Auditra.
Auditra is an intelligent command-line security tool written in Rust that automates pre-audit vulnerability analysis for Solidity projects across Hardhat and Foundry. Instead of relying exclusively on rigid pattern-matching heuristics, Auditra equips an autonomous reasoning agent with workspace navigation and file inspection capabilities, analyzing multi-contract business logic, state machines, and edge cases—and automatically synthesizing reproducible Foundry exploit tests as proof-of-concept evidence.
- Role
- Systems & Security Engineer
- Domain
- Smart contract security · Autonomous AI agents · AST traversal · Exploit generation · Developer tooling
System at a glance
What the system does
Contextual multi-contract security reasoning
Project-aware Hardhat & Foundry discovery
Automated Solidity exploit test generation
Structured vulnerability reports & PoCs
Architecture flow
From intent to verified state.
- 01
The CLI indexes the target Solidity codebase, parsing project configurations, dependencies, and contract trees.
- 02
An autonomous agent traverses contract relationships using scoped file-reading and syntax inspection tools.
- 03
The reasoning engine detects complex vulnerability patterns including reentrancy, access flaws, and accounting discrepancies.
- 04
For each verified finding, Auditra synthesizes an executable Foundry test script that triggers the vulnerability.
- 05
Auditra compiles a comprehensive pre-audit report containing severity classifications, vulnerability analysis, and PoC code.
01 / Autonomous reasoning
Context-aware security analysis beyond static regexes
Deep multi-contract reasoning to uncover protocol logic bugs.
Deep multi-contract reasoning
Evaluates how contracts interact across inheritance chains, external interfaces, and proxy delegate calls where static analyzers fail.
Business logic flaw detection
Identifies state machine vulnerabilities, authorization bypasses, and accounting errors in complex protocol workflows.
Contextual false-positive reduction
Uses LLM reasoning grounded in concrete codebase artifacts to weed out benign patterns and theoretical non-issues.
02 / Exploit synthesis
Automated proof-of-concept test generation
Transforming abstract security findings into verifiable executable tests.
Executable Foundry PoCs
Automatically generates self-contained Solidity test contracts that set up malicious states and execute attacks to prove vulnerability impact.
Developer-verifiable evidence
Replaces ambiguous security alerts with concrete forge test commands that developers can run locally to reproduce bugs.
Non-invasive detection scope
Strictly focuses on detection, validation, and reporting without altering project source code unexpectedly.
03 / Framework integration
Native Hardhat and Foundry workspace parsing
Deep integration with standard Solidity project layouts and dependencies.
Project layout detection
Automatically identifies project structure, package managers, and compile configurations across Hardhat and Foundry environments.
Dependency graph mapping
Resolves external library imports (OpenZeppelin, Solmate) and internal contract hierarchies to maintain full contextual scope.
Fast CLI execution
Implemented in compiled Rust for rapid directory traversal, AST processing, and low-memory execution across large smart contract suites.
04 / Pre-audit reporting
Structured risk classification and audit workflows
Equipping engineering teams with actionable security reports before formal audits.
Industry-standard classification
Categorizes findings according to severity (Critical, High, Medium, Low) and standard vulnerability taxonomies (e.g. SWC Registry).
Actionable remediation advice
Provides clear, code-level explanations and suggested architectural fixes alongside exploit proofs.
CI/CD pre-audit gate
Designed to run in automated development pipelines before professional audits, dramatically reducing audit cycle time and security review costs.