Analysis engine
The engine under the workbench. It recovers what a deployed contract can do from its bytecode, then proves each finding by executing it on a pinned fork.
Program analysis that starts from bytecode, not trust
Under the workbench is an EVM analysis engine built for deployed contracts: it reconstructs what the code can do from the bytecode itself, then proves what it found by executing it.
- Inputdeployed bytecode
- Sourceoptional
- Recoverscontrol-flow, storage-flow, value-flow
- Outputa runnable proof-of-concept, pinned to a block
- Control-flow, storage-flow, and value-flow graphs recovered from raw bytecode
- Concolic calldata solving to reach guarded branches the fuzzer can't hit by chance
- MorphVM deobfuscation — lifts byte-VM dispatchers that hide selectors into readable logic
- Deterministic replay: every finding is a runnable PoC pinned to a fork block
- Source and verified ABIs enrich the analysis — they're never required
CALL Vault.deposit() value: 1 ETH
CALL Vault.withdraw()
├─ CALL attacker.fallback() ← external call first
│ └─ CALL Vault.withdraw() ← re-entered
└─ SSTORE balances[attacker] = 0 ← too late
✓ PoC reproduces — balance drained on fork, state diff attached
One engine, three panels
The same analysis drives the panels auditors work in — what the engine recovers is what the workbench shows.
Composer
Builds multi-step transaction sequences against the fork, so a candidate is rebuilt as the exact calls that cause it.
- Works ona pinned fork
- Outputa replayable sequence
Fuzzer
Generates and mutates calldata against deployed bytecode; concolic solving reaches the guarded branches chance never hits.
- Inputdeployed bytecode
- Guided byconcolic calldata solving
MorphVM
Lifts byte-VM dispatchers that hide selectors into readable logic, so obfuscated contracts analyze like ordinary ones.
- Targetobfuscated dispatchers
- Outputlifted, readable logic
Source optional.
Source and verified ABIs enrich the analysis. The engine never requires them.