• 

  architecture

Inspiration

Smart-contract bugs are unusually expensive: a small logic mistake can become an irreversible on-chain loss. We wanted to make security auditing more accessible by building an agent that does more than flag suspicious code—it follows a vulnerability path, creates a proof of concept, proposes a patch, and verifies that the exploit no longer works.

What it does

FLEXX is an autonomous smart-contract auditing agent for Solidity projects. It combines deterministic static analysis with an LLM-guided investigation loop to detect issues such as reentrancy, tx.origin misuse, missing access control, and unsafe self-destruct patterns.

Instead of treating a finding as complete after pattern matching, FLEXX aims to validate it through differential testing:

$$ \text{Valid finding} = \text{exploit succeeds on vulnerable code} \land \text{exploit fails after the patch} $$

This helps separate genuine vulnerabilities from noisy alerts.

How we built it

We built FLEXX in Python around a tool-driven audit workflow:

1. Parse Solidity projects, including multi-file imports and compilation-unit dependencies.
2. Build call graphs and state-effect maps to understand cross-function behavior.
3. Run structural detectors and produce candidate vulnerabilities.
4. Use Foundry to compile and execute proof-of-concept tests.
5. Generate or apply patches, then rerun the same exploit to verify the fix.
6. Produce structured JSON and Markdown reports with traces, PoCs, patches, and discarded false leads.

The system supports OpenAI-compatible providers, Gemini, Groq, and OpenRouter, while keeping the deterministic analysis and verification layer independent of the model provider.

What we learned

The biggest lesson was that detection is not verification. A static signal may look convincing but still be unreachable, harmless, or incorrectly modeled. Requiring a PoC and a patch regression test made the system more reliable and forced us to design better tooling around compilation errors, revert reasons, and test feedback.

We also learned that a hybrid approach works best: deterministic analysis provides repeatable structure, while language models help investigate context, reason about candidate paths, and communicate findings.

Challenges we faced

The hardest challenge was reducing false positives without hiding real vulnerabilities. For example, an unprotected function is not automatically dangerous; it must perform a privileged action such as changing ownership or draining funds.

We also had to handle multi-file Solidity imports, interprocedural call paths, modifiers, loops, provider tool-call failures, and fragile PoC generation. To address this, we added bounded retries, deterministic PoC scaffolds for common vulnerability classes, source-order-aware analysis, and differential verification gates.

FLEXX is our attempt to turn smart-contract auditing from “this looks risky” into “here is the exploit, here is the fix, and here is proof that the fix works.”

Built With

• api
• auditing
• contracts
• foundry
• gemini
• groq
• npm
• openai
• openrouter
• python
• reentrancy
• solidity