AI smart contract audit · EVM

The smart contract audit that proves its own findings.

Guardix maps your architecture, hunts vulnerabilities with independent AI models, and proves the critical ones with a working exploit on a mainnet fork — a full audit in hours, for $200, re-run on every commit.

Built for Solidity teams shipping on EVM

Ethereum
Arbitrum
Optimism
Base
Polygon
$200
per audit — one-time, no subscription
1–3 hours
from commit to finished report
Every commit
re-audited at the same flat price
Exploit PoC
critical findings verified on a fork
01What you get

Four artifacts ship with every audit.

Not a wall of model output. A defensible deliverable — the finding, the proof, the context that grounds it, and a report you can hand to anyone.

Severity, exact location, and the vulnerable code
Each finding carries a severity, the exact file and line, the offending code, and its risk class — reentrancy, oracle and price manipulation, access control, accounting drift, unchecked external calls.
Criticals come with a working exploit
A critical finding is replayed on a fork of mainnet — so it's something you can run, not just read.
Invariants extracted before any bug-hunting
Guardix maps the system's invariants, assumptions, and design decisions first — every finding is graded against what the contracts are supposed to guarantee.
Versioned, diffable, shareable
One report, pinned to the exact commit, diffed against the last scan, shareable by link — stakeholders see what engineers see.
exploit · mainnet fork live
$ guardix exploit --fork mainnet
Forking mainnet at block 19,842,116…
Executing reentrancy on Vault.withdraw()
Drained 142.8 ETH — verified
architecture · invariants graded against findings
INV-001 state

Total supply equals the sum of balances at all times

INV-004 access

Admin role changes cannot bypass timelock constraints

02Earned verdicts

A finding has to earn its verdict.

Most AI auditors hand you everything their model flagged. Guardix distrusts its own model and puts each finding on trial before it reaches you.

  1. 1

    Independent AI models propose findings. On its own, a flag is just a claim — Guardix doesn't trust it yet.

  2. 2

    It tries to prove the finding real (reproduce the attack on a fork) and to prove it false (find the exact line that defeats it). The finding has to survive both.

  3. 3

    Kept only when grounded in your invariants — criticals proven by a working exploit. Killed only when the validator cites the exact line that defeats the attack step.

Can't prove it either way? It stays in front of a human as needs_manual — never silently dropped. And for novel, bespoke attack paths and economic or game-theoretic design, human auditors still win. See where each wins →

03Coverage

The bug classes it hunts.

Named, real, EVM-wide — the repeatable, provable vulnerability classes Guardix is built to find across any Solidity contract.

Reentrancy
Single-function, cross-function, and cross-contract callback paths in vault, router, and callback flows.
Oracle & price manipulation
Stale feeds, single-source spot prices, and flash-loan-inflated prices that break liquidation and collateral math.
Access control & privilege escalation
Unprotected admin entry points, missing or bypassable timelocks, and role-boundary or guardian escalation.
Accounting & invariant drift
Divergence between internal accounting and real token balances — supply that no longer equals the sum of balances.
Unchecked external calls & returns
Ignored transfer and low-level-call return values, silent failures, and unvalidated callbacks.

Plus the long tail of best-practice and logic issues. For what we don't claim — novel economic design — see the comparison .

vault-core · scan history main
e7b2f4a today latest
c91d3e8 2 days ago
a3f8c1d 5 days ago

−3 critical, −5 high vs previous scan

04Continuous

Audit on every commit. Same flat price.

A human firm audits once — the report is stale the moment you push a fix. Guardix re-runs on your next commit and diffs against the last scan.

Run a new audit on each commit at the same flat price — no new scoping call.
Each scan is pinned to its commit and diffed against the last.
Everything's included: findings, exploit proof, architecture, shareable report — one price, no tiers.

Cheaper and faster than a manual engagement, but not a replacement for one — see exactly where each wins .