Free security tools
Eleven tools. No sign-up, no upload.
Analysis tools that run entirely in your browser, on-chain tools that read public state, and reference tools that document how we work. Each has its own page with the reasoning behind it.
Contract Risk Pre-Check
Paste Solidity and get an indicative scan for twenty known vulnerability patterns, with severity, line numbers and remediation. Runs locally — your code never leaves the page.
AI Deep Scan
Runs every analyser at once — patterns, access control, gas and storage — then adds an AI reasoning layer for what pattern matching cannot reach.
Storage Layout & Upgrade Safety
See slot-by-slot packing with wasted space highlighted, or diff two versions to catch the layout changes that break an upgradeable proxy.
Gas Optimization Analyzer
Twelve rules that find real gas waste, each with an estimated saving and an honest note on whether the fix risks changing behaviour.
Access Control Matrix
Generates the roles × functions table from your source, flags unguarded privileged functions, and spells out what a compromised admin key could do.
Verified Source Fetcher
Pull verified source for any deployed contract across nine chains, flattened and ready — then send it straight to the pre-check.
Proxy Detector
Read the standard proxy slots for any deployed contract — implementation, admin, beacon — and find out if a single key controls the code.
Audit Cost Estimator
Lines of code, complexity, chain and urgency in — a price range, timeline and researcher count out. Every coefficient is published.
Severity Explorer
What Critical, High, Medium, Low and Informational actually mean, with example finding classes and typical remediation for each.
Sample Audit Report
A complete example report: threat model, eight findings, vulnerable-vs-fixed diffs, Foundry PoCs and verified remediation.
Web3 Unit Converter
Wei/gwei/ether without precision loss, hex and bytes32, EIP-55 checksums, function selectors and keccak256.
Where they fit
A tool is a first pass, not a verdict.
Everything here recognises shapes. None of it understands what your protocol is for — which is the gap where every large exploit in this industry has lived.
Known patterns
Reentrancy shape, missing guards, spot-price oracles, unbounded loops, layout collisions, gas waste. Cheap, fast, and worth running before a human looks.
Intent
Whether the code does what the specification says. A tool has no specification, so it cannot see the gap between what you meant and what you wrote — which is where most Critical findings come from.
Economics and composition
Sequences of individually-correct operations whose composition is insolvency. Incentives that are profitable to attack. Assumptions that hold until a market moves. That is the audit.
About the tools
Common questions.
Yes, and there is no account, no email capture and no usage limit. They exist because a specialist security firm should be able to demonstrate competence before asking anyone for money.
The analysis tools — pre-check, gas, access control, storage layout, utilities — run entirely in your browser and transmit nothing. The on-chain tools read public chain state. The AI Deep Scan sends source to a server-side proxy only if the site owner has configured that layer, and the tool says which mode it is in before you paste anything.
No, and each tool says so on its own page. Automated analysis recognises known shapes. It cannot ask what your protocol is supposed to guarantee, follow value across contracts, model an economic attack, or write a proof of concept against a fork. Those are the four things that find the expensive bugs.
Because a lead form measures how much someone wants a PDF, and a tool that works measures whether we can build something useful. We would rather be judged on the second.
Yes. They are free for any use, including commercial. If you find something serious, the responsible thing is to contact the team privately before saying anything publicly.
Beyond the tools
A regex can't read your spec. We can.
Send us the repository. Scoping is free and takes under two working days.