AI smart contract audit · EVM
The smart contract audit that proves its own findings.
Guardix maps your architecture, hunts vulnerabilities with independent AI models, and proves the critical ones with a working exploit on a mainnet fork — a full audit in hours, for $200, re-run on every commit.
Built for Solidity teams shipping on EVM
- $200
- per audit — one-time, no subscription
- 1–3 hours
- from commit to finished report
- Every commit
- re-audited at the same flat price
- Exploit PoC
- critical findings verified on a fork
Four artifacts ship with every audit.
Not a wall of model output. A defensible deliverable — the finding, the proof, the context that grounds it, and a report you can hand to anyone.
- Findings Severity, exact location, and the vulnerable code
- Each finding carries a severity, the exact file and line, the offending code, and its risk class — reentrancy, oracle and price manipulation, access control, accounting drift, unchecked external calls.
- Exploit proof Criticals come with a working exploit
- A critical finding is replayed on a fork of mainnet — so it's something you can run, not just read.
- Architecture Invariants extracted before any bug-hunting
- Guardix maps the system's invariants, assumptions, and design decisions first — every finding is graded against what the contracts are supposed to guarantee.
- Report Versioned, diffable, shareable
- One report, pinned to the exact commit, diffed against the last scan, shareable by link — stakeholders see what engineers see.
Total supply equals the sum of balances at all times
Admin role changes cannot bypass timelock constraints
A finding has to earn its verdict.
Most AI auditors hand you everything their model flagged. Guardix distrusts its own model and puts each finding on trial before it reaches you.
- 1 A model flags it
Independent AI models propose findings. On its own, a flag is just a claim — Guardix doesn't trust it yet.
- 2 Guardix challenges it
It tries to prove the finding real (reproduce the attack on a fork) and to prove it false (find the exact line that defeats it). The finding has to survive both.
- 3 The verdict is earned
Kept only when grounded in your invariants — criticals proven by a working exploit. Killed only when the validator cites the exact line that defeats the attack step.
Can't prove it either way? It stays in front of a human as needs_manual — never silently dropped. And
for novel, bespoke attack paths and economic or game-theoretic design, human auditors
still win.
See where each wins →
The bug classes it hunts.
Named, real, EVM-wide — the repeatable, provable vulnerability classes Guardix is built to find across any Solidity contract.
- Reentrancy
- Single-function, cross-function, and cross-contract callback paths in vault, router, and callback flows.
- Oracle & price manipulation
- Stale feeds, single-source spot prices, and flash-loan-inflated prices that break liquidation and collateral math.
- Access control & privilege escalation
- Unprotected admin entry points, missing or bypassable timelocks, and role-boundary or guardian escalation.
- Accounting & invariant drift
- Divergence between internal accounting and real token balances — supply that no longer equals the sum of balances.
- Unchecked external calls & returns
- Ignored transfer and low-level-call return values, silent failures, and unvalidated callbacks.
Plus the long tail of best-practice and logic issues. For what we don't claim — novel economic design — see the comparison .
−3 critical, −5 high vs previous scan
Audit on every commit. Same flat price.
A human firm audits once — the report is stale the moment you push a fix. Guardix re-runs on your next commit and diffs against the last scan.
- Run a new audit on each commit at the same flat price — no new scoping call.
- Each scan is pinned to its commit and diffed against the last.
- Everything's included: findings, exploit proof, architecture, shareable report — one price, no tiers.
Cheaper and faster than a manual engagement, but not a replacement for one — see exactly where each wins .
Pick the path that fits your stack.
Building DeFi?
Oracle manipulation, flash-loan price attacks, and accounting drift across integrated protocols.
Want the methodology?
How architecture-first analysis and the earned-verdict pipeline actually work.
AI vs manual?
Speed, cost, coverage — and exactly when a human auditor still wins.
Your next commit can ship audited.
Connect a GitHub repo, pick the commit, and review a validated report in hours — $200, with a free-audit allowance to evaluate.