-
-
A review map for smart contracts.
Inspiration
Arkheionx came from my own experience doing Web3 security research.
When I look at a large Solidity or DeFi repo, the hard part is not only writing a test. The hard part is knowing where to look first.
Sometimes the repo has many contracts, many flows, and many assumptions. If I just ask an AI agent to “find bugs”, the result can become too broad. It may produce many ideas, but not enough clear evidence.
So I built Arkheionx to make the review process less random.
The main idea is simple: before writing tests, I want to understand the repo better. Where does value enter? Where does it move? Where can it leave? Which contracts interact with each other? Which parts are important but not reviewed deeply enough?
What it does
Arkheionx is a local Ethereum devtool for reviewing Solidity repositories.
It helps map value flow, contract interactions, important assumptions, weak review surfaces, and parts of the repo that may need more Foundry tests.
The latest version adds a scope-aware workflow.
This means Arkheionx can take an audit or bug bounty scope note and turn it into review lanes, focused tasks, evidence requirements, and a report filter.
So instead of starting with a vague prompt like “find bugs in this repo”, Arkheionx starts from the actual scope, the repo structure, and the evidence needed.
Arkheionx does not try to be an automatic auditor. It does not say a candidate is definitely a bug, it does not assign final severity, and it does not submit reports for the user.
It is more like a local research helper for builders and security researchers who want to review Solidity repos with more structure.
How we built it
I built Arkheionx as a local-first CLI tool for Solidity and Foundry workflows.
The tool uses static repo analysis, Markdown reports, JSON outputs, and local evidence templates. It does not need RPC access and does not run anything against a live chain.
Example workflow:
arkheionx scope-map . --scope-file scope.md
arkheionx scope-pack . --scope-file scope.md --out .arkheionx/scope-pack
arkheionx evidence-judge . --scope-file scope.md
arkheionx report-filter . --scope-file scope.md
Project links:
Challenges we ran into
The biggest challenge was keeping the tool honest.
In smart contract security, it is very easy to overclaim. I did not want Arkheionx to sound like a magic AI auditor or an automatic bug finder.
So I kept the boundary clear.
A review lane is not a finding.
A candidate with evidence is not automatically a valid vulnerability.
Human review is still required.
Another challenge was noise. A security tool should help focus the review, not create even more random output to read.
I wanted Arkheionx to help answer: what should I review first, what is in scope, what evidence do I need, and is this candidate worth continuing?
Accomplishments that we're proud of
I am proud that Arkheionx became more than a small script.
It now has a working CLI, documentation, website, GitHub release, and a clearer workflow for Ethereum security research.
I am also proud that the project stays grounded. It does not try to replace audits or human researchers. It tries to help people review Solidity repos with better structure.
The latest version also feels closer to how real bug bounty and audit contest research works: start from the scope, build review lanes, create focused tasks, test locally, then filter the candidate before submitting anything.
What we learned
I learned that smart contract review is not only about finding bugs.
A big part of the work is attention management: knowing what is in scope, where value moves, what assumptions matter, what was already tested, and what kind of evidence is strong enough before submitting anything.
I also learned that AI agents are more useful when they are given clear scope, focused tasks, and evidence requirements instead of one vague instruction.
For me, Arkheionx is also a way to document the research process better: what was reviewed, what was rejected, and why.
What's next for Arkheionx
Next, I want to test Arkheionx on more real Ethereum and DeFi repositories.
The main focus is improving the scope-aware workflow, making the evidence judge more useful, and creating better examples for builders and security researchers.
I also want Arkheionx to be useful in real bug bounty and audit-style workflows, not only for finding candidates, but also for documenting the review process before a final report is submitted.
Log in or sign up for Devpost to join the conversation.