The smart contract security workbench for developers and auditors.
Build and test contracts on real chain state, investigate deployed code, and replay every finding on an isolated fork before it is reported — one workspace for the people who write the code and the people who review it.
- Ethereum
- BNB Chain
- Polygon
- Arbitrum
- Optimism
- Base
- Solana
Research you can check
We publish incident analyses and vulnerability research worked from deployed contracts — the kind of investigation Trilocore is built for.
From first deploy to a reported finding
Every capability works on deployed contracts and real chain state, so what you test matches what is live.
Build and test on real chain state
Write, compile and deploy Solidity and Vyper in the browser with the Contract IDE, then test against fork environments of real chain state. No transaction ever reaches the live network.
- ForContract developers
- LanguagesSolidity, Vyper; Rust read-only
- Runs onAn isolated fork pinned to a block (EVM)
Find, replay and report issues
Open a deployed contract in the Auditing IDE, scan it for issues, send transactions as any address and replay a candidate on the fork. A finding is reported only when it reproduces. Contract analysis works with or without source.
- ForAuditors and security researchers
- InputDeployed contracts, source optional
- OutputReplay-verified findings with a trace
Understand who controls a protocol
The Architecture Explorer maps a protocol's roles, permissions and upgrade paths from chain state, so you can see which accounts can change a contract — and whether any path skips a timelock.
- ForAuditors and protocol teams
- InputDeployed contracts, chain state
- OutputActors, authority and the paths between them
Find the contracts worth reviewing
Tradar searches deployed Ethereum contracts by what they do — the opcodes they contain, the functions they answer, their proxy and admin shape — then lets you open a candidate in the Auditing IDE. A match is a lead, not a finding.
- NetworkEthereum
- CoverageAn indexed slice, marked incomplete on every result
- StatusAvailable from your account
Built for both sides of an audit
Developers and auditors work against the same contract context, findings and fork state.
Contract developers
Write and deploy in the browser, test on a fork of real chain state and catch what is catchable before review. Hand the project to your auditors read-only.
Auditors and security researchers
Work a deployed target end to end: find candidates, replay them on a pinned fork and report findings that arrive with a reproducible trace.
Protocol teams
See who controls your contracts and how they can be upgraded, share code privately with your reviewers and read their findings against the same fork state.
One question, one reproducible answer
The question. An auditor is asked whether anyone other than its owner can drain a vault contract on Ethereum.
Why it matters. The answer arrives as evidence rather than opinion: a transaction sequence anyone on the team can replay at the same block, with the state change it causes. The developer sees exactly what to fix, and the same replay can be run again after the fix.
Reentrancy in withdraw()
The vault sends funds before it updates the caller's balance, so a contract that calls back into withdraw() is paid more than once.
- TargetVault contract, Ethereum
- Issue classReentrancy
- ForkEthereum, pinned at block 22,847,313
- ReplayReproduced: 41.2 ETH moved to the test account
- ImpactCritical: vault funds at risk
- EvidenceTransaction trace and runnable proof-of-concept
What we commit to, and what we do not claim
Check the fit before you start: what we hold to today, where Trilocore works, and its limits.
Commitments
- WorkspacesPrivate by default, shared only with people you choose
- ExecutionIsolated forks; no transaction reaches the live network
- AI providersNo contract source, bytecode or workspace content is sent to any model provider
- Hand-offRead-only and revocable
Scope and limits
- NetworksEthereum, BNB Chain, Polygon, Arbitrum, Optimism, Base and Solana (SVM); capabilities vary by network
- SolanaRust programs are analyzed as source, not compiled
- CertificationNone claimed
- Service levelsNo SLA or availability target is published
- AI assistanceJanus AI is in development and not available.
What people ask first
What is Trilocore?
A browser-based smart contract security workbench. Developers write, compile and deploy contracts and test them on forks of real chain state; auditors investigate deployed contracts and replay each finding on an isolated fork before it is reported.
Who is it for?
Contract developers, auditors and security researchers, and protocol teams who need to know who controls their contracts. Developers and auditors work against the same contract context, findings and fork state.
How do I get access?
An account is required. Launch the app to sign in or create one, or book a demo for a walkthrough with us.
Does this replace a manual audit?
No. Trilocore makes review evidence-based and faster: developers catch what is catchable before review, and auditors spend their time on the reasoning only people can do. High-value protocols should still get expert review.
Which chains are supported?
Six EVM networks — Ethereum, BNB Chain, Polygon, Arbitrum, Optimism and Base — and Solana. Not every capability is available on every network, and Tradar searches Ethereum only. The support matrix lists what is available where.
How is my code handled?
Workspaces are private by default: your contracts and programs, session state and findings are visible only to the people you explicitly share a session with. Verification runs against isolated forks and captured account state; live networks are read to source that state, never written to. No contract source, bytecode or workspace content is sent to any model provider. See the Trust Center for details.
Put the workbench on your code
Launch the app to sign in or create an account, or book a demo and walk through it with us.