trustless: verifyBytecode compares against EXTCODEHASH, so the attestation is bound to the deployed code.
- Reports are pinned to IPFS.
- The contracts are covered by 19 tests.
AI layer
An ML risk model scores the contract, an LLM reasons over the flagged regions, and the system then synthesizes a Foundry proof-of-concept for the candidate issue. The provider is not fixed, so the reasoning model can be swapped.
Static analysis and validation
Slither runs alongside custom detectors, with findings mapped to the SWC taxonomy. Candidate exploits are then executed under Foundry to confirm they actually work. The first version validates reentrancy-eth and suicidal.
Pipeline
Ingest, fingerprint, static analysis, ML risk, LLM reasoning, exploit proof-of-concept, classify, assemble under a keccak256 hash, attest, verify.
Layout
- contracts: the Solidity registry and attestation logic.
- worker: the FastAPI analysis worker.
- orchestrator: a TypeScript Fastify service coordinating the pipeline.
- frontend: Vite and React with wagmi and viem for wallet interaction.
- eval: the benchmark harness.
Stack
- Contracts
- SolidityFoundryEIP-712IPFS
- Analysis
- PythonFastAPISlitherLLMs
- Orchestration
- TypeScriptFastify
- Frontend
- ViteReactwagmiviem