Three tools we built for our own audit work and released publicly, plus the self-check list we recommend running before you hire anyone — including us.
An open-source static analyser for Sway, the smart contract language of the Fuel Network, published on crates.io. Installs with cargo install swayscan — no account, no gate, no telemetry.
Contract inspection for a deployed EVM address. Open EVM Sleuth and see what the bytecode actually is before you approve or deposit.
A free, MIT-licensed VS Code extension that catches secrets before they leave your machine — plaintext private keys, seed phrases, mnemonics and API keys — and flags risky dependencies. Scanning is local-first: nothing is uploaded. Read more about Bastion Security.
Yes. SwayScan is open source on crates.io and EVM Sleuth is free in the browser. There is no account wall and no gated tier.
No. Static analysis catches mechanical bug classes cheaply and at scale, but it cannot know your intent, so it cannot find an accounting error that is internally consistent, a liquidation that is profitable to grief, or an oracle window short enough to move.
Run a static analyser and triage every finding, write your invariants down, get a fuzz campaign on the most important one, and enumerate your privileged roles.
Frequently — invariant harnesses, differential test rigs and exploit scaffolding specific to your system. Those go to you at the end of the engagement.
Send the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.