Skip to main content

How It Works

FirePan combines AI-powered analysis with human expertise to deliver comprehensive smart contract security.

The AI + Human Hybrid​

Our approach leverages the strengths of both automated and manual analysis:

┌─────────────────────────────────────────────────────────┐
│                   Your Repository                        │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│              Static Pattern Analysis                     │
│  • 15+ vulnerability patterns                           │
│  • Solidity/Vyper support                               │
│  • Sub-second execution                                 │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│              AI Verification Layer                       │
│  • LLM-powered false positive filtering                 │
│  • Context-aware analysis                               │
│  • Exploit hypothesis generation                        │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│              Human Review (Audits)                       │
│  • Senior auditor validation                            │
│  • Complex logic analysis                               │
│  • Business context consideration                       │
└─────────────────┬───────────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────────┐
│                 Actionable Report                        │
│  • Prioritized findings                                 │
│  • Remediation guidance                                 │
│  • Code snippets and fix suggestions                    │
└─────────────────────────────────────────────────────────┘

Analysis Pipeline​

Stage 1: Pattern Detection​

Our scanner runs 15+ security patterns against your codebase:

CategoryExamples
CriticalUnprotected selfdestruct, delegatecall to untrusted targets
HighReentrancy, tx.origin authentication, unchecked calls
MediumMissing access control, frontrunning risks, oracle dependencies
LowDeprecated patterns, missing visibility specifiers

Runtime varies with repository size, language, network access, and whether AI verification is enabled.

Stage 2: AI Verification​

Raw pattern matches include false positives. Our AI layer:

  1. Analyzes context - Is this pattern actually exploitable?
  2. Checks mitigations - Are there guards the regex missed?
  3. Prioritizes findings - Which issues matter most?

This layer is intended to reduce noisy pattern matches, but it does not guarantee a fixed recall or false-positive rate on an arbitrary repository.

Stage 3: Deep Analysis (Audits)​

For comprehensive audits, our autonomous agent:

  • Builds knowledge graphs of contract interactions
  • Generates exploit hypotheses based on attack patterns
  • Tests invariants to find logic bugs
  • Simulates attack scenarios across contract boundaries

Stage 4: Human Validation​

For boutique audits, senior auditors:

  • Review AI-generated findings
  • Analyze complex business logic
  • Verify exploit feasibility
  • Write detailed remediation guidance

Connected Repository Workflows​

Beyond one-time scans, FirePan provides:

PR Checks​

Configured GitHub events can trigger a security scan. Confirm the event and enforcement settings for each connected project before treating the result as a merge gate.

# Example GitHub Action
- name: FirePan Security Check
  uses: firepan-labs/security-action@v1
  with:
    fail-on: critical

Dashboard Alerts​

Get notified when:

  • New vulnerabilities are detected
  • Risk scores change significantly
  • Dependencies have known issues
  • Findings are resolved

Trend Analysis​

Track your security posture over time:

  • Finding counts by severity
  • Time to remediation
  • Code quality metrics
  • Coverage statistics

Security Boundaries​

Data Privacy​

Use the current Privacy Policy and any written order form for the controlling description of data processing, retention, subprocessors, and security commitments.

Accuracy​

  • Automated findings can contain false positives and false negatives
  • Detector coverage varies by language, repository, dependency, and scan type
  • Human review should be used for critical decisions
  • A repository scan is not deployed-contract or on-chain surveillance

Next Steps​