The EVM security workbench

A Contract IDE to build. An Auditing IDE to break. One fork to prove it.

Developers write and store contract source securely in the Contract IDE. Auditors work the same code in the Auditing IDE — a Composer to replay transactions as any sender, a GPU-accelerated Fuzzer, a Scanner that proves findings by execution — all on the same live fork, in the browser.

Works on deployed bytecode — source optional Findings replay as proof-of-concepts before they're reported Confidential read-only handoff of code + notes to your audit team
Replay-verified
every reported finding ships as a runnable proof-of-concept
200+ detectors
static analysis plus GPU-accelerated fuzzing
Bytecode-level
analyzes deployed contracts — source optional
Any EVM chain
L1 or L2 — no per-chain setup
Built for Independent & firm auditors DeFi protocol teams In-house security engineers CI/CD security pipelines
The Contract IDE

A secure home for your contract source — think GitHub, for contract work

Developers build in a full browser IDE. Source and development notes live in private, secure storage inside your workspace — and hand off to your audit team confidentially, in read-only mode.

  • Write, compile, and deploy Solidity entirely in the browser — nothing to install
  • Deploy to a live fork and test against real protocol state before mainnet
  • Private, secure contract storage — your source stays inside your workspace
  • Development notes travel with the code — the context your auditor actually needs
  • Confidential read-only sharing: your audit team sees code and notes, and can't modify either
The Auditing IDE — BEVM

Every panel a security engineer expects — rebuilt for the EVM

The layout is deliberately familiar. Where a web proxy works on HTTP requests, the Auditing IDE works on transactions, calldata, and storage — against a live fork you control.

Target

Every contract in scope, with selectors grouped per contract — proxies, implementations, and linked contracts resolved into one map of the attack surface.

Composer

Compose a transaction and send it as any address — no keys needed on a fork. Inspect the full result, revert reason, and step-level debug trace.

Fuzzer

Mark payload positions in calldata and drive the GPU-accelerated fuzzer at them. Interesting inputs come back with the trace that produced them.

Scanner

200+ static detectors plus execution-validated checks. A candidate only becomes a finding when its proof-of-concept replays successfully on the fork.

Graph

Interactive control-flow graph of the deployed bytecode — computed jumps resolved, orphan blocks surfaced, paths traceable selector by selector.

Storage

Slot-level storage layout with mapping-key math done for you. Watch reads and writes flow through a transaction to see exactly what state an exploit needs.

Heap

A heap-and-stack view of every selector: memory allocations, mapping regions, and reachable state — the runtime picture next to the static one.

Decoder

Calldata, returndata, and event decoding backed by a function-selector database — paste raw bytes, get back what the contract actually saw.

MorphVM

Some contracts hide their logic behind a custom byte-VM dispatcher. MorphVM lifts the obfuscated dispatcher into readable logic so you can audit what it really does.

Blocks

Per-block analysis: which selectors can reach a block, what state it touches, and where a computed jump can land. The view auditors use to chase odd paths.

The analysis engine

Program analysis that starts from bytecode, not trust

Under the workbench is an EVM analysis engine built for deployed contracts: it reconstructs what the code can do from the bytecode itself, then proves what it found by executing it.

  • Control-flow, storage-flow, and value-flow graphs recovered from raw bytecode
  • Concolic calldata solving to reach guarded branches the fuzzer can't hit by chance
  • MorphVM deobfuscation — lifts byte-VM dispatchers that hide selectors into readable logic
  • Deterministic replay: every finding is a runnable PoC pinned to a fork block
  • Source and verified ABIs enrich the analysis — they're never required
Fork environments

Real chain state, without touching the real chain

Every session runs on an isolated fork of live chain state, pinned to a block. That's what makes findings reproducible — and what makes it safe to try the exploit.

  • Fork any EVM L1 or L2 at any block — no per-chain integration work
  • Impersonate any sender and override balances — no private keys involved
  • Share the fork, not a screenshot: teammates join the same state, live
  • Deploy work-in-progress contracts against real protocol state before mainnet
  • Forks are isolated and disposable — break things freely
Janus — the AI analyst

An analyst that uses the same tools you do

Janus is an EVM-specialized AI analyst built into the workbench. It doesn't guess from source text — it calls the same CFG, storage, decoder, and replay tools you use, then explains what it found in plain language.

  • Walks attack chains step by step, from entry selector to drained state
  • Reads raw bytecode and calldata, not just verified source
  • Turns machine findings into audit-ready write-ups with severity rationale
  • Suggests the concrete fix — and what to re-test after applying it
Why one workbench

Developers and auditors, on the same evidence

Security usually breaks down at the handoff — different tools, lost context, findings as prose no one can replay. Trilocore closes that gap by making both sides work in the same place.

01

One shared fork

Both sides work against identical pinned chain state — nothing to re-set-up.

02

Proof, not prose

Every finding ships as a runnable PoC either side can replay and confirm.

03

Self-check first

Developers run the same analysis their auditors will — before the review starts.

04

Full-context handoff

Auditors get code, dev notes, and fork state — read-only and confidential. No translation loss.

Who it's for

One platform, every workflow

Developers

Build in the Contract IDE: write, compile, deploy, and store source securely. Test on a fork, keep notes your auditors can read, and run the Scanner before they do.

Auditors

Triage a deployed contract in minutes: Scanner and Fuzzer for breadth, Composer and Graph for depth, replay-verified PoCs for the report.

Teams

Share sessions, fork states, and findings with one click. Work the same fork in real time and generate audit reports automatically.

Janus AI

Paste bytecode, calldata, or a finding — Janus reasons through the attack chain with real tools and writes it up in plain language.

Our mission

Make deep security something every builder can reach

On-chain code moves real value, yet audit-grade tooling stays locked behind scarce engagements. We're putting replay-verified analysis in every developer's hands — and giving auditors leverage to go deeper, faster.

For customers

Protocol teams, audit firms, and security engineers use Trilocore to ship safer contracts and prove findings with reproducible evidence. Book a technical walkthrough — we'll show you the workbench on your own code.

Book a walkthrough

Build with us

We're a small team obsessed with EVM internals, program analysis, and applied AI for security. If you want to work on the tooling that keeps on-chain value safe — as an engineer, researcher, partner, or backer — we'd like to hear from you.

Get in touch
Trust & practices

How we handle your code, and ours

Security tooling has to earn trust before it earns a workflow. These are the commitments the platform is built around.

Private by default

Your contracts, sessions, forks, and findings are visible only to your workspace. Sharing is explicit, per-session, and revocable — never implicit.

Isolated execution

Exploits are only ever replayed against isolated forks of chain state. Nothing the platform runs touches a live network or real funds.

Verified before reported

A finding reaches your report only if its proof-of-concept reproduces deterministically on the pinned fork. No speculative severity, no noise.

Coordinated disclosure

We practice and support coordinated disclosure. Report issues via security.txt or security@trilocore.com.

FAQ

Frequently asked questions

What is Trilocore?

A browser-based EVM security workbench where developers and auditors work on the same live fork: a Contract IDE for secure development, an Auditing IDE (Composer, Fuzzer, Scanner, Graph, Storage, MorphVM), replay-verified findings, team sessions, and the Janus AI analyst.

Do I need to install anything?

No. Trilocore runs entirely in your browser. Register for an account and start building or auditing immediately — no downloads, no local setup.

Which chains do you support?

Any EVM chain. Coverage extends to every EVM L1 and L2 with no per-chain integration work.

Do you need source code?

No. BEVM analyzes deployed bytecode directly — paste an address and it works from what's on-chain. If you do have source or verified ABIs, the analysis gets richer, but it's never a prerequisite.

Does Trilocore replace a manual audit?

No, and you should be skeptical of any tool that claims to. Trilocore makes review evidence-based and faster: developers catch what's catchable before review, and auditors spend their scarce time on the deep reasoning only humans do. High-value protocols should still get expert review — Trilocore is the workbench both sides share.

How are findings verified?

Every candidate finding is replayed as a proof-of-concept against a pinned fork of the target chain. If it doesn't reproduce, it isn't reported — that's what keeps false positives out of your report.

How is my code and data handled?

Workspaces are private by default: your contracts, fork states, and findings are visible only to the people you explicitly share a session with. Exploit verification runs exclusively against isolated forks — never live networks.

What is Janus AI?

An EVM-specialized AI analyst built into the platform. It calls the workbench's own analysis tools — CFG, storage, decoder, replay — to reason about attack chains, then explains findings and fixes in plain language.

Can I collaborate with my team?

Yes. Share sessions, fork states, and findings with one click, and hand code plus development notes to your audit team in confidential read-only mode. Your team can work on the same fork in real time and generate audit reports together.

How do I report a security issue?

See our security.txt or email security@trilocore.com. We support coordinated disclosure.

Put the workbench on your code

Run BEVM yourself, book a technical walkthrough, or talk to us about a security review or integration.

Or reach us directly: hello@trilocore.com · GitHub ↗