Audit

Firepan Audit is an automated adversarial review of selected smart contract source code. Its findings describe the scope and evidence analyzed; they are not a guarantee that the code is secure.

Overview

Use Scan to find common signals and Probe to investigate a repository baseline or compare a later run. Audit goes deeper into attack hypotheses for the selected source scope. A human-led Boutique Audit is a separate engagement.

Product	Scan	Probe	Audit
Purpose	Discover common signals	Investigate a baseline or compare a later run	Adversarially review selected source scope
Output	Risk score and findings	Exploratory findings and repository context	Curated findings with supporting evidence

How an Audit Works

Knowledge Graph Construction

The audit agent builds a knowledge graph of your contracts:

┌──────────────────────────────────────────────────────────┐
│                  Knowledge Graph                          │
├──────────────────────────────────────────────────────────┤
│  Contracts ─────────────────────────────────────────────  │
│     │                                                     │
│     ├── Inheritance relationships                         │
│     ├── Interface implementations                         │
│     └── Library dependencies                              │
│                                                           │
│  Functions ─────────────────────────────────────────────  │
│     │                                                     │
│     ├── Call graphs (internal + external)                 │
│     ├── State variable access patterns                    │
│     └── Modifier chains                                   │
│                                                           │
│  Data Flow ─────────────────────────────────────────────  │
│     │                                                     │
│     ├── User input → state changes                        │
│     ├── Cross-contract interactions                       │
│     └── Privilege escalation paths                        │
└──────────────────────────────────────────────────────────┘

Autonomous Analysis Agents

Multiple specialized agents analyze your code:

Agent	Focus
Strategist	High-level attack surface analysis
Scout	Deep code exploration and pattern recognition
Exploiter	Exploit hypothesis generation and validation
Verifier	Finding confirmation and false positive elimination

Exploit Hypothesis Generation

The agent generates and tests hypotheses:

1. Identify attack surfaces - External functions, privileged operations
2. Generate hypotheses - "What if an attacker could..."
3. Trace execution paths - Follow the code to validate/invalidate
4. Build proof of concepts - Where feasible, create reproducible exploits

Running an Audit

Via CLI

# Create a project
firepan project create myproject /path/to/contracts

# Build the knowledge graph
firepan graph build myproject --init --iterations 1

# Run the autonomous audit
firepan agent audit myproject

# Generate the report
firepan report myproject --format html

Via Platform

1. Connect your repository in the dashboard
2. Click "Run Audit" on your project
3. Monitor progress in real-time
4. Download the comprehensive report

What an Audit Investigates

Beyond Pattern Matching

Audit investigates issues that pattern matching may miss:

Category	Examples
Logic bugs	Incorrect state transitions, missing validations
Economic attacks	Price manipulation, flash loan exploits
Access control	Privilege escalation, admin backdoors
Integration risks	Oracle manipulation, callback reentrancy
Upgrade risks	Storage collisions, initialization issues

Report Contents

An Audit report includes:

• Executive Summary - High-level findings and risk assessment
• Detailed Findings - Each issue with severity, impact, and remediation
• Proof of Concepts - Reproducible exploit code where applicable
• Recommended Invariants - Tests you should add to your suite
• Code Quality Notes - Best practices and improvements

SaaS Platform Quotas

Audits are included in all platform tiers:

Tier	Audits/Month
Starter	1
Professional	3
Enterprise	10

Need more? Contact sales for custom quotas.

Boutique Audits

For critical launches requiring human oversight, our Boutique Audit service combines:

• AI-powered deep analysis sized to the agreed scope
• Human validation by senior auditors
• Extended review periods
• Direct communication channels
• Fix verification reruns

Best Practices

When to Use an Audit

• Pre-launch - Before deploying new contracts
• Major upgrades - Significant code changes
• Integration changes - New external dependencies
• Periodic review - Quarterly security checks

Preparing for Audit

1. Clean build - Ensure your contracts compile without errors
2. Documentation - NatSpec comments help the AI understand intent
3. Test coverage - Existing tests provide context for expected behavior
4. Known issues - Document any accepted risks or intentional patterns

Next Steps

• Pricing - See audit quotas by tier
• CI/CD Integration - Automate security in your workflow
• CLI Reference - Full command documentation