AI smart contract security auditor

SC Audit is an aeon skill: Deep security audit of a smart-contract repo OR a live on-chain contract by address - detect Solidity, model the protocol invariants and trust boundaries first, run Slither (best-effort) plus a bounded agentic pass that hunts for a path breaking each invariant, triage, adversarially verify, prove with a fuzzer, and drive each finding through the shared responsible-disclosure routing. The dedicated contract arm split out of vuln-scanner. Like every aeon skill it is one SKILL.md prompt file that runs unattended on your own GitHub Actions, on a schedule or when you trigger it, and sends what it finds to Telegram, Discord, Slack or email.

Smart-contract bugs are logic and economics, not syntax. Slither matches known static patterns; it is weak on access control, protocol invariants, oracle/price manipulation, rounding/precision, upgradeability storage collisions, and cross-contract reentrancy - the classes that actually drain funds, and where exploitation on-chain is immediate and irreversible. That whole class is what an agentic reviewer catches by reading the source and reasoning about who can call what and which invariant breaks.

This skill is the contract arm split out of vuln-scanner. vuln-scanner detects Solidity and hands the repo here rather than running Slither inline; this skill owns the deep audit and then routes findings through vuln-scanner's shared disclosure machinery. It does not duplicate the disclosure/PVR/email logic - see §S7.

It audits two kinds of target: a GitHub repo (source in a repo you fork), and a live contract deployed on-chain by address (<chain>:0x<addr>) - the latter fetches the verified source from the block explorer/Sourcify and adds on-chain context (proxy/implementation, owner, funds at risk). A live deployed contract is where a bug is already exploitable with real money at stake, so on-chain findings are treated as the highest-stakes disclosure and are operator-gated - staged for a human, never auto-filed (§S7).

The agentic source pass is the reliable core. Slither is best-effort: a headless run has slither allow-listed but not solc / forge / solc-select, so contracts that need a compiler to build may not compile in-run. The source pass needs no compiler, so a clean audit never depends on Slither succeeding.

Every aeon skill takes one optional text input, var, set in aeon.yml or typed in when you run it by hand. It picks the target or the mode for that run.

Target selector. Four forms:

• ` (empty) -> auto-select the day's fresh feed target, audit **only if it contains Solidity**, else exit clean. See §S1 for the selection order (an optional sc-targets.json ledger, else the github-trending` feed).
• owner/repo -> audit that GitHub repo (e.g. Uniswap/v4-core, aave/aave-v3-origin).
• <chain>:0x<address> -> on-chain mode: audit a live deployed contract by address. It fetches the verified source from the block explorer (Etherscan V2) or Sourcify, materializes it as a Foundry project, and runs the same pipeline - plus on-chain context (proxy/implementation, owner/admin, funds at risk). chain in eth/base/arbitrum/optimism/polygon/bsc/... (bare 0x<address> defaults to eth). Examples: base:0x4200000000000000000000000000000000000006, eth:0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2. On-chain findings are operator-gated - never auto-filed/auto-emailed (see §S7). See §S1/§S2.
• fixture:<name> -> local regression mode: audit the bundled fixture at skills/sc-audit/fixtures/<name>/ (e.g. fixture:vault). No fork, no dedup, no disclosure - a self-contained way to exercise the whole pipeline including the fuzz arm, with no external repo. See §S1/§S2.

Besides the model you connected to aeon, SC Audit uses the following. Add secrets as GitHub Actions secrets on your aeon repo, or in Aeon Connect.

• GH_GLOBAL - optional secret, unlocks more data or features
• ETHERSCAN_API_KEY - optional secret, unlocks more data or features
• BLOCKSCOUT_API_KEY - optional secret, unlocks more data or features
• RESEND_API_KEY - optional secret, unlocks more data or features
• RESEND_FROM - optional secret, unlocks more data or features
• RESEND_REPLY_TO - optional secret, unlocks more data or features

Easiest: open Aeon Connect, sign in with GitHub and turn on SC Audit. No clone, no terminal. To add it to an existing aeon repo from a shell, run:

Then switch it on in aeon.yml (the default schedule is filled in):

skills:
  sc-audit: { enabled: true, schedule: "workflow_dispatch", var: "" }

New to aeon? Read the docs for how skills, schedules and memory fit together, or browse all skills.