ChainGuard

Solidity attack-chain analysis

See how isolated findings combine into an exploit path.

ChainGuard maps your repository, runs static analysis, and reasons across contracts to surface potential multi-step attack chains. Every step is tied to source code, and every chain shows where to break it.

Analyze a repositoryOpen Demo Analysis

The Demo Analysis uses a fixture repository and pre-recorded results. It is labelled as such throughout.

CG-001Critical
Demo Analysis · fixture data

Potential oracle takeover leading to over-borrowing

  1. 1

    Deploy a malicious pool

    Attacker action · IPool.getReserves

  2. 2

    Replace the oracle price source

    Vulnerability · SpotPriceOracle.setPool

  3. 3

    `pool` now points to the attacker contract

    State change · SpotPriceOracle.setPool

  4. 4

    Deposit nominal collateral

    Attacker action · LendingVault.depositCollateral

  5. 5

    Oracle returns an inflated spot price

    External dependency · SpotPriceOracle.getPrice

  6. 6

    Collateral valued at the manipulated price

    Contract function · LendingVault.collateralValue

Investigate this chain

Evidence first, reasoning second

AI reasoning is never the source of truth. Candidate chains are validated against the deterministic repository map before they reach you.

  1. 01

    Ingest

    Clone a public GitHub repository or extract a ZIP in an isolated workspace. No project code is executed.

  2. 02

    Map

    Contracts, functions, modifiers, external calls, state reads and writes, and oracle dependencies.

  3. 03

    Detect

    Slither detectors are normalized into findings with exact file and line locations.

  4. 04

    Reason

    AI proposes how findings connect across functions and contracts, using only mapped context.

  5. 05

    Validate

    Every referenced file, contract, function, and line range is checked against the map.

  6. 06

    Break

    Each chain lists the minimum changes that invalidate its steps.

What ChainGuard does not claim

  • No confirmed exploits. Chains are potential paths derived from static evidence. ChainGuard does not execute transactions.
  • No safety guarantee. An empty result is not proof of security and does not replace a professional audit.
  • Clear uncertainty. Claims that cannot be validated against the repository are marked Unverified and kept separate.