Contract scan
AUDIT0
AI-native onchain audit and compliance workspace. Zero backend. Infinite coverage.
Real-time coverage surface across all connected protocols. Every contract, wallet cluster, and policy mapped to a risk score.
Permissions, oracle integration, upgrade mechanisms — surfaced per contract with line-level precision.
Transaction topology mapping treasury clusters, mixer interactions, and cross-chain bridge usage.
Generated memo, matrix, and ledger for each module. Ready for regulatory or listing submission.
Each module runs live. Switch tabs to see surface analysis, wallet exposure, and compliance mapping update in real time.
From raw source to signed evidence pack in five operations. Every step is auditable and reversible.
A zero-backend, AI-native audit workspace. Every scan runs client-side. No data leaves your environment.
Audit0 reimagines the audit workflow for the onchain era. Traditional audit firms operate behind closed doors — NDAs, PDF reports, and point-in-time snapshots. Audit0 inverts this: every scan is deterministic, every finding is content-addressed, and the entire evidence graph lives in a single, portable file. No backend, no service dependency, no data exfiltration.
The core scanning engine ingests Solidity and Vyper source code, ABI-decompiled bytecode, and wallet transaction graphs. Each module produces typed findings with severity, source location, and remediation guidance. Three scan modes operate in parallel:
Static analysis performs pattern matching against a library of 280+ vulnerability signatures, symbolic execution for reentrancy and access-control paths, and AI-assisted invariant discovery. Graph analysis constructs a transaction topology from wallet clusters, identifying mixer interactions, bridge relayers, and governance vote-buying circuits. On-chain simulation dry-runs state-modifying calls against a forked EVM to verify oracle prices, slippage bounds, and liquidation thresholds.
Findings are deduplicated across modes and ranked by a composite severity score — weighing exploitability (CVSS-adapted), total value at risk (TVL), and existing control maturity. Each finding carries a content-addressed hash so subsequent verification steps can prove non-tampering.
Technical findings are mapped to regulatory controls automatically. Audit0 ships with 280+ controls across 12 jurisdictions: VASP (Singapore), MiCA (EU), PSA (payment services), DORA (digital operational resilience), and state-level frameworks in New York and Dubai.
The mapping is transparent and editable. Analysts can reassign findings to alternative controls, split a single finding across multiple controls, or merge several findings under one control. Every edit is recorded in the evidence graph. The compliance matrix visualises coverage per module — green for adequate, amber for partial, red for gap — so reviewers can see at a glance where manual attention is needed before a filing can be marked complete.
Custom policy packs can be uploaded as YAML or JSON. The compliance layer validates them against a JSON Schema and surfaces validation errors interactively in the workspace.
The output layer generates three deliverable types. A memo is a human-readable summary written for non-technical stakeholders — listing committees, investors, or regulators. A ledger is a machine-readable finding registry in SARIF format for CI pipeline ingestion. A listing pack bundles the memo, ledger, and all supporting evidence into a single signed archive for exchange submission.
Every output is timestamped and content-addressed. A SHA-256 digest is computed over the full pack, and the user may optionally anchor it to a public chain (Ethereum, Base, or Robinhood Chain) for a tamper-evident audit trail. The anchor transaction hash is embedded in the pack itself, forming a closed loop: the evidence proves itself.