A transparent explanation of how we analyze smart contracts, detect vulnerabilities, and generate security reports — and where our limitations are.
Try Free Audit4
Languages supported
10+
Vulnerability classes
60s
Analysis time
Free
Always
Six stages, from paste to PDF.
You paste your smart contract source code directly into the auditor. We accept complete contract files or individual functions. Supported languages: Solidity, Rust, Move and Vyper. The contract is never stored permanently — it exists only for the duration of the analysis session.
The contract code is parsed and analyzed for structural patterns associated with known vulnerability classes. We check function visibility, state variable ordering, external call patterns, access control modifiers, arithmetic operations, and event emissions against a library of known vulnerability signatures.
An AI model analyzes the contract's logic, identifying vulnerabilities that pattern matching alone misses — including business logic errors, incorrect state machine transitions, and complex multi-function reentrancy paths. The AI reasons about the contract's intended behavior versus its actual implementation.
Each finding is classified by severity: Critical (immediate exploit risk), High (significant vulnerability), Medium (moderate risk), and Low (best practice violation). Severity is determined by exploitability, impact on funds, and likelihood of real-world attack.
For each vulnerability found, the auditor generates specific fix recommendations — not generic advice, but contract-specific suggestions referencing the exact functions and line patterns that need changing. OpenZeppelin library alternatives are suggested where applicable.
A 0-100 risk score summarizes the overall contract security posture. Lower is better. Contracts scoring 80+ qualify for the Blockhertz Security Stamp verification program. The full report is exportable as PDF.
14 core classes, spanning pattern matching and AI reasoning.
| Vulnerability | Severity | Detection Method |
|---|---|---|
| Reentrancy | Critical | Pattern + AI reasoning |
| Access Control | Critical | Pattern matching |
| Integer Overflow | High | Arithmetic analysis |
| Oracle Manipulation | Critical | AI reasoning |
| Flash Loan Vectors | High | AI reasoning |
| Unchecked External Calls | High | Pattern matching |
| Delegatecall Injection | Critical | Pattern matching |
| Timestamp Dependence | Medium | Pattern matching |
| Self-Destruct | Critical | Pattern matching |
| Signature Replay | High | AI reasoning |
| Unprotected Initializers | Critical | Pattern matching |
| Front-Running | Medium | AI reasoning |
| tx.origin Auth | High | Pattern matching |
| Price Oracle Manipulation | Critical | AI reasoning |
Solidity
Ethereum + EVM chains
Rust
Solana programs
Move
Sui + Aptos contracts
Vyper
Ethereum alternative
The Blockhertz AI Auditor is designed as a free first-pass pre-audit tool. It is not a replacement for a professional manual security audit.
Understanding what it does and does not catch:
For any contract handling real user funds or assets, use the Blockhertz AI Auditor as a first pass to catch obvious issues, then commission a professional manual audit before mainnet deployment.
| AI Audit (Free) | Manual Audit | |
|---|---|---|
| Stage | Development | Pre-mainnet |
| Time | 60 seconds | 1–4 weeks |
| Cost | Free | $5K–$200K |
| Best for | Catching obvious issues | Production deployment |
| Misses | Complex logic | Almost nothing |
| Report | Instant PDF | Detailed document |
Paste your contract and get a complete security report in under 60 seconds. No signup. No credit card. Always free.
Open AI AuditorNeed a professional manual audit? View our smart contract development and security services →