Smart contract security, grounded in architecture.

Findings have to earn their place against your system's invariants and trust boundaries — challenged on a fork, validated by independent models, and dismissed only when we can cite the exact line that disproves them.

Start an audit See how it works

LinkedIn X

2 free auditsA

vault-core

36 findings3 critical7 high17 medium7 low2 info

−3 critical, −5 high vs previous scan

maine7b2f4alatest

Download reportShare

SV-001

Unchecked external callback before balance update

security bug·Vault

Open

SV-002

Admin rotation bypasses timelock constraint

access control·Governor

True positive

SV-003

Oracle staleness window exceeds safe threshold

price manipulation·PriceFeed

Open

SV-007

Unchecked transfer return value hides failure

best practice·Treasury

Open

SV-012

Missing zero-address check on initialization

best practice·Proxy

Open

Built for Solidity teams shipping on EVM

Ethereum

Arbitrum

Optimism

Base

Polygon

Grounded

findings tied to invariants + code

Independent

multiple models, 23 categories

Proven

criticals with fork exploit

Honest

uncertain findings flagged for review

01The report

Security you can explain to your team.

Every finding links to architecture context and source — not opaque scanner IDs.

Finding detail

Severity, exact location, and the vulnerable code

critical·security bug·F-001

Unchecked external callback before balance update

The withdraw function calls an external contract before updating internal state, enabling reentrant calls to drain funds.

Vault.sollines 142–146

142function withdraw(uint256 amount) external {
143  require(balances[msg.sender] >= amount);
144  token.transfer(msg.sender, amount); // external call before state update
145  balances[msg.sender] -= amount;
146}

Status: validated
Confidence: high
Component: Vault.sol

Exploit proof

Criticals come with a working exploit

exploit · mainnet forklive

$guardix exploit --fork mainnet

Forking mainnet at block 19,842,116…

Executing reentrancy on Vault.withdraw()

✓Drained 142.8 ETH — verified

Validation

Dismissals need a cited line

Citation verified — dropped

guard_exists · Vault.sol:142

No line defeats it — needs_manual

stays in front of a human

A false positive is dropped only when the validator can quote the exact line that disproves it.

Architecture

Findings graded against your invariants

▸

INV-001state

Total supply equals the sum of balances at all times

high

▸

INV-004access

Admin role changes cannot bypass timelock constraints

high

Assumptions (5) · Decisions (3)

Triage-ready

Prioritized, not dumped

critical 3high 7M 17L 7I 2

Versioned and shareable — stakeholders see what engineers see

02How we work

Your invariants are the grading rubric.

We map what the system must guarantee, then test whether each finding actually violates it.

1The model flags it

Reentrancy in Vault.withdraw()

flagged by an AI model · unverified

An independent model spots a possible issue. On its own that's just a claim — so we don't trust it yet.

2Guardix challenges it

Reproduce the attack on a fork of mainnet

Hunt for a line of code that would stop it

Check it against your system's invariants

We try to prove it real — and we try to prove it false. The finding has to hold up against your invariants.

3Only earned findings ship

Kept — and proven

The exploit drained 142.8 ETH on a fork. It's real — and you get the working proof.

Dismissed — with the receipt

Line 142 already guards it. Dropped — and we hand you the exact line that disproves it.

Can't prove it either way? It stays in front of a human — never silently dropped.

Behind every result: your system's invariants, several independent models, and a benchmark of real historical exploits we're never allowed to tune against.

03PR review

Early access

Review against what you already know.

PR analysis uses prior scan context and open findings — inline comments where the risk actually is, a re-review on every push, and a clean check when it's safe to merge. Rolling out now.

Effort scales to risk — a styling tweak spawns nothing; a vault-accounting change pulls in the math and external-call reviewers.
Inline comments on the diff, re-reviewed on every push, threads resolved as you fix them.
Uses prior scan context and open findings — comments land in GitHub, not another dashboard.

Request access →

vault-core#482feat/withdraw-guardOpen

Vault.sol+12 −3

141  require(balances[msg.sender] >= amount);
142  token.transfer(msg.sender, amount);
143  balances[msg.sender] -= amount;

guardixVault.sol:142

External call runs before the balance update — reentrancy risk. Add nonReentrant or move the state change above the transfer.

re-reviewed on push2 threads resolved

Approved — safe to merge

vault-core · scan historymain

e7b2f4atodaylatest

c91d3e82 days ago

a3f8c1d5 days ago

−3 critical, −5 high vs previous scan

04Every commit

The security picture grows with the codebase.

Versioned scans, diffable results, shareable reports pinned to commits. Re-run on your next push at the same flat price.

Re-audited on every new commit — no new scoping call, no new invoice.
Versioned and pinned to the exact commit — diffable results as the codebase grows.
Shareable report links stay tied to the scan — stakeholders see what engineers see.

05The math

Depth without the audit-firm calendar.

Guardix

$200

per audit · one-time

Manual audit

$50,000+

per engagement

Turnaround

1–3 hours

2–4 weeks

Re-runs

Every commit, same price

One-shot — stale after the next commit

Critical findings

Proven with a working fork exploit

Written up, not proven

Best for

Repeatable, validated coverage

Novel, bespoke attack paths

Architecture-first, adversarial validation — repeatable per commit instead of once per release. Read the full comparison →

06Release audit

Beta

Score the audits behind your protocol.

Third-party report verification: credibility, code freshness, finding quality, owner privileges, and on-chain deployment — as one scored, shareable trust scorecard.

Five verification dimensions — auditor credibility, code freshness, finding quality, owner privileges, and on-chain deployment — rolled into one weighted trust score.
On-chain deployment probed live: EIP-1967 proxy and admin slots and the code hash, read straight from mainnet.
Run end-to-end on real multi-report projects — Liquity (51 findings) and Superform (251).
$200, pay-per-audit — the same flat economics as a code audit.

See a sample scorecard →Request beta access →

1inch · release verificationshare link

Trust scorecard82/100

Auditor credibility

Code freshness

Finding quality

Owner privileges

On-chain deployment

On-chain probe · live

EIP-1967 proxy0x3608…bbc

admin slot0xb531…103

code hash0x9f2c…e41

07Pricing

Transparent per-audit pricing.

$50 quick scan · $200 full audit · re-runs at the same flat rate. No subscriptions or scoping calls; teams get a free-audit allowance to evaluate. The full audit includes:

See pricing details →

Full report with prioritized, validated findings
Architecture artifacts: invariants, assumptions, decisions
Exploit verification for critical findings
Re-audits on new commits at the same price
PR review inside your GitHub flow
Shareable report link + PDF export

Security that starts with understanding.

Architecture map, earned findings, fork proof — connect a repo and see the difference.

Start an audit See how it works

$200 one-time per audit. Teams get a free-audit allowance to evaluate.

Featured on

AI Toolz Dir