Smart-Contract Security Infrastructure

Securing the
On-Chain Future

Trilocore makes smart-contract security testing visual — a Burp Suite for the EVM, right in your browser. See every selector, CFG block, and storage slot, replay any transaction, and prove exploits on a live mainnet fork. Backed by a 1024-thread GPU fuzzer, 208 detectors, and the Janus AI model.

Support the project Live Demo — bevm.trilocore.ai
$ scs analyze 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 --fuzz
Phase 1 · Recon ████████ 0.18s balance: 142.3 ETH
Phase 2 · X-Ray ████████ 0.31s selectors: 24, IR lifted
Phase 3 · Attack Graph ████████ 0.09s 3 orphan routes discovered
Phase 4 · GPU Fuzz ████████ 120s 187,432 exec/sec
─────────────────────────────────────────────────────────
CRITICAL  Delegatecall injection → arbitrary storage write (slot 0x0)
HIGH  Reentrancy: withdraw() violates CEI, 3.8 ETH extractable
Exploit PoC generated → dfresults/exploit_0xA0b8.sol
0K+
Lines of Security Code
0
Static Detectors
0
Parallel Threads
0K
Executions / Second
0
Tests Passing
0
Security Modules
Live in production — bevm.trilocore.ai
Reproducible exploit PoCs
Chain-agnostic EVM coverage
200K+ executions / second
208 vulnerability detectors
Browser workbench — no install
The Problem

$3.4B stolen across crypto in 2025 —
smart contracts are still the soft target

Existing tools still miss the attacks that matter — computed jumps into orphan blocks, precision and rounding errors, complex multi-step kill chains, legacy contract re-exploits, and business-logic flaws. Manual audits remain slow and expensive. The ecosystem needs fast, deep, automated security infrastructure anyone can run.

$3.4B
Stolen across crypto in 2025 (per Chainalysis). Smart-contract and protocol-logic bugs remain a primary attack surface — far from a solved problem.
62+
Smart-contract exploits ranked among the top attack methods of 2025 (per Beosin) — hundreds of millions lost, including Cetus (~$224M) and Balancer (~$128M).
$150K+
A full professional manual audit runs $150K–$250K and still takes weeks — prohibitive for early-stage and independent protocols.

What existing tools miss

  • P0
    Orphan block exploits — dead code blocks with DELEGATECALL or SELFDESTRUCT reachable via computed JUMP at runtime. Static analyzers never walk these paths.
  • P1
    Precision & rounding errors — tiny per-call rounding deltas drained across thousands of micro-swaps (the Balancer-style failure). Single-transaction analyzers never see the cumulative loss.
  • P1
    Composed attack chains — flash loan + oracle manipulation + reentrancy + legacy paths. Tools analyze single transactions, missing the multi-step kill chain.
  • P1
    Gate bypass & access control — require(msg.sender == owner) bypassed via ungated writers to the owner slot — worse in upgradeable and cross-chain setups. Attack-graph traversal is absent from existing tools.
  • P2
    Legacy & deprecated contracts — forgotten code that still custodies funds and gets re-exploited long after launch. Rarely re-audited, rarely monitored.
  • P2
    Speed & coverage — Echidna and Foundry fuzz at ~5K iterations/second; we run 200K+. ~40× throughput means far deeper exploration in the same time budget.

Manual audits take weeks. BEVM Scanner + Janus AI deliver GPU-accelerated deep fuzzing (200K+ exec/s), visual attack graphs, and reproducible exploit PoCs — in minutes.

Our Tools

Two weapons. One mission.

BEVM Scanner catches what fuzzers and auditors miss. Janus AI explains what it finds in plain language. Together they form a complete security pipeline — from bytecode X-ray to working exploit PoC.

BEVM Scanner
bevm.trilocore.ai ↗
GPU-accelerated EVM bytecode fuzzer running 1024 parallel attack threads. Five-phase pipeline — recon, x-ray, attack graph construction, fuzzing, and CPU replay confirmation on Anvil mainnet fork. Generates working Foundry exploit PoCs automatically.
  • Visual workbench: Repeater, Scanner, Intruder, CFG graph, storage
  • 208 static bytecode detectors across 20 submodules
  • 13 runtime oracles: taint, reentrancy, integer, control-flow
  • Orphan block discovery via bipartite attack graph
  • Gate bypass: caller injection, wall cracker, Z3 solver
  • 17 exploit seed templates + 8 mutation strategies
  • 6-layer CPU replay verdict on real mainnet state
  • Flash loan amplification: Aave V3, Balancer, dYdX
Janus AI Model
janus.trilocore.ai ↗
Purpose-trained AI security model specialized in EVM vulnerability analysis. Janus translates raw scanner findings into plain-language exploit reports, generates attack narratives, and surfaces composable attack chains that numeric oracles alone would miss.
  • EVM-specialized — trained on real on-chain exploit data
  • Plain-language severity explanations for non-expert readers
  • Attack chain composition — links single findings into kill chains
  • Exploit narrative generation for audit reports
  • Contextual remediation recommendations
  • Integrates with BEVM Scanner output natively
  • API-accessible — plug into any CI/CD security pipeline
01 · RECON
Bytecode X-Ray
Disassemble, build CFG, extract selectors, resolve 4byte names, detect compiler version and known CVEs. Complete in <0.5s.
02 · ANALYSIS
Attack Graph
Bipartite selector↔slot graph. Finds ungated write paths, orphan blocks with dangerous ops, and bypass routes through access control.
03 · FUZZ
GPU Execution
1024 SIMD threads. 8 mutation strategies. 13 live oracles. Attack graph seeds fed at energy 4.0–8.0. Orphan block PCs prioritized at weight 7.0.
04 · VERIFY
CPU Replay
6-layer verdict on Anvil mainnet fork: revert check, PC reach, gas stipend, ABI packing, fund flow analysis, trace confirmation.
05 · AMPLIFY
Profit Calculation
Flash loan wrapping on Aave V3, Balancer, dYdX. Loop amplification. NET_PROFIT = extracted − gas − fees − MEV discount.
06 · REPORT
Foundry PoC
Auto-generated Foundry exploit test with real calldata, profit assertion, and step-by-step attack narrative from Janus AI.
The Workbench

Security testing, made visual

Auditing a deployed contract used to mean a terminal and a stack of scripts. Trilocore puts it in your browser — a Burp Suite for the EVM. Every selector, every CFG block, every storage slot is laid out in front of you. Pick a function, set the sender, hit Send, and watch the execution trace on a live mainnet fork.

bevm.trilocore.ai
bevm RPC mainnet-fork Target balance 386.48 ETH History 1 ● Mainnet fork
▣Repeater
◎Scanner
⚡Intruder
◫Graph
✦AI
▤Contract
⌖Decoder
▦Storage
↯Transient
◳Blocks
⇆Comparer
◌Passive
Request
0x0286f920f893513c7ec9fe35ba0a4760229a243e
0x3d103b6d
transfer(address,uint256)
attacker
0
10000000
Response
EVM/1 200 OK
Gas-Used 23544
Sender-Delta −23544000000000 wei
Target-Delta 0 wei
Slots-Changed 0
0x000000000000000000000000000000000000000000000000005528bed8b9663f400
uint256 98181829285200000000
address 0x…5528bed8b9663f400
EXECUTION TRACE 66 steps · gas 23544
Terminal opcode RETURN
Revert PC 0xdb @ depth 1

Live at bevm.trilocore.ai. No install, no source code required: paste an address and the bytecode is disassembled, selectors resolved, and the CFG mapped in under a second.

How We Compare

Built for the attacks others miss

Most tools stop at single-transaction static analysis. Trilocore models the full on-chain kill chain at GPU speed — and ships a working, replay-verified exploit, not just a warning.

Capability Slither Echidna / Foundry Manual audit Trilocore
Execution throughputstatic~5K exec/s—200K+ exec/s
Orphan-block / computed-JUMP discovery✗✗manual✓
Composed multi-contract chains✗limitedmanual✓
Flash-loan + oracle modeling✗✗manual✓
Auto-generated exploit PoC✗harness onlymanual✓
Mainnet-fork replay verdict✗manualmanual✓
Plain-language AI reporting✗✗✓Janus AI

Comparison reflects typical capabilities of each approach for end-to-end, bytecode-level exploit discovery. Throughput figures are order-of-magnitude.

Roadmap

What we're building next

Here’s what we’re building next — every release ships as open security infrastructure for the entire ecosystem.

  • ✓
    BEVM Scanner v1 — Complete
    GPU fuzzer, 208 detectors, attack graph, gate bypass, orphan block discovery, Anvil replay. Live at bevm.trilocore.ai.
  • →
    Multi-Contract Fuzzing Engine — Q3 2026
    End-to-end fuzzing across 3–5 contract chains. Flash loan → oracle → drain modeled as a single transaction sequence. Covers the real DeFi kill chain.
  • Janus AI Model Launch — Q3 2026
    EVM-specialized vulnerability analysis model. Plain-language exploit reports, attack chain composition, CI/CD integration API.
  • Cross-Protocol Oracle Manipulation — Q4 2026
    Inject manipulated oracle returns during fuzzing. Detect AMM pool drain via TWAP manipulation. Closes the biggest gap in existing DeFi security tooling.
  • ○
    Multi-Block Temporal Attacks — Q1 2027
    Governance flash voting, TWAP grinding across blocks. Models the attacker timeline, not just single-TX snapshots.
  • ○
    Public API + SDK — Q1 2027
    REST API exposing scanner, fuzzer, and Janus results. SDK for embedding security checks directly into protocol CI pipelines.
Where we focus our effort
Core R&D — Multi-Contract Fuzzing 40%
Janus AI Model — Training & Inference 30%
Infrastructure & RPC Costs 15%
Documentation & Community 10%
Security Audits of Our Own Code 5%
Why this matters

Smart contract exploits don't just hurt individual protocols — they erode confidence in the entire ecosystem. Every dollar lost to a preventable vulnerability is a setback for mainstream adoption. We extend deep, automated security coverage to teams that could never afford a six-figure manual audit, strengthening the whole ecosystem.

FAQ

Frequently asked questions

How is Trilocore delivered?
As hosted, production-grade infrastructure that protocols and auditors can use directly, with integration APIs for CI/CD pipelines.
What is live today?
The BEVM Scanner runs in production at bevm.trilocore.ai — GPU fuzzer, 208 detectors, attack-graph analysis, and mainnet-fork replay. It's usable right now, not a roadmap promise.
Which chains do you support?
Any EVM chain. Analysis operates on raw bytecode, so coverage extends to every EVM L1 and L2 with no per-chain integration work.
How do you measure impact?
Confirmed vulnerabilities with reproducible PoCs on mainnet-fork state, coverage/throughput benchmarks against existing tools, and adoption by protocols and auditors running the platform.
Why does ecosystem security matter?
Exploits erode confidence across the entire ecosystem, not just the hacked protocol. Extending deep, automated security coverage raises the floor for everyone — especially early-stage teams that can't afford a six-figure manual audit.
Get Involved

Support the build

Trilocore is free for every builder. If you'd like to support the project — partnership, integration, or backing — we'd love to hear from you.

To support the project, please contact:

saiteja@trilocore.com →
Or reach us directly at: saiteja@trilocore.com bevm.trilocore.ai
Thank you — we'll be in touch personally.