Developers write and store contract source securely in the Contract IDE. Auditors work the same code in the Auditing IDE — a Composer to replay transactions as any sender, a GPU-accelerated Fuzzer, a Scanner that proves findings by execution — all on the same live fork, in the browser.
Developers build in a full browser IDE. Source and development notes live in private, secure storage inside your workspace — and hand off to your audit team confidentially, in read-only mode.
The layout is deliberately familiar. Where a web proxy works on HTTP requests, the Auditing IDE works on transactions, calldata, and storage — against a live fork you control.
Every contract in scope, with selectors grouped per contract — proxies, implementations, and linked contracts resolved into one map of the attack surface.
Compose a transaction and send it as any address — no keys needed on a fork. Inspect the full result, revert reason, and step-level debug trace.
Mark payload positions in calldata and drive the GPU-accelerated fuzzer at them. Interesting inputs come back with the trace that produced them.
200+ static detectors plus execution-validated checks. A candidate only becomes a finding when its proof-of-concept replays successfully on the fork.
Interactive control-flow graph of the deployed bytecode — computed jumps resolved, orphan blocks surfaced, paths traceable selector by selector.
Slot-level storage layout with mapping-key math done for you. Watch reads and writes flow through a transaction to see exactly what state an exploit needs.
A heap-and-stack view of every selector: memory allocations, mapping regions, and reachable state — the runtime picture next to the static one.
Calldata, returndata, and event decoding backed by a function-selector database — paste raw bytes, get back what the contract actually saw.
Some contracts hide their logic behind a custom byte-VM dispatcher. MorphVM lifts the obfuscated dispatcher into readable logic so you can audit what it really does.
Per-block analysis: which selectors can reach a block, what state it touches, and where a computed jump can land. The view auditors use to chase odd paths.
Under the workbench is an EVM analysis engine built for deployed contracts: it reconstructs what the code can do from the bytecode itself, then proves what it found by executing it.
Every session runs on an isolated fork of live chain state, pinned to a block. That's what makes findings reproducible — and what makes it safe to try the exploit.
Janus is an EVM-specialized AI analyst built into the workbench. It doesn't guess from source text — it calls the same CFG, storage, decoder, and replay tools you use, then explains what it found in plain language.
Security usually breaks down at the handoff — different tools, lost context, findings as prose no one can replay. Trilocore closes that gap by making both sides work in the same place.
Both sides work against identical pinned chain state — nothing to re-set-up.
Every finding ships as a runnable PoC either side can replay and confirm.
Developers run the same analysis their auditors will — before the review starts.
Auditors get code, dev notes, and fork state — read-only and confidential. No translation loss.
Build in the Contract IDE: write, compile, deploy, and store source securely. Test on a fork, keep notes your auditors can read, and run the Scanner before they do.
Triage a deployed contract in minutes: Scanner and Fuzzer for breadth, Composer and Graph for depth, replay-verified PoCs for the report.
Share sessions, fork states, and findings with one click. Work the same fork in real time and generate audit reports automatically.
Paste bytecode, calldata, or a finding — Janus reasons through the attack chain with real tools and writes it up in plain language.
On-chain code moves real value, yet audit-grade tooling stays locked behind scarce engagements. We're putting replay-verified analysis in every developer's hands — and giving auditors leverage to go deeper, faster.
Protocol teams, audit firms, and security engineers use Trilocore to ship safer contracts and prove findings with reproducible evidence. Book a technical walkthrough — we'll show you the workbench on your own code.
Book a walkthroughWe're a small team obsessed with EVM internals, program analysis, and applied AI for security. If you want to work on the tooling that keeps on-chain value safe — as an engineer, researcher, partner, or backer — we'd like to hear from you.
Get in touchSecurity tooling has to earn trust before it earns a workflow. These are the commitments the platform is built around.
Your contracts, sessions, forks, and findings are visible only to your workspace. Sharing is explicit, per-session, and revocable — never implicit.
Exploits are only ever replayed against isolated forks of chain state. Nothing the platform runs touches a live network or real funds.
A finding reaches your report only if its proof-of-concept reproduces deterministically on the pinned fork. No speculative severity, no noise.
We practice and support coordinated disclosure. Report issues via security.txt or security@trilocore.com.
A browser-based EVM security workbench where developers and auditors work on the same live fork: a Contract IDE for secure development, an Auditing IDE (Composer, Fuzzer, Scanner, Graph, Storage, MorphVM), replay-verified findings, team sessions, and the Janus AI analyst.
No. Trilocore runs entirely in your browser. Register for an account and start building or auditing immediately — no downloads, no local setup.
Any EVM chain. Coverage extends to every EVM L1 and L2 with no per-chain integration work.
No. BEVM analyzes deployed bytecode directly — paste an address and it works from what's on-chain. If you do have source or verified ABIs, the analysis gets richer, but it's never a prerequisite.
No, and you should be skeptical of any tool that claims to. Trilocore makes review evidence-based and faster: developers catch what's catchable before review, and auditors spend their scarce time on the deep reasoning only humans do. High-value protocols should still get expert review — Trilocore is the workbench both sides share.
Every candidate finding is replayed as a proof-of-concept against a pinned fork of the target chain. If it doesn't reproduce, it isn't reported — that's what keeps false positives out of your report.
Workspaces are private by default: your contracts, fork states, and findings are visible only to the people you explicitly share a session with. Exploit verification runs exclusively against isolated forks — never live networks.
An EVM-specialized AI analyst built into the platform. It calls the workbench's own analysis tools — CFG, storage, decoder, replay — to reason about attack chains, then explains findings and fixes in plain language.
Yes. Share sessions, fork states, and findings with one click, and hand code plus development notes to your audit team in confidential read-only mode. Your team can work on the same fork in real time and generate audit reports together.
See our security.txt or email security@trilocore.com. We support coordinated disclosure.
Run BEVM yourself, book a technical walkthrough, or talk to us about a security review or integration.
Or reach us directly: hello@trilocore.com · GitHub ↗