Chainvet - Hybrid Smart Contract Auditor

Ecosystem

Use Chainvet your way.

Run scans from the Web UI, VS Code, or CLI. The findings, details, and reports stay consistent everywhere.

Web UI

Run, triage, and export reports from a local audit workspace.

VS Code

Inspect findings next to the Solidity file you are already editing.

CLI

Use the same hybrid engine in scripts, CI jobs, and repeatable audits.

$ chainvet scan Reentrancy.sol summary static 2/4 · symbolic 4 · fuzz 100% findings 7 high · 6 medium · 3 low

target Reentrancy.sol

Hybrid Analysis

Completeresults ready

00:00:04

bug_reportFindingsready · 03

1 high1 medium1 low

search

read_moreDetailsselected finding

Highwithdraw()

External call before balance reset

The function transfers Ether to msg.sender before updating storage, allowing a callback to re-enter while the original balance is still available.

msg.sender.call.value(balance)();
balances[msg.sender] = 0;

Run notes

No warnings for this target.

Web UI

Run audits from a local workspace.

Pick a target, scan it, filter findings, and export reports from the browser.

Browse contracts and Solidity files visually.
Filter findings by severity, kind, function, or file.
Export PDF and Markdown reports from the runbar.

Reentrancy.sol | Chainvet

CHAINVET ···

Analysis complete 3 findings

Target · Reentrancy.sol

Engine · hybrid

Elapsed 4s

Severity breakdown

High 1

Medium 1

Low 1

1pragma solidity ^0.4.24;

2

3contract Vault {

4 mapping(address => uint256) public balances;

5

6 function deposit() external payable {

7 lastBlock = block.timestamp;

8 balances[msg.sender] += msg.value;

9 }

10

11 function withdraw() external {

12 (bool ok,) = msg.sender.call.value(balances[msg.sender])();

13 require(ok);

14 balances[msg.sender] = 0;

15 }

16}

17

18contract Receiver {

19 function trigger(address target) external {

20 target.call(bytes4(keccak256("withdraw()")));

21 }

22}

HHigh severity · Finding

Reentrancy In Withdraw Reentrancy.sol:12

Message

The withdrawal path performs an external call before clearing the sender balance, allowing a callback to re-enter while state still reflects the original funds.

Metadata

Functionwithdraw() Evidencecall.value before storage update

Source

msg.sender.call.value(balances[msg.sender])();
balances[msg.sender] = 0;

▶ Chainvet: Analyze Current File
$ chainvet --hybrid Reentrancy.sol --json
  frontend   Solidity structure loaded
  pipeline   static + path + fuzzing context
  triage     merge duplicates and quiet noisy leads
✓ 3 findings ready (1 high · 1 medium · 1 low)
✓ diagnostics updated

ChainvetSolidityUTF-8Ln 12, Col 5

VS Code extension

Review findings where the code lives.

The extension keeps scans, diagnostics, report actions, and finding details inside VS Code.

Analyze the active file, workspace, or a selected folder.
Jump from a finding to its source location.
Generate cached PDF or Markdown reports after analysis.

bash · chainvet scan

❯ chainvet scan ./reentrance.sol
chainvet 0.1.0 · hybrid Solidity security analyzer

target: ./reentrance.sol    mode: hybrid

static targets 1/1  ·  symbolic findings 3 (10 states)  ·  fuzz coverage 87.5% (1 corpus)

Findings (4)
┌──────────┬──────────────────────────────┬───────────────────┬───────────┬────────────────────────────────────────────┐
│ Severity ┆ Kind                         ┆ Location          ┆ Tier      ┆ Message                                    │
╞══════════╪══════════════════════════════╪═══════════════════╪═══════════╪════════════════════════════════════════════╡
│ HIGH     ┆ arbitrary-storage-write      ┆ reentrance.sol:27 ┆ confirmed ┆ Storage write at user-controlled index may │
│          ┆                              ┆                   ┆           ┆ overwrite arbitrary …                      │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ HIGH     ┆ reentrancy-eth-transfer      ┆ reentrance.sol:21 ┆ candidate ┆ RE-04: reentrancy in `withdraw`: state     │
│          ┆                              ┆                   ┆           ┆ variable is read before …                  │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ MEDIUM   ┆ msg-value-in-loop            ┆ reentrance.sol:24 ┆ confirmed ┆ msg.value accessed inside a loop; each     │
│          ┆                              ┆                   ┆           ┆ iteration may transfer E…                  │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ MEDIUM   ┆ missing-input-validation     ┆ reentrance.sol:13 ┆ candidate ┆ parameter `_to` in function `donate` may   │
│          ┆                              ┆                   ┆           ┆ lack zero-address vali…                    │
└──────────┴──────────────────────────────┴───────────────────┴───────────┴────────────────────────────────────────────┘
  2 high · 2 medium · 0 low      2 confirmed · 2 candidate

CLI Tool

Use the same scanner from scripts and terminals.

The CLI prints clean finding tables for humans and structured output for automation.

Scan one Solidity file or an entire project directory.
Use pretty terminal output for humans or JSON for automation.
Set severity filters and time caps from scripts or CI jobs.
Add the Chainvet scan skill to compatible coding agents with npx skills add.

Why Chainvet

Built for audit flow, not alert dumps.

Chainvet combines multiple engines, keeps scans moving when projects are messy, and turns results into findings that are easier to review, explain, and report.

hybrid runStatic + Fuzzing + Symbolic

01Static scandetectors, sinks, entry points

02Fuzz runcoverage and concrete traces

03Path checkbranch and state context

Hybrid engine

One finding can carry more than one signal.

Static checks find suspicious code quickly. Fuzzing and symbolic reasoning add context where it matters, so findings are easier to trust and explain.

Single-engine outputAlerts often need extra manual work before they are ready to explain.

ChainvetCombines static, fuzzing, and symbolic context before a finding reaches you.

Static Analysisquickly maps risky code patterns

Symbolic Executionchecks whether suspicious paths can happen

Fuzzingruns concrete transaction sequences

Hybrid pipeline

One scan. Three ways to catch risk.

The pipeline starts broad, checks suspicious paths, and runs concrete cases so the final finding has more context than a single alert.

Static analysis scans functions, storage writes, calls, values, and common Solidity risk patterns.
Symbolic execution checks branch and state conditions behind suspicious flows.
Fuzzing turns selected risks into concrete traces for triage and reports.

01 / Static Analysis

Start with a fast map of risky code.

Static analysis quickly marks suspicious functions, storage writes, external calls, value transfers, and known Solidity risk patterns.

source spans and function map known risk pattern checks promising leads sent deeper

chainvet hybrid

static    map contracts/functions
scan      calls, storage, values
queue     leads for deeper checks

CI/CD integration

Keep contract checks in every pull request.

Run Chainvet in CI so high-severity issues show up before they reach deployment.

GitHub Actions and GitLab examples for common workflows.
Fail builds on high-severity findings when you want a hard gate.
Upload PDF reports as build artifacts for review.

Security Audit · main ✓ completed

Security Audit on push to main · completed

✓Checkout repository2s

✓Setup environment12s

✓chainvet --hybrid ./contractsfast

✓Generate PDF reportready

✓Upload artifactsready

# .github/workflows/audit.yml
name: Security Audit
on: [push, pull_request]

jobs:
  chainvet:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: cargo build --release
      - run: chainvet --hybrid ./contracts --report pdf

Generated reports

Reports that are ready to review.

Export PDF or Markdown reports with finding context, exploit notes, Solidity PoC snippets, and remediation guidance.

Generated Chainvet PDF Open full PDF

If the embedded viewer is unavailable, open the generated report PDF.

ChainvetHybrid Smart Contract Auditor