Lab 04
Contract Auditor
Find the dangerous mistake
Check a sample contract for security problems, then see whether a proposed fix passes a second check.
Overview
A small programming mistake can expose valuable assets.
How this could help a business
Automated checks can support engineering reviews and delivery pipelines. They complement human review and testing; they do not certify software as safe.
What I built
- An authenticated application connecting a browser interface to an isolated code-analysis service.
- A pipeline that selects a compiler, analyses the program and streams findings back to the page.
Live demo
Choose one of the deliberately vulnerable examples, then run the check.
What I built
Implementation, decisions and evidence.
What Sebastian built
The application around the technology.
- An authenticated application connecting a browser interface to an isolated code-analysis service.
- A pipeline that selects a compiler, analyses the program and streams findings back to the page.
- Deterministic repair recipes with compilation and a second analysis before reporting whether a pattern cleared.
One engineering decision
Check every proposed fix again and report unresolved findings rather than implying a patch must be correct.
What to check yourself
Run an example and inspect its findings and rechecked patch events. Raw event details are under Measured output and pipeline details in What I built.
Tools and model credits. Slither performs static analysis and Solidity compilers translate the contracts. Repairs use explicit code recipes, not AI-generated guesses.
These are portfolio demonstrations. Explore professional experience separately, or discuss how the approach could fit your team.
Learn
Understand what the application is doing.
Choose a story below to see what could go wrong. The live checker reports risky code patterns and checks proposed fixes when its server is connected.
Pause and predict
If the checker reports no problems, is the program guaranteed safe?
A learning question, not a score. Try this in the working demo.
Try changing something
Now make it your experiment.
Choose the wallet example, read the dangerous authorisation pattern, then compare the proposed repair with its second-check result.
The checker detects known patterns and can miss other issues. Some proposed fixes remain flagged and are labelled accordingly.
A few words, explained
- Contract
- Here it means a program on a blockchain, not a legal document.
- Static analysis
- Examining a program's structure for risky patterns without operating it with real assets.
Data handling & current limitations
Code is sent to the checker and discarded. A clean check is not a security certification.
Demo only. Each lab below explains which inputs stay on your device and which data is sent for server-backed features. Model files are downloaded and may remain in your browser cache. Hosting and security services also receive the network requests needed to serve the site.
Your contract source is sent to our container and written to an isolated temporary workspace for analysis. That workspace is removed after the request. Application request logs contain status, duration and a request ID, not your source.
The checker detects known patterns and can miss other issues. Some proposed fixes remain flagged and are labelled accordingly.