BlockchainBlockchain / Security · 2024

Every contract, adversarially reviewed

Aegis Protocol scans smart contracts for the exploit classes that recur on-chain and flags them before deploy - right inside the pipeline. We built the analysis engine and the tooling that makes a security review part of every commit, not a scramble before launch.

Commission a build
client
Aegis Protocol
timeline
9-week build
role
Static analysis, contracts, developer tooling
platforms
Web dashboard, CLI, CI integration

§ Overview

On-chain, a missed vulnerability can become an irreversible, expensive one - and audits usually happen too late and too rarely. Aegis needed to move security left: an engine that understands the recurring on-chain exploit classes, wrapped in tooling that runs on every commit so problems are caught while they're still cheap to fix.

01Problem

Audits happen too late to help

A manual audit right before launch is expensive, infrequent, and misses everything introduced afterward. On-chain, that gap is dangerous: the exploit classes are well known, but nobody checks for them continuously. Aegis needed security that ran on every change, not once a quarter.

02Method

Move the audit into the pipeline

We built a static-analysis engine that models the recurring on-chain exploit classes, then wrapped it in a CLI and CI integration so a review runs on every commit. Findings come with the exact line, the exploit class, and a fix - fast enough that developers actually keep it on.

03Result

Continuous security, not a one-off

Aegis turned auditing from a launch-day event into a check that runs on every push. Teams catch vulnerable patterns in under ninety seconds inside CI, with zero false-negative criticals on the test corpus - so the worst class of bug never reaches a deploy.

Security posture

Hardened by discipline

On-chain, a plausible mistake can become an irreversible one. Every item below was a non-negotiable.

  • [✓]Turned a once-a-quarter audit into a check on every commit
  • [✓]Modelled 40+ recurring on-chain exploit classes in the engine
  • [✓]Delivered findings with the exact line, class and a fix
  • [✓]Kept full CI scans under 90 seconds so teams keep it on
Audit ledger

The numbers of record

Contracts scanned

across teams

1,200+

Exploit classes

detected

40+

Missed criticals

on the test corpus

0

Full scan

inside CI

<90s

./procedure

How we built to audit grade

build.log
$ step 01

Parse

Contracts are parsed into an analyzable model of their real control flow.

$ step 02

Analyze

The engine checks each path against known on-chain exploit classes.

$ step 03

Report

Findings surface with the line, the class and a concrete fix.

$ step 04

Gate

CI blocks a deploy when a critical is found, so it can't slip through.

Aegis caught a reentrancy pattern in CI that our manual review had missed. It pays for itself the first time it's right.
Tomas VegaLead Engineer, Aegis Protocol
Stack

Analysis

Static analysisSolidityFoundry

Tooling

CLICI/CDGitHub Actions

Platform

Web3PostgresDashboards

Have a blockchain project in mind?

Book a free consultation and we'll map out how Beeva can help you ship faster.