AI security audits that prove themselves.

Architecture-first smart contract audits that run in hours, then take a position on every finding.

Measured on EVMBench: 59.8% to 88.9% attributed recall.

Read the 0.7 results

Audit my contracts See a real report Smart contract audit →

lending-protocolacme-labs

Download reportShare

LEN-1

isolateLiquidate pays NFT to caller instead of auction winner (lastBidder)

security bugIsolateLogic.sol

LEN-3

depositERC721 accepts tokenIds with stale lockerAddr after isolate liquidate exit

security bug·BVaultVaultLogic.sol

LEN-5

Lido unstake sends full stETH balance in one request above 1000 ETH cap

security bugYieldEthStakingLido.sol

LEN-6

Native unwrap pulls WETH from msgSender while liquidity was sent to receiver

security bugVaultLogic.sol

LEN-7

Decimal-mismatched Chainlink answers let a borrower pass HF/LTV gates and over-extract liquidity

security bugPriceOracle.sol

LEN-69

Yield repay tops up shortfall from nftOwner without balance-delta guard before pool yieldRepayERC20 pull

security bugYieldStakingBase.sol

LEN-73

Base._createProxy silently truncates proxyModuleId to uint32 in trustedSenders while proxyLookup keys the full uint256

security bugBase.sol

LEN-88

External yield withdrawal finalization gates NFT unlock with no in-protocol fallback

by designYieldStakingBase.sol

01The report

A real finding is never one line of code.

The only critical from our sample run, in its own words.

critical·security bug·GDX-1Confirmed

isolateLiquidate pays NFT to caller instead of auction winner (lastBidder)

After an isolate auction ends, executeIsolateLiquidate transfers the liquidated ERC721 to params.msgSender without comparing the caller to loanData.lastBidder.

Where it lives · 3 locations

src/libraries/logic/IsolateLogic.solcited 471-478

469    }
470
471    // transfer erc721 to bidder
472    if (params.supplyAsCollateral) {
473      VaultLogic.erc721TransferIsolateSupplyOnLiquidate(nftAssetData, params.msgSender, params.nftTokenIds);
474    } else {
475      VaultLogic.erc721DecreaseIsolateSupplyOnLiquidate(nftAssetData, params.nftTokenIds);
476
477      VaultLogic.erc721TransferOutLiquidity(nftAssetData, params.msgSender, params.nftTokenIds);
478    }
479
480    emit Events.IsolateLiquidate(

127 of 138 findings pin a file and a line range. Every finding leaves with a verdict. Proof is rationed to 15 attempts a run, and this critical's own attempt timed out.

Read the full report →

02How we work

138 findings. 138 verdicts.

No pile of flags to triage. Our sample run took a position on every finding.

acme-labs/lending-protocol138 findings · 2h 42m

68/ 138

Confirmed

Held up under validation.

19/ 138

Dismissed

Raised by a model, not sustained.

51/ 138

Design tradeoff

Real behaviour, judged deliberate.

ConfirmedGDX-1

critical · security bug

isolateLiquidate pays NFT to caller instead of auction winner (lastBidder)

The highest isolate-auction bidder can lose 100% of their escrowed bid value plus the NFT.

Call sites · 3

src/libraries/logic/IsolateLogic.solexecuteIsolateLiquidate()471-478
src/libraries/logic/ValidateLogic.solvalidateIsolateLiquidateLoan()601-610
src/modules/IsolateLiquidation.solisolateLiquidate()75-101

DismissedGDX-69

high · security bug

Yield repay tops up shortfall from nftOwner without balance-delta guard before pool yieldRepayERC20 pull

YieldStakingBase._repay pulls the shortfall from nftOwner without verifying that its own underlying balance increased before transferring the debt to PoolManager.

Still ships, marked rejected, so you can check the reasoning yourself.

Call sites · 2

src/yield/YieldStakingBase.sol_repay()404-426
src/libraries/logic/YieldLogic.solexecuteYieldRepayERC20()110-114

Design tradeoffGDX-91

high · centralization risk

External interest rate model is a single point of failure per asset group

A reverting, gas-griefing, or misconfigured GroupData.rateModel bricks every supply, borrow, withdraw, and liquidation path touching that asset group.

Call sites · 1

src/libraries/logic/InterestLogic.solupdateInterestRates()

Walk through the full pipeline →

03Release audit

Someone already audited it. Should you believe them?

Release Audit grades the audits behind a protocol before you integrate with it.

The report is legitimate and commit-pinned. Nine security-relevant contracts changed after the audited commit, four of them integration helpers the report never names.

A real run: 1inch's Limit Order Protocol against Pessimistic's November 2021 report.

$200 flat, same as a code audit.

See a full scorecard →Verify a protocol →

1inch Limit Order Protocol

Audit report review · 1 report · 1 firm · commit 9325553 · reviewed May 16, 2026

Needs manual review

60out of 100

Rubric across 8 dimensions

04Between audits

An audit is a moment. Your code isn't.

PR reviewEarly access: Reads each diff against what the last audit learned about your system, and comments inline on every push. Priced separately from the audit.
Re-audit any commit: A full pipeline run on demand, diffed against your last scan so you can see what a fix closed.
See what a re-run produces →

05What it costs

Priced per audit, not per engagement.

$200

One-time

per audit · one repo, one commit, any size

What the one price buys

The whole pipeline on one commit, as a versioned report you can share. A free-audit allowance to evaluate first.

Cost at your cadence

Same audit, back in 1-3 hours. Re-runs are priced the same, not free.

Once, before a launchthe audit you were already planning: $2001 × $200
Every releasea monthly release train: $2,40012 × $200
Every weekeach week of merged work: $10,40052 × $200

A manual engagement runs $50,000+ and reviews one commit once. When a release warrants one, we refer you to our audit partner Pessimistic. Read the full comparison →

Request a manual audit See pricing details →

A verdict on every finding.

Connect a repository. Get the architecture map.

Audit my contracts Verify someone else's

$200 flat per audit · results in 1-3 hours · free-audit allowance for teams