Methodology

How We Audit

Ten specialist AI agents, Opus synthesis, and a 3-agent Opus Cipher adversarial swarm. Parallel 3-lens RALPH on every audit. Transparent scoring, on-chain verification. Every audit is reproducible and independently verifiable.

Current Prompt Template Hash

View Schema on Base

0x08c910e97df2f35c1c3ceac6e028b120085a4049bfcac7b10f6b2cbb3aee9029

This hash identifies the current prompt version. It is included in the promptTemplateHash field of every on-chain EAS attestation. If we change our prompts, this hash changes, and you can see exactly when in the version history below.

This hash will be attested on-chain with the next audit report.

Agent Roster

Each specialist agent focuses on a distinct vulnerability class. Click to expand and see exactly what each agent looks for.

Adversarial Cipher Swarm (Opus, every paid audit)

3 adversarial agents (alpha for reentrancy depth, beta for economic exploits, general for cross-domain coverage) re-audit every specialist finding through a "what did they miss" lens. Multi-iteration RALPH loops with independent peer review. Always Opus regardless of tier -- the quality floor on both standard and deep audits.

Vulnerability Intelligence

Our agents are informed by documented exploit patterns from real-world security incidents.

4715

Exploit Patterns

Security Score

Measures vulnerability risk from reentrancy, access control, economic, upgrade, and compliance findings.

ReentrancyAccess ControlEconomicUpgrade SafetyStandard Compliance

Security Score (1.0 - 10.0)

9.0 - 10.0

Excellent

No significant issues. Follows best practices.

7.0 - 8.9

Good

Minor issues. Generally well-written.

5.0 - 6.9

Moderate

Notable issues. Review before deployment.

3.0 - 4.9

Concerning

Significant vulnerabilities. Do not deploy without fixes.

1.0 - 2.9

Critical

Efficiency Score

Measures gas optimization and code efficiency. Does not affect security risk assessment.

Gas Optimization

Efficiency Score (1.0 - 10.0)

9.0 - 10.0

Optimized

Minimal gas improvements available.

7.0 - 8.9

Good

Minor optimizations possible.

5.0 - 6.9

Fair

Notable gas savings available.

3.0 - 4.9

Inefficient

Significant optimization needed.

1.0 - 2.9

Very Inefficient

Major gas issues throughout.

Finding Penalties

Each target starts at 10. Findings subtract from this based on severity, weighted by confidence. Caps prevent any single severity tier from dominating.

Severity	Per Finding

Exploitability (per finding)

Every scored finding includes an exploitability value from 1.0 to 10.0. It combines the finding's scope class (how direct the attack path is) with confidence (how sure the synthesis agent is). It is shown on each finding in the report and drives the sort order of the Exploit Analysis section.

Formula

base = SCOPE_CLASS_BASE[finding.scopeClass]
exploitability = clamp(base * (0.5 + confidence * 0.5), 1.0, 10.0)

Scope Class Base Values

Scope class	Base	Meaning
direct_vulnerability	9	Attacker can trigger with a single transaction, no special preconditions
implementation_gap	7	Contract missing a protection it should implement (TWAP, staleness check, reentrancy guard)
design_assumption	4	Depends on trusting external system behavior (oracle accuracy, bridge liveness)
third_party_risk	3	Vulnerability in external dependency or library
extreme_condition	2	Exploitable only under unlikely conditions (mass validator collusion, 99.9th percentile)
centralization_note	1	Admin/privileged role capability without a specific exploit path

Scope Policy

Findings are gated by demonstrated exploit feasibility against the analyzed contract. Observations that describe accepted blockchain behavior, consensus-layer issues, or infeasible preconditions are excluded from scored findings.

In scope

- Direct theft, permanent freezing, or unauthorized control of user funds
- Reentrancy and logic errors enabling exploitation
- Missing protections the contract should implement (staleness checks, reentrancy guards, input validation at trust boundaries)
- Broken core functionality affecting multiple users
- Unauthorized access to privileged functions

Advisory (shown but not scored)

- Centralization notes (admin roles and capabilities)
- Design assumptions (contract trusts external oracles / bridges)
- Third-party dependency risks (vulnerable imported libraries)

Out of scope (not reported)

- Front-running, MEV, sandwich attacks on public mempools (market behavior, not contract-specific)
- 51% attacks, chain reorgs, sequencer downtime (consensus and infrastructure)
- Social engineering, phishing, key theft (human layer)
- Stablecoin depegging and external asset volatility (not the analyzed contract's code)
- Gas optimization suggestions (routed to Gas Optimizations section)
- Attacks requiring infeasible preconditions (multi-year validator collusion, etc.)

Prompt Version History

When we update our agent prompts, the composite hash changes. Every on-chain attestation references the hash that was active at audit time, so you can verify which prompt version produced any given audit.

Version History

Version	Composite Hash	Date	Changes
v1.6	`0x08c910e9...ee9029`	May 1, 2026	Merge session/forge-poc-quality: audit-engine 1.6.0 cipher-as-attacker
v1.5	`0xd9c1daa3...f7dd5c`	Apr 17, 2026	Pipeline wiring: synthesis gets full static analysis + red team framing
v1.4	`0x47dc765c...079128`	Apr 17, 2026	Attacker mindset overhaul: reframe all specialists as exploit hunters
v1.3	`0xa6ab9d0b...f98cec`	Apr 17, 2026	Gap analysis fixes: math specialist, guard enumeration, array extension, integration behaviors

Limitations

Automated audits are powerful but not omniscient. Understanding what we cannot detect is part of honest security.

!
Business logic correctness. We match vulnerability patterns, but we cannot verify the intent behind the code. A function that sends funds to the owner is a feature or a backdoor depending on context we do not have.
!
Off-chain components. Oracle infrastructure, keeper bots, admin key management, and multisig governance are outside the scope of on-chain source analysis.
!
Economic modeling. Tokenomics viability, liquidity depth, and market dynamics require simulation, not static analysis. We flag known economic attack patterns, not novel ones.
!
Cross-protocol composability. We analyze the submitted contract in isolation. Interactions with external protocols (flash loan sources, LP positions, governance tokens) are flagged when detected but not exhaustively traced.
!
When to get a manual audit. If your contract handles significant value (>$1M TVL), involves novel cryptographic primitives, or implements custom governance, automated analysis should supplement (not replace) a manual audit from a reputable firm.

Prompt Version Integrity

Every audit is tagged with the composite hash of the prompt templates used by all agents. This hash uniquely identifies the exact instructions each agent followed during the audit.

01 / Hash

When an audit completes, we compute a SHA-256 hash of all agent prompt templates. This hash is stored with the audit report and visible on the report page.

02 / Trace

Any change to agent prompts produces a new hash. The version history below shows exactly when prompts changed and what was updated.

03 / Attest

Each audit's hash is attested on-chain via EAS on Base L2, creating a tamper-proof on-chain record.

Attestation schema

promptTemplateHashSHA-256 of all agent prompts

contractAuditedContract address + chain

score0-10.0 security score

reportHashSHA-256 of full report

EAS is deployed on Base at predeploy addresses (part of the OP Stack). Attestations cost less than $0.01 each and are indexed by EASScan. No custom smart contracts are needed. Reports with on-chain attestation display a "Verified on Base" badge.

Audit a Contract

Every audit is produced by the methodology described above.

Finding Penalties

Each target starts at 10. Findings subtract from this based on severity, weighted by confidence. Caps prevent any single severity tier from dominating.

Severity	Per Finding	Max Total
Critical	-2.5	-7.5
High	-1.0	-4.0
Medium	-0.3	-1.5
Low	-0.1	-0.5
Informational	0	0

How We Audit

Current Prompt Template Hash

Engine Quality

Agent Roster

Adversarial Cipher Swarm (Opus, every paid audit)

Vulnerability Intelligence

Security Score

Security Score (1.0 - 10.0)

Efficiency Score

Efficiency Score (1.0 - 10.0)

Finding Penalties

Exploitability (per finding)

Scope Policy

Prompt Version History

Version History

Limitations

Prompt Version Integrity

Attestation schema

Finding Penalties

Score Modifiers

Score Modifiers