How It Works

FirePan combines AI-powered analysis with human expertise to deliver comprehensive smart contract security.

The AI + Human Hybrid

Our approach leverages the strengths of both automated and manual analysis:

┌─────────────────────────────────────────────────────────┐
│                   Your Repository                        │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│              Static Pattern Analysis                     │
│  • 15+ vulnerability patterns                           │
│  • Solidity/Vyper support                               │
│  • Sub-second execution                                 │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│              AI Verification Layer                       │
│  • LLM-powered false positive filtering                 │
│  • Context-aware analysis                               │
│  • Exploit hypothesis generation                        │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│            Human Review (Boutique Audits)                 │
│  • Senior auditor validation                            │
│  • Complex logic analysis                               │
│  • Business context consideration                       │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│                 Actionable Report                        │
│  • Prioritized findings                                 │
│  • Remediation guidance                                 │
│  • Code snippets and fix suggestions                    │
└─────────────────────────────────────────────────────────┘

Analysis Pipeline

Stage 1: Pattern Detection

Our scanner runs 15+ security patterns against your codebase:

Category	Examples
Critical	Unprotected selfdestruct, delegatecall to untrusted targets
High	Reentrancy, tx.origin authentication, unchecked calls
Medium	Missing access control, frontrunning risks, oracle dependencies
Low	Deprecated patterns, missing visibility specifiers

Runtime varies with repository size, language, network access, and whether AI verification is enabled.

Stage 2: AI Verification

Raw pattern matches include false positives. Our AI layer:

1. Analyzes context - Is this pattern actually exploitable?
2. Checks mitigations - Are there guards the regex missed?
3. Prioritizes findings - Which issues matter most?

This layer is intended to reduce noisy pattern matches, but it does not guarantee a fixed recall or false-positive rate on an arbitrary repository.

Stage 3: Probe or Audit

For deeper automated analysis, the selected Probe or Audit may:

• Builds knowledge graphs of contract interactions
• Generates exploit hypotheses based on attack patterns
• Tests invariants to find logic bugs
• Simulates attack scenarios across contract boundaries

Stage 4: Human Validation

For separately scoped Boutique Audits, senior auditors:

• Review AI-generated findings
• Analyze complex business logic
• Verify exploit feasibility
• Write detailed remediation guidance

Connected Repository Workflows

Beyond one-time scans, FirePan provides:

PR Checks

Configured GitHub events can trigger a security scan. Confirm the event and enforcement settings for each connected project before treating the result as a merge gate.

Connect repositories through the FirePan GitHub App. See CI/CD Integration for the supported API paths and how to pair FirePan with open-source analyzers in CI.

Dashboard Alerts

Get notified when:

• New vulnerabilities are detected
• Risk scores change significantly
• Dependencies have known issues
• Findings are resolved

Trend Analysis

Track your security posture over time:

• Finding counts by severity
• Time to remediation
• Code quality metrics
• Coverage statistics

Security Boundaries

Data Privacy

Use the current Privacy Policy and any written order form for the controlling description of data processing, retention, subprocessors, and security commitments.

Accuracy

• Automated findings can contain false positives and false negatives
• Detector coverage varies by language, repository, dependency, and scan type
• Human review should be used for critical decisions
• A repository scan is not deployed-contract or on-chain surveillance

Next Steps

• Scan - Quick vulnerability scanning
• Probe - Investigate a repository baseline and compare later results
• Audit - Comprehensive security analysis
• CI/CD Integration - Automate your security workflow