A Contract IDE to build.
An Auditing IDE to break.
One fork to prove it.
Develop, analyze and audit contracts and programs against reproducible chain state, from one security workspace.
- Ethereum
- BNB Chain
- Polygon
- Arbitrum
- Optimism
- Base
- Solana
contract Vault {
function withdraw(uint256 amt) external {
(bool ok, ) = msg.sender.call{value: amt}("");
balance[msg.sender] -= amt; // state written AFTER the call
}
}
pub fn withdraw(ctx: Context<Withdraw>, amt: u64) -> Result<()> {
let vault = &ctx.accounts.vault;
**vault.try_borrow_mut_lamports()? -= amt;
// authority is read, never required to sign
Ok(())
}
- EOA Owner 0xd8dA…6045
- owner()
- TIMELOCK Governor 0x1a9C…f0b2 · 48h
- admin()
- PROXY Vault 0x9f41…c2ae
- implementation()
- LOGIC VaultV2 0x7B3d…a01e
REACHABLE Owner → upgradeTo() → funds skips the 48h delay
Who can change the program
One key can still replace the program outright.
How Solana authority is reported
Solana authority ships as graded findings, not as a graph you walk:
missing signer on authority
PDA owner not verified
upgrade authority is a single key
Accounts · withdraw
The program reads authority to decide who may withdraw, but never requires it to sign.
Result
Vault balance 9 SOL→0 SOL
withdraw() succeeded without the required authority signature.
vault_pda 9,000,000,000 → 0
recipient 0 → 9,000,000,000
lamports
One workspace, three surfaces.
Contract IDE
Write, compile and deploy Solidity and Vyper in the browser; open Rust programs for analysis.
- SurfaceDevelopers
- InputSolidity, Vyper; Rust read-only
- OutputCompiled and deployed to a fork (EVM)
Auditing IDE
Composer, Scanner and MorphVM against one live fork.
- SurfaceAuditors
- InputDeployed bytecode
- OutputReplay-verified findings
Architecture Explorer
Who controls what, read from chain state.
- SurfaceBoth
- InputBytecode, chain state
- OutputActors, authority, paths
Contract IDE
- Solidity
- Compile
- Deploy
Architecture Explorer
- Authority
- Actors
- Storage
Auditing IDE
- Findings
- Replay
- Trace
One shared execution context — a pinned fork on EVM, captured account state on Solana
Janus AI — an agentic auditor held to the same replay bar, in development and not yet available →
chain mainnet (chain_id 1)
block 22,847,313 (pinned — deterministic)
sender 0xd8dA…6045 (impersonated, no key)
balance overridden → 1,000 ETH
session shared with @audit-team ● live
// same state, both sides — no "works on my fork"
Real chain state. No transaction ever reaches the live network.
Every analysis session runs against isolated chain state — a fork pinned to a reproducible block on EVM networks, captured live account state on Solana. Inspect, modify and replay execution without touching live assets.
Explore fork environments →- 22,847,310
- 22,847,311
- 22,847,312
- 22,847,313
Mainnet
- continues
- untouched
- read-only
Trilocore fork
- sender override
- balance override
- transaction replay
- storage mutation
We build so that a finding is proven by execution, not argued from a report.
See why a finding is real
- Candidate
- PoC generated
- Fork replay
- State change observed
- Replay-verified
Trust is a precondition, not a feature.
Workspaces are private by default, execution never leaves an isolated fork, and no finding is reported until its proof-of-concept reproduces.
Trust Center Read the Trust CenterPut the workbench on your code
Run Trilocore against your contracts and programs, or walk through the platform with us.