AI security audits that prove themselves.

Connect a repository and get a full smart contract audit in a few hours, with a verdict on every finding.

lending-protocolacme-labs · 0d22145

Complete · 2h 42m

After an isolate auction ends, executeIsolateLiquidate transfers the liquidated ERC721 to params.msgSender without comparing the caller to loanData.lastBidder.

IsolateLogic.sol:471-478 · executeIsolateLiquidate

src/libraries/logic/IsolateLogic.sol

470
471    // transfer erc721 to bidder
472    if (params.supplyAsCollateral) {
473      VaultLogic.erc721TransferIsolateSupplyOnLiquidate(nftAssetData, params.msgSender, params.nftTokenIds);
474    } else {
475      VaultLogic.erc721DecreaseIsolateSupplyOnLiquidate(nftAssetData, params.nftTokenIds);
476
477      VaultLogic.erc721TransferOutLiquidity(nftAssetData, params.msgSender, params.nftTokenIds);
478    }

supports:

Ethereum

Arbitrum

Optimism

Base

Polygon

Guardix is a team of AI agents working in an exploit-ready environment. They read, fuzz and attack your contracts in as many ways as they can, to surface everything from simple mistakes to the most complex multi-step exploits.

Architecture first

It maps contracts, roles and value flows before it looks for a single bug.

A verdict on every finding

Confirmed, dismissed, or a design tradeoff.

Measured in public

88.9% recall on EVMBench known vulnerabilities. Read the benchmark →

Code audit

A full audit, while you keep shipping

Over a few hours it reads the code, maps the system and works through every category a reviewer would, then hands back a report where each finding already has a verdict.

See a sample report

Confirmed68

Dismissed19

Design tradeoff51

LEN-1critical

isolateLiquidate pays NFT to caller instead of auction winner (lastBidder)

ConfirmedIsolateLogic

After an isolate auction ends, executeIsolateLiquidate transfers the liquidated ERC721 to params.msgSender without comparing the caller to loanData.lastBidder.

IsolateLogic.sol:471-478 · executeIsolateLiquidate

src/libraries/logic/IsolateLogic.sol

470
471    // transfer erc721 to bidder
472    if (params.supplyAsCollateral) {
473      VaultLogic.erc721TransferIsolateSupplyOnLiquidate(nftAssetData, params.msgSender, params.nftTokenIds);
474    } else {
475      VaultLogic.erc721DecreaseIsolateSupplyOnLiquidate(nftAssetData, params.nftTokenIds);
476
477      VaultLogic.erc721TransferOutLiquidity(nftAssetData, params.msgSender, params.nftTokenIds);
478    }

System map
Contracts, roles and value flows, drawn before the hunt starts.
Source-linked evidence
Every finding cites the exact lines it is about.
Verdicts, not maybes
Confirmed, dismissed or design tradeoff, with the reasoning.
Shareable report
Send one link to your team or auditors, no account needed.
PDF export
A clean report for partners, investors and governance.
Re-audit any commit
Run again after fixes and compare against the last scan.

Release audit

Someone audited it. Should you trust it?

Upload the audit reports for a protocol you depend on or are about to ship. Guardix checks them against the code, the scope and the deployment, and scores how much the audit actually covers.

See a sample scorecard

1inch Limit Order Protocol

Audited by Pessimistic

60/100

Needs manual review

Scope coverage45/100

Release-critical scope coverage

The report clearly covers OrderMixin, OrderRFQMixin, AmountCalculator, and ArgumentsDecoder, but many other changed release-critical files are not explicitly mapped in the uploaded report. That makes the scope only partially evidenced for the assessed commit.

Gaps

Explicit scope coverage is missing for pricing helpers, predicates, permits, callbacks, and proxy helpers.
The top-level deployed wrapper contract is not named explicitly in the report.

Report against code
Checks the audited commit and scope against what you are about to trust.
Scope reconciliation
Shows which contracts the report covered and which changed after it.
Auditor credibility
Weighs who did the audit and how the findings were handled.
Privileged roles
Lists who can pause, upgrade or move funds, and how.
Deployment check
Probes the deployed contracts you point it to, on any EVM chain.
One score, with reasons
Every criterion explains itself and cites the findings behind it.

One price per audit

No subscriptions and no seats.

Pricing details

Code audit

$200per repository, per commit

Any size codebase. Re-audit after fixes at the same price.

Release audit

$200per release

Bring as many audit reports and sources as the release has.

Audit your next commit.

Connect a repository and come back to a verdict on every finding.

Audit my contracts Verify someone else's audit