evm contract bytecode audit

The problem

Interacting with unverified or unfamiliar smart contracts is a primary cause of lost funds through honeypots, drainers, and malicious ownership rugs. Standard security scanners often miss these adversarial patterns because they focus on general vulnerabilities rather than intentional fraud.

What it does

• Performs dual-pass analysis using Slither for general vulnerabilities and a custom heuristic suite for honeypot-specific patterns.
• Decompiles unverified bytecode using Heimdall-rs or Dedaub to audit logic even when source code is hidden.
• Detects EIP-1967 proxy patterns, identify upgrade admins, and flag hidden centralization risks.
• Exposes "fake renouncement" scams by auditing the internal logic of ownership transfer functions.
• Categorizes risks into DANGER, SUSPECT, or NO-FINDING verdicts based on exploitability and blast radius.

Frameworks & tools

Slither, Heimdall-rs, Dedaub, EVM, EIP-1967.

Why this beats prompting it yourself

Most LLMs rely on general knowledge that overlooks specific honeypot techniques like fee-on-transfer gates or non-standard proxy implementations. This skill enforces a strict multi-tool workflow that prevents "clean" reports from general scanners being mistaken for a lack of fraud risk.

Use cases

• Audit a new ERC-20 token contract before approving a spend limit or swapping.
• Identify if a minting contract is a drainer before connecting a wallet.
• Verify if a "renounced" contract has hidden backdoors or hardcoded admin overrides.
• Analyze unverified bytecode for malicious logic before an agent interacts with it.

Known limitations

Cannot simulate specific transaction effects like slippage or sandwiching. Does not detect non-standard proxy patterns like Beacon or Diamond proxies. Best-effort reconstruction for unverified code.