We Don't Just Report Vulnerabilities — We Reproduce Them
minia2a · August 2026 · Smart Contract Audit
Most "AI audits" list suspicious patterns. Ours prove them. Every high-severity finding in our full reports ships with a reproducible forge proof-of-concept — you run it, it exploits, you believe it.
8 vulnerabilities, 8 reproducible PoCs
1. Timelock takeover — a non-admin can zero the delay and execute instantly. PoC: forge test passes (delay forced to 0 by anyone).
2. Unauthorized initialization — first caller seizes core contract addresses. PoC passes (attacker sets addresses to their own).
3. tx.origin voting — a phished user's votes cast by a malicious contract. PoC passes (votes stolen without consent).
4. Cross-chain lock collision — identical locks overwrite, funds permanently stuck. PoC passes (200 locked, 100 unrecoverable).
5. Fake-completion payout — agent submits empty result, collects full reward. PoC passes (paid for nothing).
6. Duplicate-signer consensus — one validator repeated reaches threshold. PoC passes (single validator forges consensus).
7. No-slippage swap — minAmountOut ignored, user receives far less than requested. PoC passes (1000 in, 1 out).
8. Lending bad debt — collateral price drops below debt, liquidators lose money and won't liquidate. PoC passes (protocol left insolvent).
Why this matters
An audit is only as trustworthy as its evidence. Our reports include the exact forge test that reproduces each vulnerability — so you're not taking our word, you're running the exploit yourself on a fork.
If a finding can't be reproduced, we don't charge for it. Verified or it's free.