The panels for working a target: compose transactions as any sender, fuzz calldata, read storage slot by slot, and trace what actually executed.
The layout is deliberately familiar. Where a web proxy works on HTTP requests, the Auditing IDE works on transactions, calldata, and storage — against a live fork you control.
Every contract in scope, with selectors grouped per contract — proxies, implementations, and linked contracts resolved into one map of the attack surface.
Compose a transaction and send it as any address — no keys needed on a fork. Inspect the full result, revert reason, and step-level debug trace.
Mark payload positions in calldata and drive the GPU-accelerated fuzzer at them. Interesting inputs come back with the trace that produced them.
Static detectors plus execution-validated checks. A candidate only becomes a finding when its proof-of-concept replays successfully on the fork.
Interactive control-flow graph of the deployed bytecode — computed jumps resolved, orphan blocks surfaced, paths traceable selector by selector.
Slot-level storage layout with mapping-key math done for you. Watch reads and writes flow through a transaction to see exactly what state an exploit needs.
A heap-and-stack view of every selector: memory allocations, mapping regions, and reachable state — the runtime picture next to the static one.
Calldata, returndata, and event decoding backed by a function-selector database — paste raw bytes, get back what the contract actually saw.
Some contracts hide their logic behind a custom byte-VM dispatcher. MorphVM lifts the obfuscated dispatcher into readable logic so you can audit what it really does.
Per-block analysis: which selectors can reach a block, what state it touches, and where a computed jump can land. The view auditors use to chase odd paths.
A candidate becomes a finding only when its proof-of-concept reproduces against the pinned fork.